{ "Event": { "published": true, "date": "2026-05-31", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-31", "timestamp": 1780272181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "26d4949a-c464-4eec-95ab-f0fb197d636b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dffcb65-5d27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256016, "uuid": "7d14ca15-cf3d-421e-8c3b-fb579ddd42a1", "comment": "Malware payload (Mirai)", "value": "367f71dc85c31db55a5eda5aead05790", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256016, "uuid": "e5fd863e-225c-4a8b-ac0b-a3cce8728c90", "comment": "Malware payload (Mirai)", "value": "0170f0e281476c453322a2c7390c63bce33f19b80e6a6c0f3b7ecc74ce126d6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256016, "uuid": "1dd0b72a-7e41-462a-9e94-b37ac256088e", "comment": "Malware payload (Mirai)", "value": "dfe673b10cf5188eb8d4d47604a397d03dbb2c46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256016, "uuid": "be3aec83-1e07-4b29-9ad8-02623126ce64", "comment": "Malware payload (Mirai)", "value": "2cd0170989132d8aeaad257e36e97f6729f64afa4344ce34eba1ce06c6b4a54bf1668e6c2ceccb030989522633ab4dba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256016, "uuid": "7cb07ba2-d7ae-46ca-83d1-16d195298f8a", "value": "T1320429027B0D0B43E1531EF0277B07E183ABAD6629E5E584750ABECD93B1DB16506ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256016, "uuid": "f1fec62a-59a0-431d-973e-4fe9db2c11d5", "value": "3072:/5WPEIMbEl3D26OxGv+mpeeWDe6jDSbrwH4K4uMD:g/AE5Ox9mpeeWDeODSnwHOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256016, "uuid": "e3ea2ae1-f3ea-497d-b554-ab7caa8f60c5", "value": 180200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256016, "uuid": "531ec30c-c9ad-408c-b07c-07b83640d8ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256016, "uuid": "3745606b-c9b3-460e-8fd9-b9d5b5208255", "value": "wife.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ffd526-5d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780254640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254640, "uuid": "2dffa785-e1d2-4fc6-ae08-58644b2b76d6", "comment": "Malware payload (Mirai)", "value": "8700d82bff312c20af81fa7cc6daea4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254640, "uuid": "9765373b-6a0f-4082-8c4a-e5a470d0c857", "comment": "Malware payload (Mirai)", "value": "02fb061df966f336d74fcb6e51b8b584dfc07dc139a9cee8b669d956cbdb3090", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254640, "uuid": "4bd45d16-2448-4509-965d-d6a9eb09a289", "comment": "Malware payload (Mirai)", "value": "7c150728ea36c4d68a960dca349afbdfa4e6486b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254640, "uuid": "46149e21-cdfd-47c1-a652-877490bf1eef", "comment": "Malware payload (Mirai)", "value": "0f5752f396645f7bfce32a951af7b78862a8cb284cc696ce0b80b4efd3a33e05e8230ce32d58e81d25811434f655be17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254640, "uuid": "4de4eab8-b8db-4261-b842-9bb5ab31428e", "value": "T1FCF31A46F8819B16D5D112BAFE1E028E33231B78D2DE72129D249F707B8B97B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254640, "uuid": "a050c45d-fab1-4ea9-90be-6d284531c93a", "value": "3072:XqcC7qdQ/VO2sXSafUDUELnokg85J/ZN2M:fCC0VmXSafOUEL5JBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780254640, "uuid": "347be542-ab69-492c-a37f-168f93bbe31a", "value": 170448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780254640, "uuid": "2e98c1e2-fffd-4726-9594-7011d15ba72b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254640, "uuid": "c0b6462e-4df5-4d79-a98b-8b3d38f54a3a", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15eaac77-5ce2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780226152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780226152, "uuid": "3b989514-7a82-4dd7-a957-60ade9dca5db", "comment": "Malware payload", "value": "6a57d0560241e9f5839a4bb7dd21eadb", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780226152, "uuid": "cc428f6d-bc12-4e04-becf-c72faa0ce79b", "comment": "Malware payload", "value": "0614449d5ede73eee9b3ac6538eaa0b5c1b6a9a39703f7e6ff87d9c252328584", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780226152, "uuid": "d640eed4-908e-4e54-8f0f-e29e5d024996", "comment": "Malware payload", "value": "c567dfa2cf3da6f9688a13e513dfccfa71a2d05c", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780226152, "uuid": "224019c1-5261-49c3-b385-fc06babf7c02", "comment": "Malware payload", "value": "f52841a97a471f73f69801920fc38b26132127ed78c48b280ebd0a233c106106e68896bb0345dd75663b8e3a79f51589", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780226152, "uuid": "0a403f48-9f16-45e8-910d-def7bea7515f", "value": "T1508287CABAD1E0A0D75AD6BF3A3646C1D26F0D91A3D99798F31874E5FC9010472BC748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780226152, "uuid": "4a1f0306-c646-4928-baff-ab5f10846f90", "value": "384:QT7cvYa464+pP1lBN+1WuE9KqARBnkoyban6EzQRD2xEUuEXkVklKmB:Qfcve+F1x+YuE9KqARBnkoyban6Ecgxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780226152, "uuid": "45b9daf1-7749-4ea4-9beb-415b9820f3c7", "value": 17975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780226152, "uuid": "5d769797-dffd-429e-8541-59dac9f9f7c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780226152, "uuid": "11390d88-ec12-456d-b117-6388d082bf5a", "value": "main.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bcc361c-5d28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256388, "uuid": "61587858-7bc7-4ba2-b0c1-2deb7ff446aa", "comment": "Malware payload (Mirai)", "value": "38809cd6d4b3dca6c8c2819ebf8442b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256388, "uuid": "5895c8af-75e7-442d-b70d-c04cf369e2a9", "comment": "Malware payload (Mirai)", "value": "0701530763ac1258cbdf3d65dfb92ad331bdb8bdb8db0e601df5f8dcf63e119e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256388, "uuid": "6cff7046-c672-437f-ae99-14f9f1bcc11e", "comment": "Malware payload (Mirai)", "value": "d310512faf7085ac1fc7268379742992208e6143", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256388, "uuid": "89eaf73f-90fa-4e6a-a6d5-3982ae65d4a0", "comment": "Malware payload (Mirai)", "value": "1f2a87e18cb49870c84b98caca57f54a0485813525d633b4e9ce839ace0477edf2eae30160215ace5043ab78a9c6eb2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256388, "uuid": "66420c42-d1c8-43b0-8470-eb8cc1b3da28", "value": "T12943122A6384C653D4305074687F8845E15ECA6473D77892D3766C7824EF7CF38BABA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256388, "uuid": "e5a8eb2a-9db4-44c1-a36b-7430651fbb8f", "value": "1536:HO2Ah3NnujxAxvGgVn7N+M2WFeJ6oSKfq1zBQT:HO2KNnYxAN/74ZoeQoSl1aT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256388, "uuid": "601ff35f-02e0-4092-8db3-86b82831eefd", "value": 58408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256388, "uuid": "3981a76f-ace6-4781-b464-46bfb2728f10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256388, "uuid": "3527f697-1706-45a2-9166-2f484dfcdd96", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facf797a-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780271204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271204, "uuid": "dda3834e-f04b-4693-8258-d59d09541040", "comment": "Malware payload", "value": "1c6fa187212f90226ccafac3cad610cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271204, "uuid": "68562125-5976-494d-be3d-c01d2471d842", "comment": "Malware payload", "value": "077c330c66a4296f9eafe9ac37c0fb8d965490243e46e01f8054f7e8cae58576", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271204, "uuid": "bc169de8-68c4-4c00-bd2b-d0a07deb372d", "comment": "Malware payload", "value": "3ff0e37b9ba0b059cb6a01158ef716ab450e2cd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271204, "uuid": "d354ff04-0198-4d32-9598-889e95912698", "comment": "Malware payload", "value": "a62090422da64c8498e3154b01d431fbbac68d8acfc515736188a6e90d2ad7f805107f4c5f34b782686c8b9c76c2a609", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271204, "uuid": "660ea142-c5ed-45f0-ac69-663f5171e2bd", "value": "T163C30A46F8819F15D5C151BAFE0E124E77231B3CE2DE7202AD246B747B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271204, "uuid": "937562e4-0f89-4997-a6ae-59723c8ddd12", "value": "3072:PcJKDrbpDDeZe9Ta7jsoevwjazuopt2ij:5Dq49Ta7ooeFBptnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271204, "uuid": "ec0d7f16-f2ef-45fe-b4db-3cad2d337d7f", "value": 125536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271204, "uuid": "d6b430ce-5a52-47b2-863b-782f418d84c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271204, "uuid": "2339587f-b2eb-43ec-b2fb-6822ba2a7f67", "value": "gov.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1850585-5cef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780232023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232023, "uuid": "4d2bb50e-78e1-43c6-acf6-b712ce079f4b", "comment": "Malware payload (Mirai)", "value": "5d847f741fe2b02cf39a4159393153b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232023, "uuid": "53249aac-40af-4f96-a2d4-c18b263e2445", "comment": "Malware payload (Mirai)", "value": "08031510f552af30e310fb3fa81186c48c2c2df41173b8045ab2876f94c1c4c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232023, "uuid": "4b70e0f3-a2aa-499f-912c-5a416c239091", "comment": "Malware payload (Mirai)", "value": "49af23c637c78e3cd1688ec88189482c2d508c5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232023, "uuid": "d5085fb8-9942-4b4b-b1d3-0eb38fa44a8d", "comment": "Malware payload (Mirai)", "value": "3ecaa2cfdb368f19d15c0e20e70b457f357591143db7cbdf3e9734b9b9431e108c184c3a679f15ef2c737649bfda1bda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232023, "uuid": "6afa5961-e59d-409c-a3a2-bc8c9779508a", "value": "T1D543F162C9E8498DEDEAA1FD4C18CBD71BF4CDF672F1C99530425BE619475110BA2CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232023, "uuid": "353af931-dab5-4a74-858c-f494da8e9011", "value": "1536:gO7/aUzqv4YqHuXBhf4vItKsC4u+qgw09P:5baU+QYqHQf4vCKv4u+qgwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780232023, "uuid": "b4ef5e6d-845a-4b45-99e3-c0da90566bae", "value": 55148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780232023, "uuid": "ccb1aa76-5b10-46c3-8ad7-3dfcde45ecbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232023, "uuid": "bb47a390-3fe5-4c47-95aa-c910f25dbe9a", "value": "micro.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ada0908-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213302, "uuid": "a8b146f4-8a82-4df5-a375-9eef10566a0a", "comment": "Malware payload (Mirai)", "value": "fc4fd866d4b0a41249e1b866c903f093", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213302, "uuid": "857e1d4c-0254-4195-86e9-ee6f17e93ce8", "comment": "Malware payload (Mirai)", "value": "086bfc2e6ff24e84097b962e8f84701cfe9e41d2474d783aaa363c9c13d9f74c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213302, "uuid": "0d27d339-9ac9-482c-a5ec-6e9a2f5a532d", "comment": "Malware payload (Mirai)", "value": "0c125bad11e1c11a63558fee90332d6c67e7dd7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213302, "uuid": "0de78cd2-af69-4f91-abeb-e3f2ea166b7b", "comment": "Malware payload (Mirai)", "value": "e6cf2cfb8d27d4ba32433854655084d60497380aaf842abd4ad934092708fabdda2fb948de0ddbc129d1576924440fec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213302, "uuid": "a1771284-1510-41bf-863a-92d16d72b95b", "value": "T1D9534B02B31C0A07D1A31AB0253F5BD197BBEAD022F4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213302, "uuid": "49b64a64-04ec-444f-a11e-af054c49eace", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/MyV8SpXCpEM4q/J9KCrMvuBxANUr6FV+tMiwWhN:MvolWm+l1pXgd9KCAWBxANee++bWhfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213302, "uuid": "57627d34-666d-4c7c-a1c1-54013943ec49", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213302, "uuid": "cb5584b0-73da-409c-a4ef-fe31fdb64cb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213302, "uuid": "b91c95d0-cb38-48e6-9b09-232148ff4af9", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4728a3-5cdb-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780223321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223321, "uuid": "4a409000-22c8-4fda-b32a-e2513cfe3a89", "comment": "Malware payload (ValleyRAT)", "value": "8624de4818263016a4c33b767b38743d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stKCP", "colour": "#A5C96E", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223321, "uuid": "9c17109a-51ab-4bc1-81a5-7012fe34bc00", "comment": "Malware payload (ValleyRAT)", "value": "0896fae8bb43d572655a92a00c3ff411cca0ea1c928f0ab2f5778f698e391e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stKCP", "colour": "#A5C96E", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223321, "uuid": "ad3c1c68-c757-4e00-8636-f7a7eacc0266", "comment": "Malware payload (ValleyRAT)", "value": "70df531bf923e7859dd8c95541ece99bf972b1c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stKCP", "colour": "#A5C96E", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223321, "uuid": "b679005f-5a44-41ee-83bc-1ac81072832d", "comment": "Malware payload (ValleyRAT)", "value": "d86ba7a669dc554d102fcc74a26729fbb638fc88ee6b2ea77ca5147f8e3fe2adf22ee4b6d9982c34d3848611bcdc492c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stKCP", "colour": "#A5C96E", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223321, "uuid": "95ae7963-c556-4acd-97a1-bfc8f087318b", "value": "T1A4A5B6DAF88124E4FAEF6A3172173972812B3DA96E15B4FF4490F1921B374C12536E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223321, "uuid": "e79aecbd-44a3-49f4-8c10-12299f4d8bc4", "value": "f6849d05da821dd07600db9f44c3c8af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223321, "uuid": "f934dcbc-ee93-41a1-83d5-c86ce07d1464", "value": "24576:O955dhNDV46cevRx0555b55N5HIzLUQQYMgTmF1XIqwIGyZ0aC:O955nDpcGxJzLUtYMcmF1XIqwIGyZ0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780223321, "uuid": "5923b65b-f7e2-4b27-a856-5e0b088efb58", "value": 2141696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780223321, "uuid": "908b349f-d0d9-42a8-a5d4-412a91e9cc5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223321, "uuid": "e4f14d4d-1304-48b4-9902-074cf6d68d6f", "value": "BevySync.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410b1d22-5cf2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233096, "uuid": "d98b3a60-0f11-4885-8c17-3ddba5ad3da5", "comment": "Malware payload (Mirai)", "value": "c717bee8c0e6deba2f7802e4fc954f09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233096, "uuid": "82758164-ce64-40ec-b8ae-201de9d8e1a4", "comment": "Malware payload (Mirai)", "value": "08ac02ea396687d858dbb2ae46c116ec523bbae0fd48af262941601b78d2f5b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233096, "uuid": "192e1883-7434-4324-85e1-bf9f780d8ac4", "comment": "Malware payload (Mirai)", "value": "f3743b3b0b8c0e0f7fea792a06c5eb162d8526d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233096, "uuid": "67b4d0ee-f18c-4373-98d1-f9d90e7e5920", "comment": "Malware payload (Mirai)", "value": "1592a2033b3d2f44f521692d0b9cca86e1af7c994b581e5248031c7638918466fc23a585e63f471bb20c05d06e9eaec0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233096, "uuid": "646b4cb8-5d2d-43f3-be0e-f81812823566", "value": "T1E2243B46EB414B03C0D627B9F69F02453333DB6497EB73069928ABB43BC779A4F62605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233096, "uuid": "7464b42e-ceb6-4d3e-bf11-7a5d331a8e64", "value": "3072:q+fUbh2CsrCMtyvsUyaL0kkUWb5oDVnwdWZCbRTsV/Gv0:mb1HMtMHyaL0dUWb5CVZCbRTsV/Gv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233096, "uuid": "8d6e03f2-c037-4ba9-99c5-cc386d3a80b3", "value": 217592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233096, "uuid": "8d95b4ea-a38b-486d-8e44-d8fdcb9575af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233096, "uuid": "e9eb2285-2a92-47a4-a862-3e25b700ef6e", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5673d14-5cf8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780235842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235842, "uuid": "8e3c8edd-b689-4dfa-b8f8-cd1aeef81750", "comment": "Malware payload (Mirai)", "value": "eb50bef4cc3050b444955cc22dc96dd1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235842, "uuid": "c0f1fef2-5292-4923-be29-e09a21d64f55", "comment": "Malware payload (Mirai)", "value": "08c65eebf3c102885be33adb98df1c3b131c853227fdc98da8b5945901174c82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235842, "uuid": "b955fc8f-4705-460f-b572-438e1f27166a", "comment": "Malware payload (Mirai)", "value": "db6717b5b69794ccd68de7a55dafc27ff82cc923", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235842, "uuid": "6d9f71ec-ac2e-42f2-8a7a-4ed56784e161", "comment": "Malware payload (Mirai)", "value": "ff52a1f56d431f096244b777ae2ea73b8d4e5e52522180b13dd9b3430753fe1a163c8e27b681c9202f452a978dea0c19", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235842, "uuid": "a675c3f0-def6-451c-9024-a59410694fce", "value": "T103F068921B90002B0FB548C4F0FDC714210523B65F24422C7D8EC92077C42D7F77386A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235842, "uuid": "06cf17e8-4f23-4ecc-b5f8-7d4de1d9f385", "value": "12:yEdEqdwq4XmaZVgzd3/FFscll7qxObK4aF:ucHH7qx5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780235842, "uuid": "0683c332-d474-4faf-80a1-dfc779207f30", "value": 462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780235842, "uuid": "2a366dae-ba17-4991-a778-a8d076b1bdb9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235842, "uuid": "482511b9-b109-4357-9da4-c7fb19c6c825", "value": "jaws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4b3434-5cc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780211748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211748, "uuid": "9f86d9f4-24f7-43c5-bed6-5d1434c6c525", "comment": "Malware payload (Mirai)", "value": "2a2f46e54b518228c4c84221711dabfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211748, "uuid": "fd1b7077-a949-4a60-a6c2-3f71a7d5134a", "comment": "Malware payload (Mirai)", "value": "095e2f44c711be31eeb0740592a7778ad15b27e4c25eabdd95b01f8ce226c797", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211748, "uuid": "211cbcfa-3a62-4b0d-8ea3-631636db8429", "comment": "Malware payload (Mirai)", "value": "4ca61e59466aba39c0710f235ca0e0a276de0a66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211748, "uuid": "a470d2bc-ecdc-4ee9-974f-24a5334aa569", "comment": "Malware payload (Mirai)", "value": "dd6d0bbc38d9c795fbb76cb044c29e9a509d3580bad61c5299ee434f96bfbf3717d2d7d24fe316d1194bbb878168a7dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211748, "uuid": "a253bdb8-5aa5-4d7b-bcb6-0afd47da53b7", "value": "T12B63B65A2E218FEDF76DC73447B74E2167A923C622E1D784D29CE5001FA034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211748, "uuid": "6c63c7d7-55e5-433b-86cf-9f33518760ab", "value": "1536:CxZwvHy+gl35RWwJIA43QTXVneFkJUilF:kCPq35IwW3QTXzJUilF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780211748, "uuid": "aad0b59e-c180-4b70-8e45-d2987fce3531", "value": 68416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780211748, "uuid": "b0a6bbed-f5a5-4ebc-9115-7fc586f6dd89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211748, "uuid": "f96a98a9-35ea-4a5e-b7d7-4ae13e481610", "value": "2.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bf86d8-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780271140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271140, "uuid": "817f8419-785e-45f2-b4e0-ca15569522ef", "comment": "Malware payload (Gafgyt)", "value": "a709e832e1fdb8f5cb6d1d36ebac8fad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271140, "uuid": "b2d7cdd9-a64b-4c9e-be79-0313c2c6f86c", "comment": "Malware payload (Gafgyt)", "value": "0b07373e371b70bd3823db6086c7d1905965da6e4df0d594a96b5d232545af6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271140, "uuid": "ba7320d9-7ce6-4ec1-b0e8-f13a8239b38d", "comment": "Malware payload (Gafgyt)", "value": "1ff5cb463603bbbfc645f1a011e4e0a2568dc74e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271140, "uuid": "9fa51c27-e79c-4af2-8c94-a3ea9c4edc5c", "comment": "Malware payload (Gafgyt)", "value": "fbda7513ec6e30eed0301f8d6bf7e7c39d67714992b62d16ba0e89e23a81c5e1002d5809aabc6eabfc0fd2be14c29771", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271140, "uuid": "9d7f6a84-6860-4426-94f2-47786184557d", "value": "T1D6B30945F9509B17C6C255BBFF4E428C7B2A1758D3EE320399256F21379B8AB0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271140, "uuid": "5450cf81-73fa-4384-95d0-b9e2e9b3d360", "value": "1536:xeiIwyM6jRgB0P5uHUFPTd1EvGUavSEh0lucwywhqQ6JruIhQskbdpHcOZKvT:xC46joK5uHe51JUoTCO3+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271140, "uuid": "4ad6351a-eada-4ce2-9c4a-7c394bb5ceae", "value": 111876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271140, "uuid": "0cc892d0-baa8-44c7-8375-1483b9e426a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271140, "uuid": "56e372a2-02ac-4492-9e23-6a1b5b521882", "value": "gov.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33db4772-5c8a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780188407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188407, "uuid": "7cf72549-3de2-4ae8-85ec-996e14d9f759", "comment": "Malware payload (Mirai)", "value": "a3f301d8d12bfd23d5bf4a7d8de59983", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188407, "uuid": "08a645c9-4a05-4554-84ce-5313783ccf99", "comment": "Malware payload (Mirai)", "value": "0d492437b84cc829496821debf25d42b335f9799f4548bf7885a2aef41cfa18c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188407, "uuid": "80405762-cd5a-4e67-a785-cfffb7afadeb", "comment": "Malware payload (Mirai)", "value": "ba615645417157b176cb24d8b5dc8f2256597223", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188407, "uuid": "84ab8f75-c92d-446f-a72c-c955c3839e2e", "comment": "Malware payload (Mirai)", "value": "6dc112660a62574fe181e7c910273c0890375d31f9d0b5b70eee111bd6abe883747520fcad39fc305d1dcbe1df34f9e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188407, "uuid": "1df4af17-a65a-4b5f-ac5b-c5faa6225453", "value": "T14B73188678969A1AC6D0537BFA1E82CD3B2573CCE3CD7207CD119F6136CA92F0D6A191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188407, "uuid": "216c5bcc-5738-4c3f-973b-0b990c0247e4", "value": "1536:FVuza8aam2uLd70zAU3rWTKCdqrZFPK6:HUaZa805bWG9P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780188407, "uuid": "a84f3001-19f9-475f-af1c-2ab0b5a493ba", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780188407, "uuid": "6611e5f0-2233-4601-a747-9dc8a042575c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188407, "uuid": "8268daa8-5301-4943-ad1d-e9e74657181f", "value": "0d492437b84cc829496821debf25d42b335f9799f4548bf7885a2aef41cfa18c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b06ed89-5d2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257514, "uuid": "f8384450-73c9-47b0-aab1-05977c8f9ec2", "comment": "Malware payload (Mirai)", "value": "81fc572e1248ba019a608765fb3d5e08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257514, "uuid": "eff4bb89-7d62-4059-be06-313a72b1f551", "comment": "Malware payload (Mirai)", "value": "0e0195cb0b97b14af14b4ca9093bc43f777fc3ffb10332a9fe005b95ba1e5d2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257514, "uuid": "156703dc-229a-4e44-b5cf-2ca7f6c9ef4d", "comment": "Malware payload (Mirai)", "value": "116066c755dfb9cea73ad16c3749370925a50627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257514, "uuid": "07c07f1e-5920-409c-9598-75dde1c8e62c", "comment": "Malware payload (Mirai)", "value": "8ed207165020f5af5969abba2096394fb3cbcce30f4cfa254897f5ed40e90ea65bfeaa278cb4734c9e1274e4177ee94d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257514, "uuid": "15272ecc-5bb3-4a58-8f7e-f55e4bc479f0", "value": "T139530996BC82996BC5E027BAA55E518E3335A7F8C2DF3716CC114B10378961F0E7BAC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257514, "uuid": "830185e1-5f50-4f35-8efd-226980a4b55c", "value": "768:HMOtdRFp0IyI9pmm/4H7yhmJB0/mzfAUxeYvSNMzdVU3R/Pk9dZyd+4rr3KmjC2P:HME0IyIXfm/jxq2U3W9dZmjRCd38Hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257514, "uuid": "6e54a1d2-6f5b-4b85-bd9b-33071821df94", "value": 62784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257514, "uuid": "1f9b1415-8c8e-45b4-b73a-304c2042ceba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257514, "uuid": "c080e518-47fb-4b2f-a6cd-a1ac148f1f7b", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7a58f6-5d27-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780256122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256122, "uuid": "760d6a32-c417-4856-a1b8-631df335b645", "comment": "Malware payload", "value": "008f6abbede714f7c473e7976e1e58e3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256122, "uuid": "11e855c6-2315-487f-8eb5-44a24b734bc3", "comment": "Malware payload", "value": "0e3204f772b39614346d2e79ce32523ee9c77404519da2182ca7fa8c3b8d1573", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256122, "uuid": "23080d59-a896-4f58-a279-3f27b39211ca", "comment": "Malware payload", "value": "7dc7acdf67f20ccce105775fbae80fe80de6a812", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256122, "uuid": "011770ee-bce1-44c9-b719-84baeb0e5cdc", "comment": "Malware payload", "value": "d9eb4441d4e90f5565e9381d1975af8237ae7c90b08f7c91a38c4a119950ac678cf26fc9ef5f67032bf7347c35c85170", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256122, "uuid": "051b1fd3-15c9-43fa-82fc-8a2483ddf207", "value": "T16A136C6526953C25AE99883B5C7F2F0CBDA983E2304491DDBF8A3CF18C15A9CE71871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256122, "uuid": "6020b591-f62f-47d3-bdca-f38ee5967f4f", "value": "768:mr9NyXsZztCs9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:QHusZ0cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256122, "uuid": "8cf0e708-28de-401d-b001-503e3552b7c4", "value": 45506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256122, "uuid": "33f968f5-cb76-4133-84cf-5d8abaccf028", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256122, "uuid": "6ff7a3fe-29d0-44c4-9f34-c7fd65712a87", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2684a919-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213295, "uuid": "1b34b338-421b-47e3-a1cc-e909d30742ec", "comment": "Malware payload (Mirai)", "value": "a81d8551fd264636670a0ee2ddb2c118", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213295, "uuid": "ef022627-30ef-4925-9de2-b970e0be64cc", "comment": "Malware payload (Mirai)", "value": "10e3c8bb2f511fdfa0116796843e509b71b214f5f2eb99df62a2b18ca42401b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213295, "uuid": "048a0267-4c8b-4174-89d0-1f531c26c0ad", "comment": "Malware payload (Mirai)", "value": "f600661552afd6db853be7c42b67536ffbd53dd3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213295, "uuid": "8fd0f8f6-7d3d-4b91-ad2f-f0b408b9060a", "comment": "Malware payload (Mirai)", "value": "5a3f0e5e3515cc52c95f180f9c074d4b594e190bfcd6cf692971d6837f4c227eb1308492a0f3009481122e5c9f644f44", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213295, "uuid": "3beac307-4beb-4ef1-9c9f-1c35b86b3ad4", "value": "T1824123DF235317712DAAA963F3BA04047180D1969CE3BE94E8EC7DF4568DD847188E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213295, "uuid": "61de73fa-655c-4b6a-9552-be17080ffd90", "value": "24:vbauyd/sV/sQL/sbnHld/s/bM/spG/sX/sRSHZ/sdpN/sDh/sS/sI/sfueH:vbapG+FbnFG/HpRkUHKdp2uVvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213295, "uuid": "865c61cb-1e12-4357-89f2-a8e827811b8d", "value": 1950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213295, "uuid": "efc690bd-a39c-409f-b4ea-0e10f1811217", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213295, "uuid": "f017b59d-6a93-4e29-a16c-12d6a2890f8e", "value": "jack5tr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9028ec-5cf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780234621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234621, "uuid": "043bbfbe-8f90-401b-b780-676e815f8950", "comment": "Malware payload (Mirai)", "value": "87b6b85692fb6565dbc0aa90d9a8a8f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234621, "uuid": "433ac962-41dc-4643-9592-0d1013f24218", "comment": "Malware payload (Mirai)", "value": "117de0b11db3c0fe0a1654572bbc4e79d6d10f82e51c5dbd2e68b357fa830d08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234621, "uuid": "32df7975-51af-4ea7-93e0-0a56e721ca57", "comment": "Malware payload (Mirai)", "value": "2bf368e57a6a43db6f4d57ec4ce8dfbc3c70a745", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234621, "uuid": "dee379d0-24c0-40be-8d87-08d22304c98a", "comment": "Malware payload (Mirai)", "value": "b439cd095c5090bbec1bc23d2bcaa8aad594e7d2a753d3a1bf8ad43880922f53298acca375abf6b63fb0679bf25434b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234621, "uuid": "ea13c97d-c36c-49f8-a15c-0d4d2167a341", "value": "T199A32A85FC82865AC6D027B6B76D368C3352A3E5D2DF3207EC285B2527C919E1E77780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234621, "uuid": "e63ad4ec-0a4b-46a7-b97e-23306e96ba40", "value": "1536:VySVwomiEBbB9vkJA8oDt85O1jtstPIT0dohdRay5FFKzhZpGNYEmiJG+tUuYDKU:siEBbB9vuA8oDAO1x0q7zEiA+aM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780234621, "uuid": "d5d773e6-5130-4f74-a4b3-902614dccdc1", "value": 99792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780234621, "uuid": "4242a3d2-31f4-47a7-8476-da755ba7238c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234621, "uuid": "af6cb58f-23e7-48dc-a746-e55207781bf1", "value": "023782pler.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21aa8fdb-5d29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256666, "uuid": "7687748e-9343-46e8-bf63-28a0724c1aea", "comment": "Malware payload (Mirai)", "value": "7f9329f63a30825a13f165216bda4b71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256666, "uuid": "52ab0b12-ab06-4499-93e4-de414368c7f9", "comment": "Malware payload (Mirai)", "value": "11dd7d1b5521aa74234cd120cd82f5efee761da920a752709a3232e97669d47b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256666, "uuid": "a38b3091-28b2-47f8-9e6d-411448494ac7", "comment": "Malware payload (Mirai)", "value": "ebed70bf86c3dee88fc453fb4c5c91cac3132f2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256666, "uuid": "11d97cd6-7d2c-4bc9-8f07-ceb3d3a1c6cf", "comment": "Malware payload (Mirai)", "value": "b8d5933ebe9db10222b3f764eb412ba1b2f1aecde2eed8e9fa9422d42382e2cd9d20dce8e0af25cd6ab49e871198cb0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256666, "uuid": "64e9b0bd-34fb-4cbf-9917-fa77a9a60732", "value": "T19553025E4EDF8B25D4DC29FD43A44BD08D215BD1A46BCC1CD4AC3AA32A614E05FAB8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256666, "uuid": "dbddc545-905b-4647-832b-dfb2c00b3e5e", "value": "1536:vzgpH+fxkV6oJ0qRcQYpUSNqDUcExZJXYAb+rFQzOW2VyVJudI:LA+ZkQoGGcDOohJIAqvVyVQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256666, "uuid": "436bde67-81b4-4366-af4b-ef6a0fc0b59c", "value": 63580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256666, "uuid": "6991a2fc-8434-4927-b6cc-aa37d8197794", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256666, "uuid": "5b0d45c9-0f5d-472e-a7c0-67ca1cd467bb", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce917e1-5cf2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780233224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233224, "uuid": "74a665cf-b157-4b76-a049-8202d75dcef5", "comment": "Malware payload", "value": "b7853980172ba0d2aa561420dc5787b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233224, "uuid": "fb6c96ab-9265-43a9-b98a-bd4dfd056b06", "comment": "Malware payload", "value": "122d401e549ed15c3a1da53b6f042852f03fab7af4b7fba71d8a58311ec404f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233224, "uuid": "d34112af-a944-4cf6-b54c-4cdafb21653c", "comment": "Malware payload", "value": "be121b69cba5493124bc42cb8c416df09809b785", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233224, "uuid": "cb7cbb6e-9135-4c4c-ae11-9829633076c1", "comment": "Malware payload", "value": "f1e78ec46d648716e4511d4a8d78754d0c938df81698b95c60ccfd86438dc175fc448df19e436b425f8722a637689a87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233224, "uuid": "dc9090b8-f197-4636-a2eb-8067e2771c6f", "value": "T170D33C06B30D0947D1632EF43B3B27E1D3DFDA8124E4EB44651FAA8A9272D324589DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233224, "uuid": "b70c9105-dbaf-4088-ba55-b7f2ee3ed209", "value": "1536:+GJIcIvEG/xN69OexI2G4sEup7CmqxUb0yx0oxzIHEvAvZo20N3/7092wxSpdbt5:+cIvEwxQWL0ymogZvq3lbb5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233224, "uuid": "9bd7bcd9-5b30-40ce-b6f7-53875d7741ac", "value": 137916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233224, "uuid": "a703ab45-eccf-4def-a4ce-f4db84ce2f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233224, "uuid": "8a296b7f-43e9-4784-ba1e-00d551426915", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf66a297-5cfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780237603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237603, "uuid": "545c1450-aa59-44f8-b7d4-21be1bc4019e", "comment": "Malware payload (Mirai)", "value": "133589862793b4461f628e34077375dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237603, "uuid": "b921daf8-a726-4016-8700-d7abdabc56b4", "comment": "Malware payload (Mirai)", "value": "148cc68aa0b2d58ac074919dd75839c80debe5dde2d3d809c34414c8aff5461a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237603, "uuid": "c3cbccad-eb02-49b1-bdec-09e982fac431", "comment": "Malware payload (Mirai)", "value": "28b29a8b50a5e5140fcda5c3ad3c6acbe99621a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237603, "uuid": "a618838d-6336-4343-9907-a7673f870b5c", "comment": "Malware payload (Mirai)", "value": "c4fc7c59591fb7b3a4df1f200cf24d59cd188450ac18f287d47ad3c1c087e3254fe73ee41028c544cbbead9e976e0493", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237603, "uuid": "faee9745-9814-4215-ab24-f97e594849ce", "value": "T132549E67EB0A8CA6C19606F84ECB074D1773C0005F1BDBDB7E2C66386E5369E9D56B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237603, "uuid": "964234fe-00db-4ac1-b2be-afee5cbaebf7", "value": "6144:wUOFXVSP+q6f82HX0TDMbCUNrWdqgkG5fsoDtzrmsPk6:MFtF9HsDMO1dhk0tzrmsPk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780237603, "uuid": "5c6e5560-c062-4c97-a342-1ccf2166caa3", "value": 304856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780237603, "uuid": "2ba8daaa-a1a9-42ce-b659-44b3dcc65866", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237603, "uuid": "c8bcf8eb-2c29-47e6-b54c-bdcd5166b34c", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2636e6a0-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780214153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214153, "uuid": "73ccecb3-750b-4cfa-9c66-dff962521ae2", "comment": "Malware payload", "value": "296f9cfb626bec38491b5cefa6011682", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214153, "uuid": "57b95a7a-566f-4a63-85d1-924a4903c9e4", "comment": "Malware payload", "value": "16ee8d6af960e9af3b87feafe87addb6f805ab0657028a16f5069fe7093e0dfa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214153, "uuid": "24c91edb-edb5-44fb-9d2f-432fe5a1268d", "comment": "Malware payload", "value": "f65b3411be95915369b09f199252badc82939e7f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214153, "uuid": "6ea28b10-0e12-422f-a335-d298ab9939cb", "comment": "Malware payload", "value": "fbbf805eec805dafdb01c703c9c74be3dc85e9ad68fccfe0a025f8fb5baaa2717facb9398c3a12b424702c5a857421a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214153, "uuid": "a3fd1b49-757d-453c-9b24-13631d871c54", "value": "T1F517223BB387A83DF06A5735B572A9A0043B6EA1E4164C0692F4F85DDF314712E3F686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214153, "uuid": "7c9093fb-9596-444d-9d95-de5b3c244810", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214153, "uuid": "90ca1a22-00bd-4f7f-bb64-dca88f6992b6", "value": "196608:g54jIdIBDLr2t5hfenzF9Jo1+HxQy0SQd4:g5a0IBfr2t5Y9osH6yzQd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214153, "uuid": "80ebc00b-3504-4236-a8ca-362ffe1b2c34", "value": 19591275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214153, "uuid": "d170b581-5ce0-424a-9255-859ad5e19a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214153, "uuid": "f1c20aeb-1f35-4ef3-9ed0-1dc2fbc79f16", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd96332-5cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780237143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237143, "uuid": "a1b9f1ad-c394-4186-9199-57eb588bfcda", "comment": "Malware payload (Mirai)", "value": "ab76c2b6d05b0256e8739877f5866e50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237143, "uuid": "2773c358-aa9b-4cce-8a7c-46b156450fd8", "comment": "Malware payload (Mirai)", "value": "17376fb3abc1b6d956cb83c7392d96c8fd086a45951f52364eb510c3b3bfb7f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237143, "uuid": "6cc6486b-389a-4fc8-bb51-172907c7aa6a", "comment": "Malware payload (Mirai)", "value": "91a4efecbfa60d0abdf8257a56b418c2581fc57b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237143, "uuid": "c33ee016-336d-47cf-98a1-f64c16c516d7", "comment": "Malware payload (Mirai)", "value": "f83cdc949e00e706acedab8f1c523a351c4b38d71486a32cf65b46de98de162de73ec551564e6f19fc7dac795f83ae94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237143, "uuid": "732095f5-3279-450a-a9a9-a38661364e75", "value": "T147240B41BD518F53C5C32BBBB79F42993733672497EB3302EA186E742F4A69D0E26211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237143, "uuid": "5d224c2a-5c8d-4b57-bcd7-6bab3c2185c2", "value": "6144:qbdjHK2UzJAbvAKUzSepGE3gKZZqHtlqZ8ZU1fdt6VcSW:qbdjK2mJAs/zlpuKZZqHtlq+ZU1fdt6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780237143, "uuid": "512f4c2a-42a7-4dd5-b8fb-5f8f6b9cdb86", "value": 226864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780237143, "uuid": "acbe1920-3dd1-466f-ba54-92be820fc975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237143, "uuid": "3600c16e-0b2e-431c-bc80-bd0db39470f1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23728c37-5d0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780245502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245502, "uuid": "885c900f-373b-43e4-b15d-9838e3328a30", "comment": "Malware payload", "value": "c00142b5f6a459b832a228ea7e512091", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245502, "uuid": "4466a6a9-e131-4269-b49d-e924397f974f", "comment": "Malware payload", "value": "17417c0b4ff69745861a3ce338fd5b8bb9590bfd88ba6ce512c29d5d04760da1", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245502, "uuid": "0b3cd16a-79e5-4ed2-ae89-b2ea00fb57ea", "comment": "Malware payload", "value": "75ac36d1d0943fb6e1c24ab37123b00b12b0d1c6", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245502, "uuid": "f8b14c73-a1bd-492f-b300-c8eb78a0821e", "comment": "Malware payload", "value": "489762d530c770d1d5188d7c6214bb2fedf8ec41ca0acdc9217427c1893b7f6f55b4ce21ac46569399f211f427176e18", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245502, "uuid": "3fe442ce-cef6-41ed-902b-81bdec6ad28b", "value": "T14B08334C213EA93EDC5769FB2D2294F0B57CCD8394251DA35329726C3AEBD5124ACB8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245502, "uuid": "10f358fb-6f69-4b6f-a00d-4234996f3a66", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245502, "uuid": "54b4f602-f94e-4b78-9dfd-e54875cdb33c", "value": "1572864:nt9IKP5U66rdRWYyr1Kaln9rQ3EcZCpTJygPBa6QUJfBCVRpABSdrcYYb2zSU7:nUKxU66pRWzKG2EcOTJygPBa6hUzp3Zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780245502, "uuid": "f3ad9a5a-6176-4b83-b7c4-5c528e509892", "value": 77998021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780245502, "uuid": "e73c566a-e5df-4ad6-8330-f25ba956aad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245502, "uuid": "5dcb0ea1-1b61-477d-a047-d183dfa955fb", "value": "JennyMod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89b05da-5d2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780258288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258288, "uuid": "3812574e-a4ff-4696-a322-1c2c4ea68bc5", "comment": "Malware payload (Mirai)", "value": "315ea2d1a6ffcff845d0915a87a62f9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258288, "uuid": "892b4998-c691-4430-8fc9-5f8b13956970", "comment": "Malware payload (Mirai)", "value": "197c284efac9e6427209f7f984441dc1cd098d4c98a53e946dd2cd0a751cf638", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258288, "uuid": "80867794-831f-4fc0-ab39-a9860adc8925", "comment": "Malware payload (Mirai)", "value": "639ff5a9993e4a1f58af1eeda20c6b4170ffbca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258288, "uuid": "a4bb7d7b-dbfc-4628-9b3f-897fe762f37d", "comment": "Malware payload (Mirai)", "value": "7a462343f60c476adc9fff56edf32ba6e139dca1af2cc5a40f46ca54d2a81df7ca63ebd0eec9c9cfffc2ace85b3cd4d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258288, "uuid": "87475219-3b44-4b0e-8f97-3d77414ba6d0", "value": "T1D3F3AF97B30F2450C82206F45BCF5B5E2A2325015F6B9AE36C5E3B3AA6775DF180A3D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258288, "uuid": "dfd16804-2d96-4940-b5ea-f55221b65d0c", "value": "3072:nNnLADKNxQfdkTAWQtt/zHLswXEGWwKxKG/gCCDdFc2vwdq:nBLEKNxQfdV3H1XL+0GrCDdFczdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780258288, "uuid": "e6005c5d-eb60-46fe-93c1-b5cf55bacdd5", "value": 165596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780258288, "uuid": "addfb6b5-d4aa-4c91-9005-5a5dce48655d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258288, "uuid": "83356281-de5e-447d-b4d8-caebf275f524", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb7f80c-5cc7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780214919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214919, "uuid": "b6621e2c-90f4-48b7-b532-7699ab14446a", "comment": "Malware payload (Mirai)", "value": "0a5b88889cfffab531647f10bdb54512", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214919, "uuid": "005e8280-18cd-40da-830e-38ebdefc28f1", "comment": "Malware payload (Mirai)", "value": "1a4c7a29ab4732a467d77e7ed523ea76fd727afb0590f1730276b20a1acc151b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214919, "uuid": "8e888785-e99b-4f6d-9eb2-31c30436f292", "comment": "Malware payload (Mirai)", "value": "f941f3c02cd908167d918ad999f7e7869219a3ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214919, "uuid": "b6f29e8f-eee5-4664-b79d-efd9b6fcca57", "comment": "Malware payload (Mirai)", "value": "38e6ed749aea6d97c11463eebc300d480387ff4a606c357e83709f43baa70fa1a3cd9f4cefd8713130c1f91e372a1cc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214919, "uuid": "df35e2df-aa66-47ef-83b1-5ee5716b8fc3", "value": "T17244E80A6F910FF7C8AFDF3702EA0A1124CDE41727662B367638D974B60A54E59D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214919, "uuid": "3a62732f-f20c-44b7-9800-8127eee7d965", "value": "6144:B1+jOANQmdwC663gEX9G3u0M9jvbF1hWF5NqohrUken7MwA0:BUj1Qmdwt64wZvbF1hWF5NqohrUken7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214919, "uuid": "b3dc9d1f-c333-4793-a7e0-3cb58c17b46e", "value": 261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214919, "uuid": "997c19eb-33ed-4bf2-b4ed-16003ed72823", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214919, "uuid": "9a5d99a2-c68c-436a-bf45-7f04097ab30f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03932e0b-5d40-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780266494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780266494, "uuid": "5318a905-28cc-4338-86c6-0a0ba0d0d547", "comment": "Malware payload (Vidar)", "value": "c8843270fb53572aaa079eb82a8626f1", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780266494, "uuid": "61356c21-80c8-4797-83d6-f8b61b112228", "comment": "Malware payload (Vidar)", "value": "1b0650c39616cebd048c64891e34c9c76582fa7eb292b9ce8248ea8160896876", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780266494, "uuid": "7198bc1e-7284-4df4-beac-bbd07c3c34ed", "comment": "Malware payload (Vidar)", "value": "e2150db71efc2d9866b0026bdd0cf74310d08e4d", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780266494, "uuid": "74d94858-ad01-4c0e-88b5-0ada2523aca3", "comment": "Malware payload (Vidar)", "value": "a75d974ff9b939b5c92f0d14383a757eb07144f2eec51c90fd22e0a610b5e3d0621fb0cdf2e774328a4781aa0c73bd12", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780266494, "uuid": "ec4ed686-de6e-4898-bcf0-26802e368de0", "value": "T17036AD836926E0A1D86DB2B3691302287779FC65BB3523F7A98C25B06F713D045F9F60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780266494, "uuid": "2349c520-a1ec-4c73-b4f3-d3b9828a718c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780266494, "uuid": "8cbdf941-68df-4110-90b8-cfd509accc6a", "value": "98304:7yJSaP+QJhexdiDpgfUmEkziTK3Ti7Op/2pYyKZFVFD:7YSaPPJhexdiDpgAFK3Ti7OZPZFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780266494, "uuid": "62e0465a-6189-47bb-95ce-d0d132fd56b1", "value": 4918400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780266494, "uuid": "a888f668-f1f9-4929-a982-491150006d3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780266494, "uuid": "e0ec972a-5c64-414c-9b4c-b70d0f02e40e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ea9339-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780214359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214359, "uuid": "0d2c5a1d-3741-4bd8-9ef5-3e36d0cfae2c", "comment": "Malware payload (Mirai)", "value": "de3d43870bb92bc097e8e2c762e10af7", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214359, "uuid": "873f6344-7356-4b92-afdd-f1d4f4e79d2d", "comment": "Malware payload (Mirai)", "value": "1b26aa226b9b8f14e59adf1fed6bb0083253b30fdfbb37852a27950e8ca325b1", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214359, "uuid": "4d94ec63-ae4d-4209-80d9-79da00910045", "comment": "Malware payload (Mirai)", "value": "b7ec9502f001a3e3bc4f66acd3ec6bb9317db930", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214359, "uuid": "656237d0-3575-4ce1-8bf4-6ff8fc5a2dba", "comment": "Malware payload (Mirai)", "value": "013f0fc34879b17d868ecf35b6b1328be344c8ab31db8fdfb53261178b85b54387bfba63ab18877edfc696b84b6f56ef", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214359, "uuid": "ed3f9fa6-2ff2-403d-9df9-725629a09eb7", "value": "T1428423F566AA6135D828BF7877002180D439D81AADCF40D7CF8FA5EF9E37C1609A94D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214359, "uuid": "d6447bd3-93ca-4756-ac5c-fb22063fd634", "value": "6144:qIG6TWZGqf6lHr/8qeAK8Y1PRB+XF2e0SjW4liK9wyCi0cAcC12fkdkIo:ByIqf61jOCXF29SvX0sDfkdDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214359, "uuid": "bb865d66-93c5-4c64-aa77-e28c54172f44", "value": 406392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214359, "uuid": "ba142f85-9939-4c38-97d4-d3e0f1181c7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214359, "uuid": "3e0891c7-c52b-41a6-9080-3504d00ba742", "value": "blue.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d75b54b-5cbf-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780211240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211240, "uuid": "aa673702-9bf6-4d08-b59f-495d68491b87", "comment": "Malware payload (Vidar)", "value": "170d6056a834dcfedecfe26f94581544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211240, "uuid": "2bd198fb-fe3a-4a8f-8cf9-8ea98c1d30c1", "comment": "Malware payload (Vidar)", "value": "1ccf586b9486c8f06c27dd0c425481bf61b5e87066fda459eefeddf0917770a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211240, "uuid": "774a5174-5b0b-4ffa-acfd-cc3c2c3f6952", "comment": "Malware payload (Vidar)", "value": "d082932b505dbef00d9f45dd2d794c5bb5485744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211240, "uuid": "a95e147b-9570-4c69-a1e8-4ab6620da53e", "comment": "Malware payload (Vidar)", "value": "cc7f65f8b8498bab46c5f8852deff9f061346a37155084ec68caa51cb95399f50411e9860f16978b9794892089adfb17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211240, "uuid": "671f3669-ddd8-4910-b354-67651e533887", "value": "T14DC58C0B7CE048FAD4AA63328DA762917B71BC590F3263C72E5076382F726E49D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211240, "uuid": "e4e389f0-c7c6-44a6-ba5a-5da4208e196d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211240, "uuid": "c10f604f-513c-435c-a8b8-48b0e4fdbca3", "value": "49152:j473LqBs+ocie6u1aWordb3oICx0Y2lMLGJCnd+XBIy:juV1wbkrdbfmDNVnYx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780211240, "uuid": "0466b0d3-9556-42b1-84d5-838590f10563", "value": 2556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780211240, "uuid": "3a09c95e-4f32-4e1f-bea4-f085c279f8f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211240, "uuid": "fc32ddc5-adb9-491b-be1b-828afa9bb004", "value": "_____it__64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf3d648-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250081, "uuid": "244073d4-ae9d-48d1-aab8-d181334abcfc", "comment": "Malware payload (Mirai)", "value": "a85c2f85486e2597d94967c6c69e1137", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250081, "uuid": "a663f4c2-2a2f-4e59-81f5-16f57bd7d85b", "comment": "Malware payload (Mirai)", "value": "1ce9c129d19c9486e849393cdae519e5f99d449011c82a9764697c028acb71ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250081, "uuid": "09739ad4-01b8-42ee-9a20-2888a4b78145", "comment": "Malware payload (Mirai)", "value": "8fabe5ba166088bd18f0ad4391cbc01c87e15513", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250081, "uuid": "128cf369-1341-47f1-966e-dbd877174481", "comment": "Malware payload (Mirai)", "value": "74a4802eceb73bb185320c4eabf3312db93aadc98b07968907f0441a9e5402bebe691b810ecdf3726263e15150d970b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250081, "uuid": "2bf115b9-4b27-4c3e-8e70-9f4689935498", "value": "T1FBD3AD97F38B0551C86202F807CF5FDE6E2322C26E5B85E72D2E653A28790DF4906F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250081, "uuid": "d6c879a0-5496-4892-bb89-e5ba6ba5ce24", "value": "1536:k3NA/f3A72dILzQJ6yzGPHtOp4UlMU71nVYgXS/LWR:yWY72OwJPzgNOp4UX71nVYgXSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250081, "uuid": "cf142965-9818-41dd-904d-8f3be0321e82", "value": 132376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250081, "uuid": "69bcb065-4387-47dd-a262-65b32e519da7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250081, "uuid": "2bc448f5-bcaa-46ce-91fe-9b4c42d5c5b9", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a2a2b0-5c97-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780193959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780193959, "uuid": "6d54be49-53bb-442e-b5d6-9fec693b94aa", "comment": "Malware payload (Prometei)", "value": "88ff93e8c84e8cd3576a108b03ebb7ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780193959, "uuid": "73f2095f-efce-4f83-967d-642c48f4b52c", "comment": "Malware payload (Prometei)", "value": "1e941a0014542cd36a210ddc7f00dbdc77e8b0d877e0230f781c904f17fed123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780193959, "uuid": "0153f8bc-016e-42b0-a375-b7a9ed6dcf42", "comment": "Malware payload (Prometei)", "value": "4d633d854ca70d99c8099ea89bbb401a48e348d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780193959, "uuid": "7038ec89-bc65-47fd-81b1-043f0d12dd1e", "comment": "Malware payload (Prometei)", "value": "cdc6ff5c08da3cbbf2bb4243810fcf1d80d6efa3206bd883a74fe359aa60ff36951123e15e0794c5e7a9ca43afc3b4c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780193959, "uuid": "ad764cea-613e-4c1e-bf8c-2461c1b53de2", "value": "T102A423B4F9219E9F6DD769B91B24831DE082C172589D4C2313AE95A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780193959, "uuid": "e32e8964-e328-4c57-9de8-3ea6e43c604c", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdR:Fs6pyCC/Ya2hpi6T6N4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780193959, "uuid": "d910b4b1-e66c-4160-86f6-3b0f083d57ed", "value": 449077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780193959, "uuid": "b3402dd7-0d8e-4ad0-aae9-08519544e1ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780193959, "uuid": "e56b49e7-2bfe-4e84-859d-e4c3fadb8027", "value": "1e941a0014542cd36a210ddc7f00dbdc77e8b0d877e0230f781c904f17fed123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe91fa3-5d2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257462, "uuid": "ec12d95f-57ee-46fb-aefc-c950d39653a7", "comment": "Malware payload (Mirai)", "value": "fa5b37dec001c6249a09eaf5440f6a53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257462, "uuid": "deb5df2c-d520-4b98-be78-a26155b0f0b9", "comment": "Malware payload (Mirai)", "value": "1ec18651bd4351e964e2252fbcd1eada727f59b486a2790215c424d7e024a309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257462, "uuid": "bd9847bb-d67f-4329-bccf-450b89733745", "comment": "Malware payload (Mirai)", "value": "4de57469a8e4714bec6501d22669a803f277eaf2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257462, "uuid": "8bc84ff0-020a-4198-83f1-35641ef09dba", "comment": "Malware payload (Mirai)", "value": "ab89672053c313eafa05c3493592e5c7463ff5942e588bd6bf43ac887c9c04cd57f971c37d1301a79216297721a9c7a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257462, "uuid": "407ae599-94d0-4d35-9fee-8d34ac3b63f9", "value": "T1E2043A06B681C9FEC897D1F447EB9621DD31F81E0635769F6794BEA21E4AEE0270C360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257462, "uuid": "be598ad0-6b43-44b4-b348-4adfc21611e3", "value": "3072:YDQMpl573GiFkzN9uXEqr2rNHfW5z11nH5fE9Mt2ulvOYUEaMPlpr9:gQMpP73Gy0GXUujJW4pNnT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257462, "uuid": "bd281d18-8c50-4fd9-ac02-919f003b54b3", "value": 177280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257462, "uuid": "7f83ce8d-12bd-4761-b44d-457c21621f99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257462, "uuid": "3a2eb9d8-8a36-44ce-8a9a-b46dc3f0e060", "value": "wife.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688ea7f0-5c98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780194508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194508, "uuid": "1d80d883-5c8a-4070-905b-7afc76914e8f", "comment": "Malware payload", "value": "82ddea893b4db33263f14e17a686b75b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194508, "uuid": "740ebe85-6b54-483a-8396-d5857b5e91ef", "comment": "Malware payload", "value": "20ea8978c8c543e4d1b3947bb533277e3e1318eed2bc9570a1e4bf3daeb03123", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194508, "uuid": "e17e3ee0-de1d-4aa6-948b-4fc610754244", "comment": "Malware payload", "value": "22edb5065c94c76c7d700c9eeed3a08880f68f2f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194508, "uuid": "7e334aae-a5b6-434b-8bc6-e0b178532039", "comment": "Malware payload", "value": "49a37b9ebe6354c688c39347ae4755832ae0cfb4b4669b34654a84eaa1c57f5ae6867a023b4e0d16f4bf0ce8aece065f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194508, "uuid": "a1413b20-afc2-40eb-8483-bac9bd93d72a", "value": "T14321D48C3DE93A6A4D38CDCCF2A2AE05D11AE6CF33960A24E7C6363A5C981203D15F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194508, "uuid": "371ba0ef-08e5-4fc7-acd5-131233fb7017", "value": "24:QvQhBh9M0oy1ZdLqMbiiVKGLxZmLPxbinVKTLy:QvQhnoIRiaiFiV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780194508, "uuid": "14c7770b-c5b9-4f84-9c0a-6adc692f5c2b", "value": 1148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780194508, "uuid": "457d06a6-52c1-4695-bf02-da4c6a3a1eb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194508, "uuid": "b7d20c82-1aee-4617-a7cb-463a849e8e93", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74c5b8b-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250152, "uuid": "3ae86a69-0e46-4a2b-a964-724876287623", "comment": "Malware payload (Mirai)", "value": "3850078c97ed7a15ed84e3463a8ed54f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250152, "uuid": "643bf3d2-7207-4b42-9b1b-1c4b8bab5446", "comment": "Malware payload (Mirai)", "value": "210f49d1c1a2118c9c60528920d1fb36c7f4800f219d31974aca0506b685f2b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250152, "uuid": "df70fd42-4cfb-4789-9b3d-ff30dc121c53", "comment": "Malware payload (Mirai)", "value": "e9d8c7438c60a4a2967b1a59b21632d20049c3c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250152, "uuid": "06d6a272-7b9f-4b1d-bae4-de885de4d63c", "comment": "Malware payload (Mirai)", "value": "057f4c5c2c0f7d61ee065c026c3d7d91a1774df3c35c33ec3257fa3cc53e4366a41273f04819a011554aad59efc2f9d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250152, "uuid": "d933bb6d-ad1d-4a6d-82be-737bf97986e8", "value": "T189045C46EA414F13C0D6177AB7AF42493322A7A5D3DB73069928AFB43FC275E0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250152, "uuid": "ecc3c22c-464c-4100-9249-ead4079615c2", "value": "3072:XIDnSV5J1q4VKDeeLazo0ZwqK/T8T4JLMZH77ChKdeM/9+f6sf:XWnSV5J1q4VKfLazo0ZwqKr8TR77ChtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250152, "uuid": "68bb80db-b68a-4803-8178-4fc63f85d61d", "value": 186243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250152, "uuid": "fea58cbd-6d3c-4d3f-91c0-549a4f355754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250152, "uuid": "2c7a57b8-5f91-4550-b959-d2a107c2fc08", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7060cd0e-5d27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780255939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255939, "uuid": "047414e1-8f4d-4ca8-b0cd-de144454a25e", "comment": "Malware payload (Mirai)", "value": "d219d0171f4abd3f5b7102c3e16d4070", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255939, "uuid": "1ff7b558-ad36-4517-a9e1-593bac8d0d64", "comment": "Malware payload (Mirai)", "value": "2188a29ee434373ae6dd8ef6fa7b3fba77bf03cd7a53d70ff589087047860ba9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255939, "uuid": "1e1c65d4-8b14-4773-a286-423d9bdf4d1d", "comment": "Malware payload (Mirai)", "value": "2f4d9faba8e5a1961d14ffa5cb26803cc148a061", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255939, "uuid": "f55afadf-07d2-4839-b63a-03ea76e92f7f", "comment": "Malware payload (Mirai)", "value": "9103b6f4a380bd47b83b0638705a8e3f24bf2b52d17d6190a81fbbb610368a1ceb20ff230ac691d1a7e41b96111eb187", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255939, "uuid": "8337cb7c-b3a3-4d70-93a6-7a17d55dfa6c", "value": "T1B2E3854A6F228F7EF269877447F38E31975877D61AE1C680E1ACE5041F202CE645FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255939, "uuid": "68406e62-fe87-4cc7-befc-33cfd40087ae", "value": "3072:EM5/n0AaSg/SsAWjx1Wcvz9WuXvczryFjKeSf3NqkIKzKgGB:EMqASOWjxQcb9vXv+h13I3kKg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780255939, "uuid": "95fd41d4-0ccb-451c-bb4f-e854a151fc7c", "value": 153268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780255939, "uuid": "595256a0-2a93-47e7-bd75-48225cb69b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255939, "uuid": "0f3e636f-db32-4f28-aadc-a742e1c3571c", "value": "data.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46b9ba8-5cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233746, "uuid": "d90a55c6-26b8-47da-a602-f92059bcab6d", "comment": "Malware payload (Mirai)", "value": "9df566c92f53d6d42e9307c2e31d0292", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233746, "uuid": "a3d7e2cc-7ca8-4ab6-b7e0-eeaba26c8f86", "comment": "Malware payload (Mirai)", "value": "21e99667e2f0e73d12aae89f8cabd338426ab1fe4ce828ec93c07de615ef754c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233746, "uuid": "d0b5fa39-d90c-489c-9926-9213e8af1956", "comment": "Malware payload (Mirai)", "value": "3df02e35bce125d09cd83ce3cb9a6713ffdfec70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233746, "uuid": "d6b66ced-55aa-4a5d-b159-17de27e878ba", "comment": "Malware payload (Mirai)", "value": "aa13e9269d62089b24406e9977ee698b29434eb621ac05e1b0166ee3e9352fb52cc8841e849978e98f95c7192f2b0e5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233746, "uuid": "8e2476e8-0b06-44ba-a8b5-eb49c2deeaa0", "value": "T194145BA9BA0F6C41F2C2D3F9DE4C83E13E1735E3C7768971781202EDDAA39D95A90502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233746, "uuid": "fea851af-edb7-4d31-b1b1-ed71b9c61f02", "value": "3072:Gl0Pai5y5aBkKwbS7w1/lOwZ/7r3h9UmpV8MxDnoq:Gl0PayyIBkKwG7a/0wl7rRpV80noq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233746, "uuid": "2571da31-6dc7-4220-8777-6834bbba5628", "value": 190448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233746, "uuid": "ff30d336-c0a5-487e-953a-3d09a8a592ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233746, "uuid": "1772af8c-ddab-4be8-ad2e-f803c06a291a", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f1ceab-5ca9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780201676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780201676, "uuid": "92ad1a7c-f844-4bb1-9957-097b2f437b85", "comment": "Malware payload (Mirai)", "value": "c024015efd2c5ce2af2bcd7ce6607f1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780201676, "uuid": "1b6e4ece-b006-44c4-b366-59fa6f7aba8c", "comment": "Malware payload (Mirai)", "value": "223d762b0421fd4453c94837b1c37f67859f11aa3230bc823903c09e1f6d85e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780201676, "uuid": "1c6f83dd-768d-4711-96c9-94d57d06af85", "comment": "Malware payload (Mirai)", "value": "a631ba041f76b0f30967e9cf43684e72951ec3cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780201676, "uuid": "e42f8768-6463-45d7-b892-05ddb0045354", "comment": "Malware payload (Mirai)", "value": "b3092aebf4eeb4b997412d0938ab0f4648c852b7e7199bdfdf005297404f389760b1454bdb7b86c012487f1b5eb519d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780201676, "uuid": "70e2e5db-eace-4da8-9760-c1ea571711a4", "value": "T123432A31BAB11D2BC8C4987A72F34725F2F5478A20B88A1F3D711E8DBF6498036572B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780201676, "uuid": "54b6026e-d4de-4295-a999-22e4aaa1dc0a", "value": "768:sx7zOtva3YgFk2Vr5FzfZHRuMbdO+YmG5V+VWvrplVU1tDyIg:sx7/3fNVr5FzfWiYP5sVWvstDyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780201676, "uuid": "e917c69d-9469-4352-a6df-46c84a0bb904", "value": 55760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780201676, "uuid": "fbb3dadf-fc99-452f-98a7-37f9e41e0eae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780201676, "uuid": "2b2a7ef8-023b-498d-99d6-6ec117814ea2", "value": "9.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f507de5a-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250149, "uuid": "51d8afe1-7ee9-4a27-b3bd-ede85da643f1", "comment": "Malware payload (Mirai)", "value": "ae696d2159184a555c158d6df75b52f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250149, "uuid": "6a4129f6-1151-43a1-ac23-3bc16e91e7f3", "comment": "Malware payload (Mirai)", "value": "22907719d9650fc3231a6107ff598af3b0cc351abddd91a34fb112397fda7ea7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250149, "uuid": "45b330aa-07b4-4bfe-9143-ee3f77fbad8e", "comment": "Malware payload (Mirai)", "value": "d1007c88e369fbcc0dd531bce45dc988b1d58eb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250149, "uuid": "5bf7a198-33c2-4f2b-8227-5bd026facf11", "comment": "Malware payload (Mirai)", "value": "b34325e77fedcf17d602aa7ab86dc2e2bd6d60427f9582f1111b8d361211200345db2a447b3e0df412ead8336dd162ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250149, "uuid": "5178bdfc-9ed6-4faf-b43f-80ea2be49d87", "value": "T10673F691BCC28A2BC1E0137AB6AE658D3321B3E8D2CF711BCD504B20B6D551F1D6BE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250149, "uuid": "621b5438-850e-4b6d-9f48-99fe81a86f96", "value": "1536:UK17f6D/9FlNp/GIkkNdLJyHWmOsREvvJLseZ:UKhfM/9FlJLsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250149, "uuid": "0a620bc3-da26-460b-9c37-877ec4ea041e", "value": 76292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250149, "uuid": "c3c8f0e8-ab3d-431d-8059-52a822c45fb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250149, "uuid": "9fca9908-0a7e-42a9-b1ad-ef7026c4037f", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e8fcac-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "b8d2ae31-ca85-4710-9f5a-dfb784064c2d", "comment": "Malware payload (Mirai)", "value": "4b482bf3f1e30c0539b9a104d87a1ddb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "e47b7524-f67f-483b-923c-7a443688f323", "comment": "Malware payload (Mirai)", "value": "22ce1ff1ac6964a7e462063e3d728b19c7d7259a87789a9973b6811dea7c7403", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "fdbcf5a0-e8e5-4bec-a74c-9d6c34edbd7a", "comment": "Malware payload (Mirai)", "value": "f4658264347482e844e5b3b04d9e7313ab7800ae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "e940c45a-ba4f-4730-9743-ee4390173f70", "comment": "Malware payload (Mirai)", "value": "d376d594ee549f676272f9dc90e8c1aff4ff4a34067724abb9f1cc0e06b7fe4fde4b42c90e3ebe50121bd374fcc4be0f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "a4a3c798-534e-4153-a7a3-6b734916f014", "value": "T125E022AE9027A07664A4BA8DFD623820AA03F28036716F2C7DC3187170C46193132ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "509ccba5-09d9-4e2e-820b-0389c48d500a", "value": "6:hoWbnyS8eVfgkOYPeDyw9XQOvPV/gHd9XQOvPVcgHd9XQOvPVYPHdy:5SJafbOvPV/g9aOvPVcg9aOvPVYP9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213643, "uuid": "de5a5d79-9ad5-40a9-b783-efe2f197a355", "value": 365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213643, "uuid": "3d415afd-d00b-40a0-8d71-bd9bf3290e45", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "46145acf-ad99-4c9c-bb9a-617a6c0d1a10", "value": "v.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4502a38-5d28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256456, "uuid": "b9029476-0f78-4c2a-9a85-deb9cc1189b7", "comment": "Malware payload (Mirai)", "value": "6e2e405fff1588108e5de09284f84de7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256456, "uuid": "57d70ef6-cb14-4600-9ebe-838e20a3415f", "comment": "Malware payload (Mirai)", "value": "236351de3580743d5e07cc1d18149edc67f81ce8473e5f9a6f676008667ffe5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256456, "uuid": "508239a5-077c-4c43-b1e0-905cb02b2325", "comment": "Malware payload (Mirai)", "value": "1d4a7df3204b7f0991c9368eecf2b843976e1022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256456, "uuid": "d600842a-93be-4164-9633-2db31789ea1f", "comment": "Malware payload (Mirai)", "value": "42928a7be2c78571a6b4d3389de22769b560c27b440e2d6865eea01130746f39d38b0cf480460f274e048d33a13e09a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256456, "uuid": "837ee54c-5614-43ac-88be-8d9588d5cfc0", "value": "T142B33B86E793D0B9D91710B041A7E7396770ED720220CD5ADBA0BFF19871FC2A15A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256456, "uuid": "48775727-6093-4183-90a3-dcee6ef40aad", "value": "1536:mU3Vf4ETDnvDmB65Psp+kOInfqzyIWqSkUy31cDZQ0VsgQQSktOJgnr8:mU3Vf5TTKB65PM+dQfqzyrBI6ygSzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256456, "uuid": "b55bef4a-bb09-4367-b35a-700ac21a6f73", "value": 115132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256456, "uuid": "24bb56c9-c879-419f-ad7a-c51c7b03cafd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256456, "uuid": "45dc1994-8250-4454-bb1f-57b445fc591f", "value": "wife.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94dacd6-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780271201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271201, "uuid": "f9478d59-66e6-41ec-98fb-413660982a55", "comment": "Malware payload (Gafgyt)", "value": "20ae752e697134f266b456b51a57e00b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271201, "uuid": "529b3978-865a-48c5-9ceb-6452c454da57", "comment": "Malware payload (Gafgyt)", "value": "2373df4a5e91b4fbc6d52500f0980bf9fade40f4d4a2dc3ab4ec78c40ce67472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271201, "uuid": "977a50c6-db8a-4bff-9d41-86272fa9df24", "comment": "Malware payload (Gafgyt)", "value": "69f1024217473f70abadb396f5ef56c409364c2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271201, "uuid": "3aea78fd-0bb4-4c12-9134-9e31c71472e2", "comment": "Malware payload (Gafgyt)", "value": "0d799166ed1479ef2786709e5d0baa59595a6751b6b5ddff3b335cb87069c35369525b1eb3764122d6934e39765202ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271201, "uuid": "c9df00a2-d545-40d7-90c6-232659af2dd1", "value": "T189631949F9806F11D8D125BAFE0E124A73634B6CE3FD7211AE24AB2427CB96B0F77505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271201, "uuid": "58a91005-022a-4737-b8ea-e199dad1648a", "value": "1536:OVnfNuWPmxc6ml15JEaQQXPxlKelpagiR+A4W9Yix:4NuWDb15JEaQQXPK/+A4W99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271201, "uuid": "bed78987-b327-4d56-92a5-1d823cfbe8a5", "value": 67068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271201, "uuid": "5c879bab-1d10-46c2-85e4-2042a03362d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271201, "uuid": "d21e441d-28f5-4525-8a6d-462968ec672d", "value": "gov.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a47226f-5ce4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780227126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780227126, "uuid": "842cfbc8-adbe-412a-a9c3-dd1f925decc8", "comment": "Malware payload", "value": "21dd9c2f69af5b74b9991e345703d215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Win32/Malgent", "colour": "#7AEF1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780227126, "uuid": "a2c6cb3d-0966-453b-ab29-a563c488a462", "comment": "Malware payload", "value": "23c3d20182d11ce6841fde4d906e20b6a0c722632910f873ce3c78a6aa1a34e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Win32/Malgent", "colour": "#7AEF1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780227126, "uuid": "bba5664a-93b9-4b3d-90e3-61d952baefe0", "comment": "Malware payload", "value": "064421553931714d1c5a10514b0d26024e68aeff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Win32/Malgent", "colour": "#7AEF1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780227126, "uuid": "576548e0-764f-4bb4-a5ea-deee1315a99f", "comment": "Malware payload", "value": "23c830ebb54f3417d5f25dec48167acc67a98e9485b96611ff6213d4a211e544e33b1e768283db8fe52cbb56d6131924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Win32/Malgent", "colour": "#7AEF1F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780227126, "uuid": "d92cc890-7843-43cf-96f8-f08f860adae2", "value": "T1B608335B44C0E05AEA3F40FF3AE32B52E724459ECD52B96FFF84643A714A182249C7B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780227126, "uuid": "0a183041-0efb-48ee-9fd8-f55dd037afbd", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780227126, "uuid": "e23e517e-9af1-44ec-9447-47c35d873cf3", "value": "1572864:bt9IKPCARRWYvv+GF6QMdooZMJpaut2c5omLUo4Bq0YdmKDu3sVtkR+UCSJTml+N:bUKRRRWqItd1ZMJhJ5oKCqvMJ3SW+UCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780227126, "uuid": "75c0310e-5744-438c-bc23-78ee84159eae", "value": 78200266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780227126, "uuid": "444ab5f7-d96f-4a5e-9686-fd20d1c052cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780227126, "uuid": "3b35a062-1fae-440d-91b5-d7102f439be9", "value": "YuzuEmulator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d020f91f-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780271132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271132, "uuid": "f1e06fad-0f8a-4338-a8f7-11c4ecb5de35", "comment": "Malware payload (Mirai)", "value": "e9439b207c34ffbf27437a3e42301366", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271132, "uuid": "8233212a-d911-4846-9433-6662cf6a8f56", "comment": "Malware payload (Mirai)", "value": "2454be41fcef381bb4ef10f1354525945a476067180ff6064313443a9ef15a40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271132, "uuid": "9534b075-d6c0-45cb-bc08-496127fa542f", "comment": "Malware payload (Mirai)", "value": "a154b1ea2d05e9f1dfb9e2e44f52c0b4bcfcf113", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271132, "uuid": "880df7bd-bec0-4113-b351-94dc6e4400f9", "comment": "Malware payload (Mirai)", "value": "c656dffcf5cc2d17d6389ea0c5114e0c248536c561f37c3ef62fdb06e88dac533c73aa5aa960a7d773051e66e6ccd360", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271132, "uuid": "9408f426-03e7-45c6-bb06-583593067c96", "value": "T1032302EE5DE1698ECD0C8C38D0570FC27F6092694E57DB59EB11DC8CD766A0BB0E10AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271132, "uuid": "17440aca-1b93-4901-8644-82d10667a2a1", "value": "768:D68MFx0aHz/RaaNQ1KV5tmPVC2FwX4ET7QhFgXegi2rcoeikwql9SLVQq0pRVQj3:2pCaHzPGMVs02OoETshFwegi2AoeikLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271132, "uuid": "4a736355-42b9-4878-a682-71cdd8025c09", "value": 48412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271132, "uuid": "8bf108cb-3ca9-4df1-af02-e7f9be778c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271132, "uuid": "928bb5b3-38eb-41fe-b600-f92d999358c2", "value": "gov.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8ca4f9-5d11-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780246589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780246589, "uuid": "042c3d6e-cd36-4b2d-bf6d-9822683d8702", "comment": "Malware payload", "value": "81937426c125a9dbbc26c3b65d22d6be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780246589, "uuid": "cf742835-8f23-4399-92a7-60257eb050fa", "comment": "Malware payload", "value": "278c245782f7169cfc7900a301bb37fced09e580245d1951b2868a10edfb4abf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780246589, "uuid": "48253db8-3673-46ba-8297-df8bd70fa84c", "comment": "Malware payload", "value": "4c6f94275771a0d8750d84cba745caf35a705cf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780246589, "uuid": "9af718e8-e539-437e-8348-826d387922ef", "comment": "Malware payload", "value": "65679fbf75989fa7de1733e189a5d8f2d087654e97c9cce01b5e59f4d52c9f00763b07e280552a6ba74d8fd3626691d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780246589, "uuid": "49ad5303-e8a9-450b-aa2d-09b351abbffb", "value": "T165E622E866D056D0D482097862AE138DF3A160F613666F17378ABE015F10EEFDD0DAE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780246589, "uuid": "9d5293e7-bf95-402b-8a51-2bc26874dbc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780246589, "uuid": "3e06da03-2c87-47a9-b7af-5cdb92bff1c8", "value": "393216:YkRpe9nk411ZUSKpWVbjkWMWt+bT4OwGe0HTrO:JRpe9nk4/ZaWeWZiMiH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780246589, "uuid": "dc1da07a-6733-412f-926a-4928e2df0af2", "value": 14454784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780246589, "uuid": "7c68d632-e88f-4cce-8995-94880a1fad6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780246589, "uuid": "183c59ef-34f1-4ed6-8475-a66e3283df35", "value": "Madium-Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c39740f-5cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233625, "uuid": "a014b1d0-635f-4eca-b542-f8084e019eca", "comment": "Malware payload (Mirai)", "value": "3ac0813991193dfbd9822f211533a237", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233625, "uuid": "c312dd55-bbc5-4588-81de-571802f63f71", "comment": "Malware payload (Mirai)", "value": "279a71b9186b6902ab9ebfc662859c2745e5063c24c1abee7c7b68e125484d42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233625, "uuid": "f0be5e07-96fc-49e7-8e6d-19d4ea681e04", "comment": "Malware payload (Mirai)", "value": "823ddb5825a4e83a9e8f081f684d05e3b86f518f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233625, "uuid": "26ce8e4c-b6bd-48b3-9fea-2734a42d7a3a", "comment": "Malware payload (Mirai)", "value": "ef797961712db6930b8ee558459de270fb134d7e0de4b119b19c760aa8f6d560d036106c732f11c9c1738ceeaf97996d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233625, "uuid": "8f529139-fc5d-4dee-b00b-33521a8d60ce", "value": "T131D30945FD445F57CAC266BBFF4E438D7B2A0758D2EE720389256F20378B85A0E3A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233625, "uuid": "a777b499-2381-416f-8565-00a3e574a644", "value": "3072:VtIv5zUDG867hD4OcwaR9O48PqIL6VyG+6r0:Vqvp8qJ4Ocwa9O4gqIb+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233625, "uuid": "ff75378c-2f7d-451e-8cbe-91610c1d4895", "value": 135544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233625, "uuid": "1137af79-2ac8-40b8-aad3-7be9ede390e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233625, "uuid": "15ca563f-5dde-4dd2-bf16-06ec1e8dc527", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33c14df-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780271137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271137, "uuid": "c29b5ddc-c1df-4bbd-a854-0c002a4eaec7", "comment": "Malware payload (Gafgyt)", "value": "482559d2487866443ca6419c1b947fb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271137, "uuid": "923fbeae-1fbf-4266-9770-b55e51b59f85", "comment": "Malware payload (Gafgyt)", "value": "28578f68c7593640dc2e061c69e81947c446c14637da0f4dc011855cef30058b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271137, "uuid": "0251799b-e446-4e79-a38c-2311a614a79a", "comment": "Malware payload (Gafgyt)", "value": "a83212fce0e734fce77f51a57f5c351dcf2aff6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271137, "uuid": "32beaaf5-8bfa-4adc-8db8-1255498d8958", "comment": "Malware payload (Gafgyt)", "value": "e1e0e596311cfee9c16509dd12408a6c2d597eefe3a009f6467eafab45911e56f006ce254f7ba0821a7383a1cb7630c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271137, "uuid": "9096addf-61b5-4793-aecc-41b0985b58cc", "value": "T1CDB31A45FD509B13C6C655BBFB8E428C7B2A1758D3EE320399256F61379B86B0E3B102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271137, "uuid": "3c8716bc-d18f-4230-b774-e9b8d40e5b7e", "value": "1536:1/+/0QbujRgBi4RNPUctGfT5Hm4n2wLQfv9YrlGTwyw7qFYBYp8MswnixT8OTga:1W/0rjoTRNP8dH3jLQX9ESYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271137, "uuid": "0bf90a9c-3e2a-44d2-b694-d5be86da58c9", "value": 109092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271137, "uuid": "12d8ed55-883c-4f63-b525-f7029266f2bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271137, "uuid": "dfe37dd8-ccb5-4969-9a5b-4fdc0b7b6acc", "value": "gov.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501f0742-5c99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780194896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194896, "uuid": "62cfccff-fdec-4b48-85f3-bbf952ffd64a", "comment": "Malware payload", "value": "a703339a289b7b60fe12c91e0a0214c3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194896, "uuid": "e16da0dc-95c5-4a09-94b7-6a95e3e5061c", "comment": "Malware payload", "value": "28c472c1e51cdb7ede9a963fa0ab0cb42d4f9e769a4c645e7909d5c13d3cf131", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194896, "uuid": "9d16fefa-7c36-4798-9da7-2539adf89228", "comment": "Malware payload", "value": "7616ebf7307ab4fc92c82dcbdc9d2b62b8bf27fe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194896, "uuid": "e1d7740b-58f0-4048-a846-110809d53fc3", "comment": "Malware payload", "value": "16506c9f25919bf4a76e8c5bdf9ead65348b8a4c1dd530c2fa2556f54f852a6db738df422504f71d8abfcf7648b7a324", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194896, "uuid": "efea8c2f-69cb-45f5-a4d6-b4231b695163", "value": "T1A3136C6526953C25AE99883B5C7E2F0CBDA983E2304491DDBFCA3CF18C55A9CE318719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194896, "uuid": "20af8c11-8bf5-4fb3-9021-aa4578ea9338", "value": "768:fr9NyXsZztCZ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:jHusZjcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780194896, "uuid": "c87d4b27-3544-4ffe-9247-efef890bac3d", "value": 45522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780194896, "uuid": "3cd2941b-28cb-4c07-85a6-2ad560e42838", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194896, "uuid": "64d22be6-8ae2-477a-8de1-007d35fa28d0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae43284-5cc9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780215638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215638, "uuid": "22ee00e7-59b9-44ea-bf83-862b398f8989", "comment": "Malware payload (Mirai)", "value": "8f51746fcdd421b07890ccb9775413e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215638, "uuid": "9abd756d-4e10-4997-9542-f40f50c7e13b", "comment": "Malware payload (Mirai)", "value": "299f8ce183cdb9b7b1dd1249b2c07fbeed373e5e20a1ba2c88b1151d6b8b5111", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215638, "uuid": "ba96b081-6e9d-4739-aaef-efbf1bf82fc0", "comment": "Malware payload (Mirai)", "value": "5852b112b3626f96b00b0d9f67fc8f78732206e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215638, "uuid": "83b04b48-b5d6-49e7-b1c3-a961a964fb30", "comment": "Malware payload (Mirai)", "value": "4df97f93324288827325e01766edca420aa8a803bce1c7add6c60db7d69388e37d63d3498daeb048099f8c90d569dd23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215638, "uuid": "319163ff-69f0-41d5-b16a-5ed2c9baf332", "value": "T15943029932C006CBDDFA5CFD4DE623313AA215172D02BE09FB64EE83D6950A5754D8CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215638, "uuid": "9cc5825a-1a23-4ae3-bf40-fc0a854f3011", "value": "1536:JQfjdARIIfKw9yJYfgMj4Earw8s38C7GJYVJua:ufjdARbfdAefgMkmnsC7oYVQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780215638, "uuid": "6b420d9c-20be-4b49-84d0-415cdb04d130", "value": 60576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780215638, "uuid": "8e48b0bf-0889-4370-8be2-80b9d75a1bc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215638, "uuid": "714de379-0970-44e8-8d75-3ef34da0fbba", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100d1c2c-5d28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256207, "uuid": "e2ff1cbb-72fa-40ba-8fd0-f54f9cb0e3e3", "comment": "Malware payload (Mirai)", "value": "ff05073adb90ce16dbf0000e7e55d04a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256207, "uuid": "c7495f0d-efd9-4978-9b7a-02a85c951056", "comment": "Malware payload (Mirai)", "value": "29fa80d7fbd5ca662e281ce483719fc360f4d25003af2b02cc449a7e9c9f88d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256207, "uuid": "bf95f635-9ec5-455d-886f-d8d202afcdad", "comment": "Malware payload (Mirai)", "value": "2f10995534c7c4392319b668fd9a873ebec7b022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256207, "uuid": "5bab5313-f527-4127-a0fc-9ac2542937ac", "comment": "Malware payload (Mirai)", "value": "e41ebfaff2210d022f0699b4f402e671ffcc8e6e731c19cb0b08f6bdad4d9dac3c5a13eb9d89cc1eaa924f20978b86d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256207, "uuid": "fda624d1-a54b-4bcb-b137-37ae3b630f8b", "value": "T1154302ABD09DA415DA970DB73CA4EAA8FF5A0DAF98E8ED649180C7517E03D3383114E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256207, "uuid": "3b23fa49-f220-449d-96e0-41f5f7623ddb", "value": "1536:y20T6G/ch/2zH3DiBnNmvZppCuorwcn4u+qgw09m:/0TP/XfiBNmv7pY8cn4u+qgw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256207, "uuid": "36c970b7-3bff-472d-bff6-45a2b01c6c96", "value": 57904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256207, "uuid": "7adf1ae3-b839-4af2-ad6d-2b32d0d6d8c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256207, "uuid": "761d85dc-5c3e-490a-9397-ea1e8d35edb3", "value": "micro.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1452b9-5d28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256387, "uuid": "e71254cc-42e5-479b-8cb1-5ef2998342e5", "comment": "Malware payload (Mirai)", "value": "d9b7182adc5df78a37943990c0c88ec3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256387, "uuid": "387528dd-6262-4c1e-a5ae-4eb539ab3233", "comment": "Malware payload (Mirai)", "value": "2d4095f20e8f2f3389e0c308d837c52dcdceab2c02b85f9a44404ae650d0587e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256387, "uuid": "1fb5e1d9-997e-4242-b5cc-fe327f7ad148", "comment": "Malware payload (Mirai)", "value": "80e5124d813c1cd3251472b351a1a30e961d77fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256387, "uuid": "a5edf559-b77b-441e-b552-4beee5b88ede", "comment": "Malware payload (Mirai)", "value": "82781a65ea10ecc37264dcd1d91930401bf5d1eb873672dbe55a2f8d44afa4089b2658f8621d0f6c2b99de290d2e9ac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256387, "uuid": "37be8ad6-e9a3-42d7-bbfc-6a7e68ab157c", "value": "T1CD23F2D99DEECB04DA66503B9403788F79BC832CC2C79B9F9B609091D106D282A6C6D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256387, "uuid": "651985ce-b222-4394-9ac7-ef707d5e6482", "value": "768:5SQVGJLAIeHIdArPa1BXT4i8jllVFKvJgLNnkiaffM1WDdNsX5nbcuyD7UB8/Q:oIIeodADEUi83X/QDDunouy8B8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256387, "uuid": "6c7c840f-c9de-42f4-a983-8281a38f5fdb", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256387, "uuid": "5cb8031c-80fa-452a-b992-af713234bdf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256387, "uuid": "a0ae5179-11a4-417b-8c76-d58747f3a422", "value": "wife.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2795df9f-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213297, "uuid": "fa8ba247-da57-4bfe-a653-29bd4d939885", "comment": "Malware payload (Mirai)", "value": "325e6a6f81a29e24cea2437fc5ddcf68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213297, "uuid": "247a2b9b-00d0-461f-a3d9-c31ff3ab3baf", "comment": "Malware payload (Mirai)", "value": "2d5140bdabea5f89ad94546d290d5483b55995950721621c2982ba8e73575462", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213297, "uuid": "6e98b9c7-869a-484e-a076-40362099d03f", "comment": "Malware payload (Mirai)", "value": "4b5bfd58a8e4bbc23c7577aa7ceedad3d191843c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213297, "uuid": "6a541093-720a-4bc8-a8d4-512d658241c2", "comment": "Malware payload (Mirai)", "value": "5dfbe9656d315a5224f58e270d78a9d6dcb412aeb5f855e40335effb3d74513470d20672064f8ab3d5f51759ac5c7401", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213297, "uuid": "cc800b58-d440-4c9d-a728-cfce4aaf8e39", "value": "T196633891BC819613C6D1127BFA6E028D3B2613E8E3DF72079E225F2137C696B0D37A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213297, "uuid": "762fd021-22a2-4cb0-bf33-033eb3c0798f", "value": "1536:xZ1ltKm9nMtfTa7/KrVJYzCzLvkuyCG3wfqvfWe:xZkhDCCzLvkyEbff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213297, "uuid": "ed07e5f8-575e-46cf-9c05-7f6b689d3caf", "value": 66900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213297, "uuid": "35f77a7a-16dc-4fd4-bf41-cf802c35cfc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213297, "uuid": "672b9210-8401-43d3-98ea-422958baf3d9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06f4305-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780214385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214385, "uuid": "f93c4e44-429a-4ad8-ae0d-368b38e4c2e5", "comment": "Malware payload (Mirai)", "value": "3b9cb9d57fa9a4b3acc7dbe8ab820f1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214385, "uuid": "a958a188-572b-4254-b71d-9506e3ac31ea", "comment": "Malware payload (Mirai)", "value": "2eab124bc79579576933a46ed89c4e1e65789e0bb29663126e84d88f9a2a024d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214385, "uuid": "8c061b91-0716-4538-a4dc-1cb74c904703", "comment": "Malware payload (Mirai)", "value": "8808edcae9d291656f923fad605fc680f8e04ff9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214385, "uuid": "e136a031-d23d-4458-8b71-8e79082f75a8", "comment": "Malware payload (Mirai)", "value": "f5e509339328fdbef6ed67e42b67698be2b2fc101dafeebfc0cfd49c3993d435472678d4caef98459d2f0140114c97ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214385, "uuid": "95433025-634a-4665-9fb1-8a7f3ec139d5", "value": "T129F44B03BF405FEBC4AFDD71492EC34711DDA8C746C1A63A71FC4A8CBA9965A4AD3488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214385, "uuid": "5082af67-a64d-4acc-b139-208d2d179c90", "value": "12288:DBToYpbIa3IIBkP2gYMq7A3StAvcAJZFNuZJpjRvkxGl+PgWh4bdFzclA7Ipt1Sg:W2z7eUzfIvItEFIpCqSXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214385, "uuid": "c884f280-e983-4c61-90fe-46346422014f", "value": 767668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214385, "uuid": "55b19d6f-71e7-4f64-9792-792cb5895241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214385, "uuid": "ca629591-eaec-4bab-8f4c-adfaf13c2248", "value": "blue.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e34fb85-5cd7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780221495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221495, "uuid": "c2b4f16a-b463-4f23-93c2-b3ea2ffbe4e8", "comment": "Malware payload", "value": "e29b5a3d310135f8d0cf06456369c92e", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221495, "uuid": "6bd1304e-d396-4582-ad5c-8aebae5aa212", "comment": "Malware payload", "value": "2ed72ef1866bfb83ecf1a253063ce2287870f4d918141b6e134154406a0161af", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221495, "uuid": "24b1bd7c-20f9-4aa8-89ff-8ef448406737", "comment": "Malware payload", "value": "eba9ab984bd9882ca147c07e6010e547f08422a2", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221495, "uuid": "3faac590-005c-4bc0-9e17-922ab278160d", "comment": "Malware payload", "value": "2fc3af4fea1146e8e873228bf91f88eaf58b1789fd2c122c493582f7fab8655bb1dd3d14a22dbbdee2b666549d4e7b6a", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221495, "uuid": "dbc707a0-dd4d-42c3-b4fb-3a8c348c128d", "value": "T1C5A294C93B85A060CB6BD6BF7A32A5D1E13B4CC5D3C94D98F3287569FC84504A6A8788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221495, "uuid": "fe60e929-02bf-4d21-ab28-998999a8b885", "value": "384:LMKkEB4MHXIy8dIwrGycfy1HAWqsASVoNSqzuS3Wz7rVcSl6GPmtQc2Ku:LqMHXIy8SY5cK1HAWjASVQSqySm/rVj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780221495, "uuid": "219fbf74-1348-484f-91bb-b5f5988cd847", "value": 22469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780221495, "uuid": "e1032a79-9fac-48ac-84a1-d1d69933b1bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221495, "uuid": "344694bd-187d-4238-b7d6-999c1963ebe9", "value": "main.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a6ea2a-5d2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257960, "uuid": "463c5c57-a3c9-4aaf-8cd0-b4aa3d7bb148", "comment": "Malware payload (Mirai)", "value": "8a155248e51a91a291695bed64d3986d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257960, "uuid": "2d0890fd-874b-42db-a64f-8a31d6a4f2c5", "comment": "Malware payload (Mirai)", "value": "2fb61bed8340653ebe358e50d9fcb16d3e7ef3dbd6af19a62040bf6580080fb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257960, "uuid": "064f6101-f586-40ce-8793-3b380085cddc", "comment": "Malware payload (Mirai)", "value": "4c8f05f556ffda00efd85f94183682febd511d07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257960, "uuid": "4de6afd1-cf85-440d-90f6-79cb9e487533", "comment": "Malware payload (Mirai)", "value": "5fd9978193ef29e706e204ad1c9f8f808ec3f6ec4a9ba6d4620b870acac18ef1b98ee0e664fb1df943631ea636d1c44f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257960, "uuid": "4d030689-fede-4829-9f20-529963fe2f74", "value": "T132043B02770D0F43D2532EF0277B17E183AFFDA219A1A684751EBEC892B1DB22545ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257960, "uuid": "0f820bc4-69ad-45f8-b4ca-0da2b32d4c85", "value": "1536:G5W5UyUarQjqo+o2KQaFNvn6sU9zXxPFPK6IXdLZifO3W2uu1Dc0lkDa2nKfcgll:CCoz3NvnBUxxdPK5KEkDa3fG4AAIVFgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257960, "uuid": "d95f0719-ff43-46ab-84f3-e8f575cf5f18", "value": 180200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257960, "uuid": "96134e55-d8f5-4c40-86cc-ef2d9a464368", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257960, "uuid": "440ab683-61e5-48c7-81f9-35f54a6a6d69", "value": "wife.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2c54ca-5ca2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780198859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780198859, "uuid": "005a477a-8088-4837-9413-46c338589475", "comment": "Malware payload", "value": "6695df33f96e234967985cda79798477", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780198859, "uuid": "43e88922-5b3a-48b3-b7f9-258910e52c19", "comment": "Malware payload", "value": "31ce1f5ad0300191617aee4ff65b0e681ad95ea3c1827b3017c5259be25ba8f5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780198859, "uuid": "116c78ed-b16a-463d-acc6-290ff66a21b3", "comment": "Malware payload", "value": "2c3b48faabd08cb59d2cda0100d9ae462c4ee8d5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780198859, "uuid": "2d01c50f-10a2-420c-8d85-7f4e224338c2", "comment": "Malware payload", "value": "fad07cf16c09bc32ab0da1923cf5ccd2bff27c53e9da07fe9860aa70f7ce492305255f1741b04bd470d318e35c239556", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780198859, "uuid": "38fa28d9-e7e3-4f05-b18e-f86b606559ff", "value": "T1A3136D6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCB3CF18C15A9CE618719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780198859, "uuid": "302b0e55-9802-4c79-8110-6039559433d7", "value": "768:or9NyXsZztCZ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:2HusZvcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780198859, "uuid": "a94b5079-9253-46f7-8735-da2aae788b7a", "value": 45506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780198859, "uuid": "91d60c3c-a641-40a7-889d-7ec6f0742ab3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780198859, "uuid": "12cf4050-4f8c-481d-8cd9-f16e2750cec2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c3d2f6-5cff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780238746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780238746, "uuid": "ebcf790a-9dd1-470e-a1ba-5b3d80776cda", "comment": "Malware payload", "value": "738ad1a2bd72a40b5efb1a5318f203fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780238746, "uuid": "59e0acdd-6229-46f4-b928-bd91af99b320", "comment": "Malware payload", "value": "3259bba443b203a8ecacc18580d9eb04f10af1cbb90c76cfddca1489c4043bd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780238746, "uuid": "f86c5750-1fb8-4d78-9cd2-da64c45c6b8d", "comment": "Malware payload", "value": "159c4b9eeeeafa2a36442ca3e7f72f2a26533a37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780238746, "uuid": "b9c9b8db-73ed-461b-8a78-4a16f072aac2", "comment": "Malware payload", "value": "88c56f1da7f35fde8fca374dee1f6b9aea00f39350c232b7d8b903d04af3ec3212edb613ec1c000a8279b48ae44af60e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780238746, "uuid": "9bfc4123-6a3d-4b06-bcc6-154cfd658043", "value": "T1B6C68C77914238E9E4A98CB4D11025526DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780238746, "uuid": "a545774d-171b-4aae-9864-03d4d0b9c130", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQA:cqYUQuVDt0TZE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780238746, "uuid": "a21d2d56-55ed-40b9-aa67-bbd3dbdb0bf6", "value": 12517376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780238746, "uuid": "be031112-55ed-41b3-8fc1-f517642549ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780238746, "uuid": "27ddb4cd-ab39-4784-becd-3c19a78bb4a0", "value": "3259bba443b203a8ecacc18580d9eb04f10af1cbb90c76cfddca1489c4043bd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc398fc7-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250080, "uuid": "f4a672dd-0693-4a07-8e57-a02f587a4458", "comment": "Malware payload (Mirai)", "value": "97d05497f678452d1b9915befd427922", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250080, "uuid": "1fdc23e9-b33a-460e-8fac-0b070de22910", "comment": "Malware payload (Mirai)", "value": "329364457ffadf784e8520c8044438bb198330a5b3df797eafed47510de9f36f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250080, "uuid": "03715fe2-59a1-4966-ac1b-84a25409437a", "comment": "Malware payload (Mirai)", "value": "fc21ed86ea5b2098e5ddd4f701407c3f3b176189", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250080, "uuid": "8ce4dd6b-b4af-4d70-acae-523f933a9af5", "comment": "Malware payload (Mirai)", "value": "4cc5577f6bc3eb5eef8147882afccefe5cb5bb40305c677dbfba0402947afce234d254f556732f2ab543d7eabd7d3c03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250080, "uuid": "cc204287-c5ce-44e8-827d-a2485478d716", "value": "T11103F14F0FE87E84C29ABDBD819F03A2495C23D6F39903C4EA0054DC2970D66F19AC7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250080, "uuid": "b528e563-dff7-4196-b313-a7854beccba6", "value": "768:hifVq1zOXtSnXXFjD41UAdTlbU5wcSA/bT7H+VOp/jcBaI+1W97d:MvdSnl2/dFUGc9D38w/oBf+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250080, "uuid": "cbdc7bc3-291f-40b8-bfa1-15ffa44423cd", "value": 40128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250080, "uuid": "b11fea07-e5ba-46e2-b41f-217d02782440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250080, "uuid": "5c3272a9-ecb9-4195-bf83-668975bb2668", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31349446-5d28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256263, "uuid": "799f52c9-c291-41ac-9e0b-d22c037ea244", "comment": "Malware payload (Mirai)", "value": "8b74ed8f4e9273f8d72a57af99ff84ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256263, "uuid": "4539d95b-75b5-4599-ba98-e7b9c1292e1a", "comment": "Malware payload (Mirai)", "value": "3317762fe17fdb33eae249339e171b8bc1133ee3d9e44faf56d9208b5c80f2ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256263, "uuid": "77238f9d-a8f9-48b2-a8c5-5017321551bc", "comment": "Malware payload (Mirai)", "value": "0dc47b7123dbfd24c5621b557914c4e59d56d3bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256263, "uuid": "fe8bea7a-1641-4720-a4a1-beed74aa6bb7", "comment": "Malware payload (Mirai)", "value": "1330e2848e6b93974e19d0f5938266817910a42179cbeaa5d3e875965f2a1ea612afc8639ebccfa90e6fe4e5902d3c49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256263, "uuid": "a4623ac2-9011-421e-978a-22fe3901602f", "value": "T10DF32A06770C0987D1A32DB43B3F27D193EFE98121E4FA45694FAB899271E321589ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256263, "uuid": "c22849f9-d3a8-4935-9176-9add1559495e", "value": "1536:7in6AkpPIP4042++1n751DE70xjg9JYRKH/ysdM9Qk0cr/AOvAS6cUw4zKqTFEj5:7c6A8tr2++V751+0x8JY0aVQ5creSpEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256263, "uuid": "a7ddd4eb-9e41-4487-9e8f-f501f363fa74", "value": 158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256263, "uuid": "e031ce2a-5a45-4a8c-8a41-49b16a8bda84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256263, "uuid": "acfeba65-9106-43fe-a4c7-0fd2daacb5c5", "value": "micro.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2ed9f7-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213308, "uuid": "b23dc78a-59b1-454f-bf1d-0a8cf319d03b", "comment": "Malware payload (Mirai)", "value": "c683bfbe4450b71ef60ec7f120408679", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213308, "uuid": "d7d45d19-da1d-417b-a0be-1ee238b8a45c", "comment": "Malware payload (Mirai)", "value": "337278e09f9047622c8217e864e326d326957265d31e8ee291f343e563cb2f62", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213308, "uuid": "596c11c8-092f-40bb-abe2-1a9650e6284e", "comment": "Malware payload (Mirai)", "value": "b5f8fa3170b382c02f31d92008a3ea3f57e50db6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213308, "uuid": "7d368230-8d90-4b19-aa8b-a8d203919ed2", "comment": "Malware payload (Mirai)", "value": "b88ddb5617742338f726be58c0538e43ee02450fada0e94c27f34fa7ce7ac8f8d513d6a32372be48d1e3f4d0acf9777e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213308, "uuid": "194a1463-4269-4d2e-bc77-e020c4c7c2c6", "value": "T1F5632A21BA761E1BC4C1947621F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213308, "uuid": "b1b45d87-92ad-4a5c-b997-7c0bd3110de0", "value": "1536:lGBVg7AOotXhGIAsQ/VJAcQFQm75YH/tatal:lSCz5LuQmVNol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213308, "uuid": "2a4a999a-cf2f-4be7-921e-46da1774b807", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213308, "uuid": "f1613a04-4094-4dad-b0bb-e930538ab4e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213308, "uuid": "c12c0fd7-121b-43c3-be20-68bfd86c76b6", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aeecb75-5cc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780212443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212443, "uuid": "ea6196d9-b304-49fd-87e2-d2205f3f26e8", "comment": "Malware payload", "value": "4a9bfced055c4b615e2b9960b9611fb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212443, "uuid": "b3f9b02c-678e-4bdc-b514-21f79e10e930", "comment": "Malware payload", "value": "36a21f085e8a343b78eda93f5c4eb656b71f10fb9a22c84eda278649f3709f0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212443, "uuid": "7b1ce16e-c53d-4d27-8694-3a5e1d4e9bc0", "comment": "Malware payload", "value": "9268eab18ba13e3a1497f3ba64974753b584b33b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212443, "uuid": "4b9bad8b-4ede-4e58-869d-6aaeaae0a3f7", "comment": "Malware payload", "value": "80fc54344fe4f5152ff58a540da295efa286f8f177fd43dd3c55e63cd87a736ee44ae9e89ba7d80e190efd7676a29026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212443, "uuid": "bb963ccb-a04c-44a5-b3e2-e88d9d5186e6", "value": "T1B2E533CCE74A92F4D2AF0D7F07BD2945BE02A3FE0BCA155A5805BE1258622670139FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212443, "uuid": "5419be9d-04ec-4aa5-8ddf-3a2f9ed15a3b", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212443, "uuid": "ba1d93e3-5e2f-4951-aec8-1b2a39bcdc0e", "value": "98304:RPufvC1WraxBVApdPOLs4rq7YBq3QizvbTFB:FZ1Wra9mdPO1Mj9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212443, "uuid": "98e85596-e592-4201-80f2-3626a0b068b0", "value": 3216949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212443, "uuid": "ad351464-b435-4c09-8ae3-742b16ef742a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212443, "uuid": "4ee9621e-2263-4085-a3fb-5be48f5dbd2b", "value": "4a9bfced055c4b615e2b9960b9611fb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b85eef7-5cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233490, "uuid": "1ebfca0f-5c96-44f9-8849-4a16ea619ce3", "comment": "Malware payload (Mirai)", "value": "cd4bc4de6b1d037cb1c7367daef3b6b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233490, "uuid": "38769f02-7fae-4a6f-bb26-cd6a2a8c3598", "comment": "Malware payload (Mirai)", "value": "3860a632ab55f43e1bbd4782d4a3da368cfe346738628850cb08a77b857763df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233490, "uuid": "5654733d-38e9-48b5-97d3-b73d45e11540", "comment": "Malware payload (Mirai)", "value": "99769901c8d7ea980614678da9cd4e43cce92408", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233490, "uuid": "26e92d79-b9e3-4bbd-883b-2015425282ae", "comment": "Malware payload (Mirai)", "value": "d9c3b08588bf3e297055a766ee90bf5d85a00b9ab2d570be26a8b4dace386f3b6b27ffaacf8727aabb514f75297e7f72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233490, "uuid": "c5fea772-8e10-4a12-98f5-cda64e4049d2", "value": "T1E144EB1A3E228F7EF26C877047F38A31976976D617E2D645E26CD6101F2038D681FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233490, "uuid": "271c8c1a-7cde-4682-9d8d-4c111712b447", "value": "6144:0WM6niVcxCrPaph48d2bjRYQlsNKWSn8V1K1uW9NNvotVnkenH44Ad:096nXIrLLlE7K1uW9NNvotVnkenH44Ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233490, "uuid": "3844e8c7-9e5e-45de-8b17-aaf3d086f71d", "value": 271279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233490, "uuid": "4052e0f0-2bfb-432f-92f2-b340e3561620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233490, "uuid": "d6d3ce62-a4cd-4392-b524-43568a68fc55", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5379af4-5cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233748, "uuid": "f9a86a00-2ef2-4d98-b049-34374bd958fd", "comment": "Malware payload (Mirai)", "value": "80d61961fa868e5b8be84cb56ab13b3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233748, "uuid": "f6ab1a19-6e16-47cc-b071-a0081000ea81", "comment": "Malware payload (Mirai)", "value": "3910f46fe809d723d169b5723e0724dba7aed441a065b53b98e2f1b0a9736569", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233748, "uuid": "59bc72e9-2b87-460b-b7aa-06ac1a569a50", "comment": "Malware payload (Mirai)", "value": "f254e40664b1bc2e7da23571f4e230c59024c80b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233748, "uuid": "e918bdb3-7dee-4096-a185-c54baafc6c2a", "comment": "Malware payload (Mirai)", "value": "d501b7a90a17d90370b76a7dce1068ef4ade7513cf50c62caeb09b3fa5bdbc5e25630206fd908e76d0d14cbd4d89e3d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233748, "uuid": "281f3ccd-bfeb-44dd-8950-698c199c134e", "value": "T1D804985A6F228FADF278C73047B74A35975D23DA23E1D684D2ACC1142F6025E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233748, "uuid": "93b686be-27ed-4b21-bc93-d7e4590cccf5", "value": "3072:d9dzthIMYLfTt5l35BkIvJcjSlsRkQFXuJXz3QSNOrY:d9dzthIM0fTt5WIxi8Qk9QScY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233748, "uuid": "51233d60-2c2e-48ff-8229-2e1422eccfb0", "value": 181556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233748, "uuid": "2812caa1-dbd2-4ac7-9d51-2656e05f04a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233748, "uuid": "77bcb057-03ff-4627-81fa-d32792350306", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f16c358-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213309, "uuid": "e9465559-eed3-446b-b013-5daadc308142", "comment": "Malware payload (Mirai)", "value": "780a42f8632b9705d493d3ca03908f8e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213309, "uuid": "8e242207-b586-476d-b050-d4ac70eda433", "comment": "Malware payload (Mirai)", "value": "3a254f7cde3d90bc7d9fcf85f473655063bc51c2ba0bd8ef1b3e985de232f79c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213309, "uuid": "aaa84fb5-26ec-4586-9d17-629911bc234c", "comment": "Malware payload (Mirai)", "value": "f373d4c4ae15136c6fefb1d89f3faf9e68190cd7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213309, "uuid": "9fc8d359-fff0-4798-af17-7dde23d78dd1", "comment": "Malware payload (Mirai)", "value": "cabc4712289119b806f48f14d5daeb3886b5e389fc7bedffef01e4e17689001353a7a2c45d525edab3ff22ef4e91ce40", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213309, "uuid": "677f6182-8901-41ae-a5b0-cfd4a9b56bc8", "value": "T12F83A51E7E218FADF76D823147B74E25A69833C627E1D642E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213309, "uuid": "32b20e96-3c47-4c65-80a8-0088c10a857f", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/deyLYwHuRHI0I4EH6gTk7ZDYovZ73x/nL8y8QZ:Rakdn2Eo3eQaV6TkRYo99Be037Waj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213309, "uuid": "26cd587f-3a62-43bc-8451-5c649a60c82b", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213309, "uuid": "ffe91e6c-12b4-4e48-b8d3-4a40e89b78a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213309, "uuid": "12753563-79cd-4615-94a3-5464ae92805a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284f2476-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213298, "uuid": "66952b96-9d8e-4a5e-af74-87cdd21c60bc", "comment": "Malware payload (Mirai)", "value": "820922cf72a0f5e90295fafaa164bc7c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213298, "uuid": "9920c3ab-a271-41e9-bace-68217675cae0", "comment": "Malware payload (Mirai)", "value": "3bf3a4af4610fb2901ad21141f0c27abf47a63627be2f5567557b30799a02558", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213298, "uuid": "12a1254e-28c1-4983-a243-48b70db91923", "comment": "Malware payload (Mirai)", "value": "adeb5f2e32d33d62a92235b7e543b0f071451504", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213298, "uuid": "d5fbb6b8-2bdc-41f6-9e04-68dec255cb02", "comment": "Malware payload (Mirai)", "value": "4f03f884934dbee554c924d91da59f0ba4eb890ede74f687a0e339fdc6c893b0027892c0db1df66fdf5f7007920e0994", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213298, "uuid": "c4c651a8-b3a9-447b-915e-6259fe261690", "value": "T1D0730756B8814B12C5D512BAFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213298, "uuid": "4f3c77e8-3303-48c8-a53e-ede1d24564af", "value": "1536:2lnHaxP6XkC/zTkS7IDHtzMwo3i2ta0J0GIgi/z3KvcIc+5UYIWDz:nxiX1LgbtzbUtabz3KvcIc+uRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213298, "uuid": "01263a3d-fbf2-4803-810d-d68fee250b68", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213298, "uuid": "8618a976-91c6-4775-8b4c-62809c046291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213298, "uuid": "d399efff-eb14-448c-aef2-f88ca9c77dc6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996b53a0-5cc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780212629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212629, "uuid": "4de51c93-dddb-4ee6-8dcc-e259a70b7059", "comment": "Malware payload (Mirai)", "value": "9b583bb4eecd3faf7b54e4ffe7d80add", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212629, "uuid": "c1a42222-43f8-41e1-8245-2350981e0695", "comment": "Malware payload (Mirai)", "value": "3bff1b00397d89f81ca0ad45a0403d4951d5f031ece85c26919ac7c0fc7dc81f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212629, "uuid": "8d519fe5-895b-4eba-89a7-5f26e32405fa", "comment": "Malware payload (Mirai)", "value": "25cd89ee7d13bb203201a2a7ba9d12c006b4ecd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212629, "uuid": "8b599381-d38e-4f37-8261-7848636a70dc", "comment": "Malware payload (Mirai)", "value": "ed0817ac22d2f0728ea438934cdae998ccbc76299a51262cfd1439bddc3707ed316bc7af4aaeb22d5301ae25044f95da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212629, "uuid": "fdeb8d34-3474-4a02-9ef9-10e33b7d49b6", "value": "T170A34B36B874192BC4D4A47E22F74721F5F247D925A8861E7EB20D8EBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212629, "uuid": "31803ed6-33c5-4b76-914a-e0857f6aa4ba", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0oej:bbbmPTO930bkbRl886ej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212629, "uuid": "4aa7c682-3977-4d0c-9cc4-b43003d9cd8e", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212629, "uuid": "91162627-0f58-4ee9-8a3c-e99bf73a9a8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212629, "uuid": "eeb8694b-4be2-4635-81a3-67fc72787458", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c557d8ad-5cc8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780215279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215279, "uuid": "6fe7a2ff-bda9-4a81-8c9d-49df420e5acc", "comment": "Malware payload (Mirai)", "value": "a3ed020adb9cf6706d47960b2dcca16c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215279, "uuid": "fd068598-b5c4-44fa-a320-b02d7c1c881d", "comment": "Malware payload (Mirai)", "value": "3d9eda5ae2bd162902cbbd9d0f2256af000660837cf52a34dcaa5fb424b24ed8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215279, "uuid": "60d68b63-6189-43af-936f-fc98d0cdbd1c", "comment": "Malware payload (Mirai)", "value": "0d4ead1490ca691518994cbd173c3b5a94bd29cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215279, "uuid": "943ef6f1-12f5-43ef-b770-88e3d2bacd57", "comment": "Malware payload (Mirai)", "value": "e3e965fa756fd344dd12b835d290f2ced1e51313a89784e64dda1b3fef2b1d2cd7f45e09bdf268a341359290c21739e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215279, "uuid": "4d2fc550-b34d-4f7a-b1fa-160e5758fc45", "value": "T194240B41B8518F53C5C32BBBF79F42993736671897EB7302EA14AE742F4769D0E26201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215279, "uuid": "ae7aba3d-7475-424d-97b5-95a3a8efcdaf", "value": "6144:z8S90EYX0AMqQTzDDs+Wrb/IKJKHtEqZ01L1fdts1QS1:z8S9be0A83DQ+JKJKHtEqC1L1fdts1Q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780215279, "uuid": "c3307751-ab01-407c-b161-bf7f54ef02b8", "value": 218780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780215279, "uuid": "b228330f-6c69-42b7-a21c-9e59f8522894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215279, "uuid": "40844ea3-ae73-43ce-8172-1261e7fad83b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b14b40-5cfc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780237392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237392, "uuid": "cf6f21f1-2580-4b77-83f4-c15bfc1b061d", "comment": "Malware payload", "value": "0420c04f8a1abdc178c0da0368d57408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237392, "uuid": "5bac8c59-66da-4162-8133-1e20441b85ed", "comment": "Malware payload", "value": "3da4118754c0efb0d55883df372d0a2281a9cbb86dafe3cbdacfe60f2b0d6d16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237392, "uuid": "7afc1dc2-9f66-49ee-a540-f45c37ce7167", "comment": "Malware payload", "value": "289ff0b643f373896c9fc7b1626d34986f1c0659", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237392, "uuid": "2c4f3c80-3a95-4ab8-ae47-90ad128bf861", "comment": "Malware payload", "value": "b4a0bdc570b9aacb938b7b97ee742ae270a8cca9a9dd2266a767586e44fb5f7ea6329fce4d4f8a65d72ee94a613855ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237392, "uuid": "a2fc868b-70ac-485f-aeb2-0493025303a8", "value": "T145C33A73CC256F68C624E5B4B0708FB92B63996095475FBE15B7C2789083D8DFA093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237392, "uuid": "ac1ff1c2-24ce-401b-b411-31303c084651", "value": "1536:J1h9K+i4jj4P+pC8HKSY/97umqo/QS041FyRWWdxpxeEggo4GvcvVw5:jzX5oGp2S2QqQS0MsUWPno4scve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780237392, "uuid": "a4d84b68-25a1-4a38-864f-09e5c888fde0", "value": 119448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780237392, "uuid": "60b17d31-54c6-442f-bdcb-db83963eea30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237392, "uuid": "ef9dceab-0e0b-462a-9633-cdcc72587ea3", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfb2fc6-5cc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780212472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212472, "uuid": "914bcde1-d41d-4c50-97fe-92e85ef586ad", "comment": "Malware payload", "value": "d367e8eb9a3054e4d3552f76fb1663fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212472, "uuid": "9b49b4a2-66df-4da6-96ae-204dc72f7247", "comment": "Malware payload", "value": "3fba587e5fe244f53f57dca3dc5d3538b1a69a1dcf39642d43fe88983c636d7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212472, "uuid": "67c5300f-3273-4ed9-bea5-42bd225d96ca", "comment": "Malware payload", "value": "d81613fe84746636ded2224db62da79bab64dae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212472, "uuid": "7cabdf33-aff5-44aa-a440-2a192a0a2ab1", "comment": "Malware payload", "value": "e8339424a9a906914a21fe5b8425ea537ad2c97c7b12b97d96e4092445320fd03a43fe2d75e70c485424ab2728e7c291", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212472, "uuid": "a2a225a9-ef82-453d-8e62-0601fe786cfa", "value": "T1BED64B47E8A545E9C8EDD134C9679612BB7178085B3163E72E60F3282F77BE0AE79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212472, "uuid": "f33c6905-d572-4d94-a4f5-b5ffd670b87b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212472, "uuid": "e9142b40-7c1c-42bb-9886-1a8d4b5c0329", "value": "98304:c6tn4wnal4Ab6rmSMPj0gTG33DJdaTZiiLCTZBRA72KcR82jvvJEYf:canTal4AurmpiiLCT/C6Y2Wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212472, "uuid": "4ebc8d96-884e-4852-9d9b-e054fd92503e", "value": 13814325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212472, "uuid": "0d932e3b-c082-429b-984f-03856ff803c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212472, "uuid": "56bd429d-f3f3-4a61-abe1-60afd45188a3", "value": "4a9bfced055c4b615e2b9960b9611fb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af31cd45-5d1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780252179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780252179, "uuid": "92f41481-4dcd-4978-bad5-fc8502039a11", "comment": "Malware payload", "value": "b82547e769ab3c69245d1ad27f764e25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780252179, "uuid": "16748751-8f89-4d0c-b890-9d096cb0a4c2", "comment": "Malware payload", "value": "4165229ffba96b372853c7d1c8bf1238755919a20dc5423afc079c79e74de661", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780252179, "uuid": "e3e875f9-c1f8-4841-9de0-4393a1e89f8e", "comment": "Malware payload", "value": "d9a55d98bd29e07bb1c57995988d787dbba6b4ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780252179, "uuid": "7dd71975-9ad5-402a-b159-23222253aa1c", "comment": "Malware payload", "value": "1a30801ab84f34f4dcc3578ed7d76e73be030f4e139aadb80da0e08f3c311bfbd9918be03ffd354781663aecf2e13a77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780252179, "uuid": "55fb3b18-ab81-4755-9fc6-5c421523b9fc", "value": "T19167CE7792067CEDE9B94DB4C41015816DA878874778A3C7BAC8B1E666FB2D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780252179, "uuid": "82414113-9154-445a-861c-dc4c8e9e9654", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQp:cqYUQuVDt0TZEAom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780252179, "uuid": "0db84cad-fac3-42c5-8a73-f9cb3b8e1308", "value": 29786112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780252179, "uuid": "94a6e2c0-ad0a-4375-8985-11787b26c152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780252179, "uuid": "0dd51532-6404-4b4a-9062-8628a0307a98", "value": "4165229ffba96b372853c7d1c8bf1238755919a20dc5423afc079c79e74de661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affcd9bc-5d1d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780251751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251751, "uuid": "2ed87ebd-07e8-4283-8e5c-fb269b30e4e3", "comment": "Malware payload (Vidar)", "value": "be43f9a029b74f5f541486fc61a8e97f", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251751, "uuid": "8b08a793-d666-4112-8605-f92cc3f5b717", "comment": "Malware payload (Vidar)", "value": "4209b06b9d6a0bf8ce57291481e378ecd960ba836c6a0d9a1084d1fb66135ac3", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251751, "uuid": "21144fc9-ee4e-45bf-abef-469e80c34a98", "comment": "Malware payload (Vidar)", "value": "97ab10bbfe7a83f9638bbc7847e6334ddffcc727", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251751, "uuid": "4b86c108-1120-43f8-8a13-4db945bbe5a3", "comment": "Malware payload (Vidar)", "value": "ab5f3b5497f6ccc7ff3fbf8b6e2ee720cbc49bd8c4339fa0296097499d3bd83cb740c4d6dd40a09e707ba69c33750c5b", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251751, "uuid": "b9522dc4-ee94-4c52-a064-a43eef6f4808", "value": "T1F2D56A87AC62E0E1C819B2B3A8A381757B64FC157B75A7F729D825341F322C049F6F94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251751, "uuid": "2331253e-73ad-41f4-8aef-87c2aed376cd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251751, "uuid": "9c3b3d27-7b8d-4ce4-9dff-a89e6e028a85", "value": "49152:RRK5WuF42gzZiwiCVwmrdyJlY/CrFkxY+qH:RoJFqZi3CVwmrdglY/CBAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780251751, "uuid": "d5792a7d-d945-4f1e-86e7-6f2c709184ef", "value": 2859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780251751, "uuid": "785d8327-2daf-48ed-b506-ff662f1289c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251751, "uuid": "9c079e28-89c5-4996-b0cb-021b320c83b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c88950-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "27de334a-6d8f-442f-b621-59b51fc1fb7b", "comment": "Malware payload (Mirai)", "value": "e40da3b9c9cbf8a1c605151ebc3cee86", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "f4e46b77-93e6-499f-ae73-42cf2e57b30f", "comment": "Malware payload (Mirai)", "value": "436c647151880024eb68b897f5ecd32c642965a85204ac488bc2437f172414cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "edc85133-bedd-4463-b37b-0e880fb5ad7c", "comment": "Malware payload (Mirai)", "value": "2e98f4b8e198b362e3db7bf381b56890c5c595e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "8cb070dd-c558-4c22-ba95-28c0bce377f7", "comment": "Malware payload (Mirai)", "value": "89e7cdfeb042b5cebd26b5fe6bed0c74365ff18c520eb37519a05aeafbf332bceb93811514839afd863395576da36018", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "9caf0ca0-ad43-48d0-abd2-938f30241c8d", "value": "T13D733A4AB8819B11D5C5237AFA1E128E332317B8E3DE7212DE149F2177CA96B0E77911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "cafd029f-a22f-42bd-be4f-f5a95a21abe6", "value": "1536:xWnR4v/qoGR5cOQ6PD+eliPCnIBfarWCQYMh9i2L4wQ824Wi5uY1:egqoccOQ6kCn+faEL4wQ824rU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213643, "uuid": "05ef5607-23d8-43aa-a83f-f9213148d0db", "value": 80132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213643, "uuid": "7879be5d-dc39-4faf-8e4e-995ba40ee701", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "6f9748c0-0f1b-451f-a254-ab7373d53ae8", "value": "karm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbdfd6e-5c97-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780194112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194112, "uuid": "4a685a95-72a3-41a5-8d48-bb5b849b26ce", "comment": "Malware payload (Mirai)", "value": "035981ccca4dd7b41dcae87a0039f6b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194112, "uuid": "60926311-1ae9-46fe-a4f9-4fd8cee5b979", "comment": "Malware payload (Mirai)", "value": "439e978519da00d49065d0b0da635a0014c18f3207c272797b1e9bb4caa53e4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194112, "uuid": "ffed3904-59ac-4a5b-ace1-5b5de131b21e", "comment": "Malware payload (Mirai)", "value": "22d2a3d2ba764c3580e8b45208f6022ed8fda5e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194112, "uuid": "f1da7050-8edc-4a2b-bdf5-7ae271ad8f5c", "comment": "Malware payload (Mirai)", "value": "0c0a86146a33df8248953fb468afcd232775a3b7f894b4ebd828d0dade877d09647ca436d646895996a2dc2811eee950", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194112, "uuid": "fcdb9dca-7440-42ad-b339-2ce4130bc195", "value": "T162B30A427D419F13D5C322F7FBAE42983B136B78D7EA3102E9247FA127478DA0E66611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194112, "uuid": "2bba3bcb-57e8-4278-b519-de4fc60b779f", "value": "3072:+A4Qjbwb+bScYp+3q0oM+pNR6Fx11KvaV7Aeltf:qswbMS7pGq0UpNR6b11Kvaxltf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780194112, "uuid": "4a6c8273-c88e-4607-baa4-63bfc78f184b", "value": 116784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780194112, "uuid": "2af5cbb3-4199-45cb-a5c5-7a6110717c81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194112, "uuid": "3a6788ec-2ea7-423c-9086-8a2def58917c", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508961e7-5d27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780255886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255886, "uuid": "ce89b5dc-881e-4be6-a569-8dd7864cd96b", "comment": "Malware payload (Mirai)", "value": "35827fea335fa9bb5cbc97454ea00441", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255886, "uuid": "acadc6e4-5554-45ae-8099-2e68102bc7b2", "comment": "Malware payload (Mirai)", "value": "43b946c50722fc7685ab36d5a35f713155845d6198934d1416e1b5138fabefbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255886, "uuid": "c1de1e8d-f929-49bd-b48d-dbbc77f90b58", "comment": "Malware payload (Mirai)", "value": "cf1507b9660c3fc87006255cf735c62001a16951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255886, "uuid": "2eb7c5d5-2fb0-4829-883e-a98810d6d6a2", "comment": "Malware payload (Mirai)", "value": "b9f3e8c1458090ab8727d56dbc848d62d70ea3e08f7bbef1f5ce0bba76dd7835d32286bb9a7ea0e16376342c26eed9e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255886, "uuid": "7548b298-9d88-4404-9fca-89162a7d7614", "value": "T11C14F80AAB510FBBD8AFDD3706E9070225CCA45722A57F357674C928F54A60F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255886, "uuid": "48bf973f-d34c-46d9-8789-9aa1187deb21", "value": "3072:RUxq0u+XO4wE7yMkpfR7rG04TJpgLYPO6bGucUzLFck:RUpuuw+yMkpfZr0Jq0m6bcU3Fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780255886, "uuid": "315dd3e8-a559-437d-957e-cb453e1ef7b7", "value": 208840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780255886, "uuid": "cc5d57bf-da04-4e5a-95a5-c9304bd31edf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255886, "uuid": "f02ae3b9-55c9-4655-8327-e10c0c23e850", "value": "micro.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cace3454-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250078, "uuid": "5dc205d6-43de-4383-9474-53eae0ede8a1", "comment": "Malware payload (Mirai)", "value": "8cc8c5f0fc46729f288c88b391483f49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250078, "uuid": "4b46b717-79de-4a68-bd6e-852df898eadc", "comment": "Malware payload (Mirai)", "value": "43fdec415105ff3004c8d905d138a13eb91ff38a5712b96be1656d55371718d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250078, "uuid": "ec8b475a-e562-4ab1-a246-0df8460ff147", "comment": "Malware payload (Mirai)", "value": "ff64c97c493fde0f39bc17ef57f4cdb88663de6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250078, "uuid": "d1bfadc1-0119-450e-9642-584239305baa", "comment": "Malware payload (Mirai)", "value": "0fc316140468188be3a81d52d333dafb9d28e52859f5331a02fa73d1350a4e2f7e7459b7eaf17197b5661ae42bf9cecf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250078, "uuid": "fb1bad36-8b76-47f8-96d6-8ee5472b3668", "value": "T1CB939E26D0146DA4C49686B4B0E8CE751F63F0C883572EBB19E5C2B96893DB8F905FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250078, "uuid": "066960e6-e4f6-4b7d-91cc-14ee5b7b63f4", "value": "1536:vZOnLRoMikpOQqfFbYYhv7y7KGzJWq7RaCeeIQAHb:vEnLRRikp8FbLFy+GH7RaaAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250078, "uuid": "1bfd3d1d-a254-420e-8000-5ab8358dfc92", "value": 92172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250078, "uuid": "61769a9b-a890-4d61-8193-28bc877a46d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250078, "uuid": "a89655b9-ecb9-4fef-b1ca-23976a42f38d", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba0c76a-5cd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780219773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219773, "uuid": "9372ae9d-afc9-4fd3-88f1-363652eac63c", "comment": "Malware payload (Vidar)", "value": "6e005545722d05c59bdba0ddc4a99e39", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219773, "uuid": "e5903a65-8b2a-43b2-9e9e-4f4d6c1ee6ca", "comment": "Malware payload (Vidar)", "value": "44b3b4e3c319900e5c71b2adb136748dda9dca8893df084b8986af0ff29211f0", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219773, "uuid": "6d336a1a-898b-4a68-8cf1-eb39b3c99f54", "comment": "Malware payload (Vidar)", "value": "d203e9437db2ac63c2ec79d7fa791f3a7f6ae696", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219773, "uuid": "4bb20ba0-01f9-494c-aba5-841d87707b55", "comment": "Malware payload (Vidar)", "value": "b6bebb888bfc24ab020e1d408396818e9e1cfa4131ce40e87fbf9f258139b97021836795f03108bbea9c5f9dad425450", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219773, "uuid": "1e3f71cb-e2c5-405e-ac20-d45a651de584", "value": "T19EC57C876CA2A4E1C81572B368A751717B24BC147F72A3F32E9872382F715D458FAF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219773, "uuid": "e5c22e10-79d3-4d14-8dfe-2a8647b336dc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219773, "uuid": "17f373c9-d35a-4197-9347-2978199ef842", "value": "49152:p4pcJO6NfmPFaW5Nd8OTmUH8zO6fiPzdTooi+LdNqh1HHl:pdDKN5NEUH8zOvpco3nyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780219773, "uuid": "b41641f3-c8b0-40f5-bf11-9d9748d26ed2", "value": 2658440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780219773, "uuid": "9e2f0a42-51d1-4bfc-a0e3-fec11c2ef87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219773, "uuid": "80fb23e1-244a-4101-a49e-a364ad68266d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6857129-5cf8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780235951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235951, "uuid": "6618c963-eacf-479e-8b0a-2b7e93d4bc32", "comment": "Malware payload", "value": "015430d217d36aeeadadacd9b63f033d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235951, "uuid": "23a1e35e-53fb-4ce1-a2fd-738cab01ddb0", "comment": "Malware payload", "value": "453205ae451d8bf0b9f7ec224151debd3877dac2cb78be044878cf856e25d830", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235951, "uuid": "324f26c7-d019-4095-aad8-3b7474a354d8", "comment": "Malware payload", "value": "4737f559f136e4ad993df41d48da7fbb232842f8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235951, "uuid": "75526018-f8f6-4198-8fe3-85d1613d7087", "comment": "Malware payload", "value": "bb2bcfb5c19c0ce2514522378c9dc4853362e812b776f52bdbd392729e4c1aa6553e616234aa5c7344cdf02325520faa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235951, "uuid": "a983e991-37a7-4eda-adae-494f016226e4", "value": "T19D137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235951, "uuid": "bb4a8ca4-9ba3-4e20-b14d-6946cf4240a7", "value": "768:p+E9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:p+pcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780235951, "uuid": "5cea0788-8ec9-4be2-a7cf-39259753d0d1", "value": 45526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780235951, "uuid": "a84e9409-4848-468d-9dfa-374561c47d2d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235951, "uuid": "b87b1903-9e40-4bb8-82c5-855d752f3d6c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c417cf0-5d0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780245195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245195, "uuid": "2f0176a1-46e8-4fa4-b719-6907517519b7", "comment": "Malware payload", "value": "733db042ba98d1deee1a2046bda83bac", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245195, "uuid": "60bfbeff-0fcc-41b3-88a9-5559a0c2eea3", "comment": "Malware payload", "value": "454d0d0d7b8f97a1e617a57e7a3e4d134140dc4b390cb2041532f815d2c221dc", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245195, "uuid": "16935936-f9f6-4e77-87f0-544197795c1c", "comment": "Malware payload", "value": "3c2d32445271b9db4303f3927cd0262613e5bb12", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245195, "uuid": "c01cd6fd-bd5e-472c-a90b-3baf0b6597af", "comment": "Malware payload", "value": "adc86fc871a7da80234f7ffd2e02d00d6d9c53672278a4a31d3d0eb22476d2c1d63a205a48c5ad15bea54ee8e490c1f7", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245195, "uuid": "99a2934a-5032-4d7d-893a-2a1e3245b453", "value": "T1530833364434D1A9C42A74F0A231E02BB35C676FE3216E3ED3A9436479F64D6C86DBB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245195, "uuid": "c1e0ccf6-7e70-4790-823a-d9fa660e8724", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245195, "uuid": "665f833f-fa88-411b-8f64-7628cd54f40c", "value": "1572864:ht9IKP6O8ulpRWYe8MW7dm8eBHCo6cqpFId3IROH7:hUKS5uLRWGMaduBHCrFW3cOH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780245195, "uuid": "b747e2f5-6f8c-4c37-acee-ba859c3fd0b0", "value": 77630761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780245195, "uuid": "8342a9b8-fc6a-4fa2-bb72-044ca78cf29b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245195, "uuid": "a0f9d5ef-6f29-47b7-9d7d-60ea99493ee7", "value": "NTE-Tools.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb4015a-5c90-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780191084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780191084, "uuid": "bbb6a2a1-1e54-48bc-be73-956f99381252", "comment": "Malware payload (Mirai)", "value": "b48d230e9facdc7c9b773efead05e008", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780191084, "uuid": "7a7e8c3b-2fa3-4ca7-82d1-ac06cbda46ec", "comment": "Malware payload (Mirai)", "value": "45bff40a22d87575c6dd47fb5a1cdade428c08771f50c357ac9001f3f6f1279a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780191084, "uuid": "04c936c6-6cdf-4f2b-a106-b276b5739a30", "comment": "Malware payload (Mirai)", "value": "6511eb4a1c23019679d9e04cbf41ec543fb11b27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780191084, "uuid": "c768038e-b358-454e-be07-2c32c1e971d5", "comment": "Malware payload (Mirai)", "value": "e4778f1c62750dafca5013af7a74603b7aee69e6582e9ed0d6619ba2198eaa4c9c6c40fa3ccded643799805b8d0f00f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780191084, "uuid": "813e68dc-2951-4cb1-9904-ad308be98d7d", "value": "T167664947ECA515E9C0AE95308A6295637F717C894F2163D32B50F2393F73BD0AABA350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780191084, "uuid": "97806b9e-1ad4-474a-a6e2-329021edfb99", "value": "49152:33I1SPjtuIXdqKJDpQ8cguLmR4BzPImQ0L/rNfxAPrz3KdRI60NxuVM4KlK1KVT/:331PpHU1cgD9x2f6Ujm3Ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780191084, "uuid": "4bc0e484-57a3-4622-8c75-7ba7baa64340", "value": 6820002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780191084, "uuid": "c9281e23-2739-4185-b765-9e5f01099f76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780191084, "uuid": "2077c99a-63e5-4057-b1cd-76d03e5c192d", "value": "45bff40a22d87575c6dd47fb5a1cdade428c08771f50c357ac9001f3f6f1279a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ea883a-5cd7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780221803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221803, "uuid": "2e0cb760-122b-4b12-8a2c-f01b7d4815f9", "comment": "Malware payload", "value": "29835d405449d474659542d50901033a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221803, "uuid": "5d97cd2f-6967-4d0c-911d-0bbf04325103", "comment": "Malware payload", "value": "47217430b6e045bd9d36d126dca795681b626643156fb375c4e2a9d3d7a91e79", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221803, "uuid": "6d05bb7c-edca-45d2-b690-dee7675661cb", "comment": "Malware payload", "value": "4dfc8cedf244f61348afce9829ea8086393f9a5d", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221803, "uuid": "d65aa294-5145-457d-8f24-49571c19fb52", "comment": "Malware payload", "value": "b3ba5840200fd28bb043d291e2d3d80e755b992afb8d6bb8e86d449effbc91a1f99bbdf5165d19ebb3241a76ab92951e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221803, "uuid": "40516615-eba0-46ac-b2fe-a977d35784cf", "value": "T1EDF5330B62E9675DD2725431542D21A362778E00CEF283FE3D89E69FBB225186D4C37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221803, "uuid": "98ae52c3-f4d1-4cdb-81c2-9fda9f82d60f", "value": "cd10d9c4e9bfc54c446b3c83f0418b05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221803, "uuid": "4e871db9-4b16-4dd6-b4e4-de7be4fe140e", "value": "49152:xxo+zEUAZdl8dZzZObNruuwczQxfzYwMaJZ0aOuofvHL+dg+vQiCRB4+PSG:xxo+zEUQl0ZzZOpA5rZ0Luo3Lkgdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780221803, "uuid": "bed10565-3549-4cc4-bf23-1a469b9a3b63", "value": 3459088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780221803, "uuid": "c4398699-0301-4ec5-8861-75204729aa96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221803, "uuid": "254342d2-8827-4bae-a8c1-ccbc13c62352", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b9e2ee-5d15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780248158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780248158, "uuid": "2fcd9bfd-f671-4867-a1aa-fbdfdc5596d0", "comment": "Malware payload", "value": "bf71a0d748b898e80cf6cc9d4d37f7ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780248158, "uuid": "ce65f05d-8ee2-4549-83e3-84962ae9d5e3", "comment": "Malware payload", "value": "47ba76a5bcf954f1ee2b0eba4ad9b172d7934d8782e21ce0f3be78587bbe6f27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780248158, "uuid": "a1015ae3-1214-462b-842d-b68b6c56cf85", "comment": "Malware payload", "value": "d47c6787ac878dc3ac4d7241f4da66c5096f11d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780248158, "uuid": "1925f404-7518-496e-a878-e538b40b1a93", "comment": "Malware payload", "value": "73d2f2c3f6a095c5249aa1415a867954362731ff8adaeae3a679796dea4c3f10c2ce58fa105c799fd108eb081ba9824b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780248158, "uuid": "cce42631-c50b-4b42-8c7d-8c928ade718f", "value": "T1BFF75016B6058D8AF4769278548B4FA0E372ECB18AB1933723B8772D2FFE34C5E91544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780248158, "uuid": "e460a413-c8ba-45f1-a260-f2010112c3ee", "value": "33100aedc979741e5464b8a91cb38f35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780248158, "uuid": "781fddb5-7e0e-490d-b8ea-96880516ff28", "value": "196608:SK7zgcx/RDhMea5LRN3fMArDr5nzFo5fMJP3g:DRRWLR9hrp4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780248158, "uuid": "7f2e5ff9-c2cf-4cd7-a2e9-ecfe07ab89e6", "value": 72068904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780248158, "uuid": "b7275fc1-e887-4502-a898-a1d4a0f64aaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780248158, "uuid": "6e3c5d47-b984-4462-8f41-746c1cd5991b", "value": "zky868643801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1aad72-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213308, "uuid": "b9a23c6e-99af-49fb-8268-8056951d1d30", "comment": "Malware payload (Mirai)", "value": "64d7c35b215203cb7af25d56a739ee62", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213308, "uuid": "b2468c5c-81ae-4b36-8f49-535dad996620", "comment": "Malware payload (Mirai)", "value": "484dd61982a99514775988ebcdaf6159e94d6c1483d845af7881656d1f5c5c91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213308, "uuid": "a52b1758-418d-4444-bf04-6b15fee3d44b", "comment": "Malware payload (Mirai)", "value": "71dd96d9eb924cbbe45b9d17a54afd0183e764aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213308, "uuid": "469aa083-531a-44c0-912f-2d316ea9dcff", "comment": "Malware payload (Mirai)", "value": "58c9d37019c87a78c1a5939934628d2439fe400483b9a10ec52bfedb4d6acce5cd4ed33619b7a73debdc4da55016d307", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213308, "uuid": "9289f93a-745f-4d71-8e28-6911fa73bf49", "value": "T193438D36E96E1E74C04641B074748EB56F23F4C883572EBA1AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213308, "uuid": "2dc7957d-feb1-4931-bac0-77e14b83e3d1", "value": "1536:9aa0brW/Od9hlCRDei3KQXACspfDCMx2+WW:9v0brWGd9XJi6QqpfDQ+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213308, "uuid": "fc7a50fe-9f4c-4af3-aff3-824f109fff76", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213308, "uuid": "045c614c-b794-4f74-904a-4fcc34d14b5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213308, "uuid": "519dbe3a-9992-4d04-80f8-44c94866b9c1", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8089dac-5d28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256569, "uuid": "6e58d481-22b2-4483-a50e-759828ac0359", "comment": "Malware payload (Mirai)", "value": "b694f972313cef424488f017b38d4451", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256569, "uuid": "570c6fb4-4a1f-488d-a12b-7ff36366f28f", "comment": "Malware payload (Mirai)", "value": "49053dd03498050e8f369df2cb9c835c18a53cdedc97ed557b8e40ce2f3e9547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256569, "uuid": "e4f37fc4-58b3-42c6-9048-b16b3b22a68a", "comment": "Malware payload (Mirai)", "value": "8c1aa63946b8505db398724d800396e954be3739", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256569, "uuid": "3ce3aa1a-f9ab-4910-a532-a4664203177c", "comment": "Malware payload (Mirai)", "value": "ed41f880edf789818e2e0a64ba72967addd1ec17a16ec7315371a1f71d8d52ac764c29c87f575ecd25361ad1a13c893c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256569, "uuid": "94ca21d5-9f9b-4d90-ae53-465f5bb1a1fc", "value": "T15A24961E6E328F7DF268C73447B74A34975D33DA23E1D684E1ACC1152E6029E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256569, "uuid": "3f73e24c-9a82-45e4-a5a9-e9460e6d8120", "value": "6144:/PWg34cNBy9dEcqIIq+j5q1E+rTqj05KQ8Mc:VmE+B8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256569, "uuid": "b734c57f-0919-4e17-91d5-eb731fd86105", "value": 211628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256569, "uuid": "f3f920c9-3c20-4d33-bbe5-f30e97531c4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256569, "uuid": "b95e6f2b-523c-4536-8788-e68370ba7fe0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f86218-5cc3-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780213024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213024, "uuid": "a6d48774-8b41-4d42-8703-f21492d4a038", "comment": "Malware payload (ConnectWise)", "value": "441332cd6148336a31d3e671bbc06f6b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213024, "uuid": "47c60a65-3332-4aef-9664-6c6c71ae0884", "comment": "Malware payload (ConnectWise)", "value": "496252d26edd00f8a45d80470ad1ac21bd7b910df992d4ed2f8b883f069fce18", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213024, "uuid": "087a6bce-8c2e-4f35-a03c-c56662425478", "comment": "Malware payload (ConnectWise)", "value": "c1208b8404051c33c62b0e31dd37c6107c738c1f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213024, "uuid": "2ada3092-4831-449e-9a3c-4cd078449cb5", "comment": "Malware payload (ConnectWise)", "value": "639bb5ecff320967b47d2da4326106285a06e492b993fd564dd36256142143383673dfa8ddb8f1846a6ecbd6f1423726", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213024, "uuid": "4c5ecd93-2b9c-4846-952b-dcd68ae4ad39", "value": "T1BC646C11B9C48432C273383147B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213024, "uuid": "dcac56f8-24e4-4732-aa45-99203173ceaf", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213024, "uuid": "07bb9f4d-ac8b-461e-9874-4074eb255a14", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9y:J1iw7gryNkSV1hy1Z1u2JLu9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213024, "uuid": "f5a4df56-2322-418f-b4ba-5f4b2620ea25", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213024, "uuid": "ab7fe478-4d60-438d-b96c-f756160f4bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213024, "uuid": "d1a745e3-97e5-4575-b0ed-987607d2bc33", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5303b02f-5cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780212081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212081, "uuid": "a264fc54-b070-4f92-bcfd-7f7237ee26e2", "comment": "Malware payload (Vidar)", "value": "d2a8b82e225855d3682f877f535d0153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212081, "uuid": "fb4242b3-61dc-42ca-afa8-11bede61afaa", "comment": "Malware payload (Vidar)", "value": "4a239c63b6ce21d454a0f90cbe33e8b3e5690a6052a5c8e7e7dc9dbc7c83d4a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212081, "uuid": "90c0a784-53b4-401d-bf48-1068c48b3492", "comment": "Malware payload (Vidar)", "value": "49cd0d7fc2e3b532aca14f7e5d15e467309b40b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212081, "uuid": "f7311bf1-f9a5-47bb-9f74-57b3bfb9713d", "comment": "Malware payload (Vidar)", "value": "b742b4b03d97c92d03184acf68fdd4d0a6ca13ed0908f2f0f97e224ba660e2f891e056081058f7a9aae97cea73fd27ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212081, "uuid": "0414002b-8c9e-41e5-b64d-c67bc65c04f8", "value": "T1B3167C07BCA108E9C4A9A335C9A256527B74B8490F3263E72E60B3BC3F76BD45D79344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212081, "uuid": "b9dfce33-dee2-47e8-a97d-7342bc39f78a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212081, "uuid": "0ae4aa8d-24f1-4b6b-b269-680cfc4cc9a7", "value": "49152:GZCp5fUcADBNsQXx6rU4RRi4aRaj8Ft7Ev0ByiFbFNT37ymXudvep:G0istRwejYxX3O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212081, "uuid": "a5130d79-cd92-4d5c-b7ab-8030ff1768c0", "value": 4038784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212081, "uuid": "ef0ca27f-1342-47d2-97fa-10f6110a8422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212081, "uuid": "2a103e30-3548-4e35-b22b-bb99f0642eaf", "value": "S_t_U_U_D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b376354-5d2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257112, "uuid": "616f38dd-d46d-4697-ba9c-c406a03808f1", "comment": "Malware payload (Mirai)", "value": "8adfbd9951704e1fad5db9b63d84f1f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257112, "uuid": "20c7e8b6-3b5e-4cc5-8a46-43102c777914", "comment": "Malware payload (Mirai)", "value": "4ab4946271b91225d959fbc24584400a64e411054cc9c0f460612148002c241a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257112, "uuid": "4841bbaf-a16f-4d61-a011-b5aed52998f5", "comment": "Malware payload (Mirai)", "value": "15787d8a15aa7a23be97f4f7e4fe72081913e607", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257112, "uuid": "a521d4e5-d36d-43e1-9441-94cc1359f3e6", "comment": "Malware payload (Mirai)", "value": "88f9d37afa811a54a2236f51731010a895c1c1aca3ee46549b0b53482d13d59779c12bfe10a23adf90ad395f6dd23da2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257112, "uuid": "6911e674-1b78-4e22-9afe-f7c33a4bcc2e", "value": "T14ED37DB3C8292F98C615E5B4F0308F792B63A56481471FBA29B6C7B58047D8DF9193F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257112, "uuid": "75935dd4-b6f1-4f4e-8a1b-0b0bfcd2f8b7", "value": "3072:ie2DRFHabtUZbVFtdTqj+wbuzWOrR3r1o:ie2DRF6JIpFtdTdAuiO13ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257112, "uuid": "bf0ebe9a-9741-44e0-9f51-ba7161a0aa40", "value": 141744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257112, "uuid": "ecf4fff1-3c79-481d-aa5b-9f0a8925939a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257112, "uuid": "83e28024-0fea-449c-90b4-ec3b693a2693", "value": "micro.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8afc974-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250074, "uuid": "072f4a17-d5d3-4eef-bd81-c64307a0a8d0", "comment": "Malware payload (Mirai)", "value": "bfa7c6312e3ca8a403e58304d9b7324c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250074, "uuid": "8f4d4222-6682-474b-a6b3-09a3efeba556", "comment": "Malware payload (Mirai)", "value": "4b0f2bd8aebda76893ea3480b55636dff2753abaa2cf2f60e5c9bda64a022527", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250074, "uuid": "15e1e515-bef4-4c12-ba7f-c5d2121eb29f", "comment": "Malware payload (Mirai)", "value": "7f392ec69e295415e3a4f423eb1850d3a0a3fee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250074, "uuid": "5c3b824d-0c85-498a-97f5-2bfe0eebb753", "comment": "Malware payload (Mirai)", "value": "fb52db0d24602101bc3944fc354eaeda22808f1c2f6cfa296812836a47c47f6e859f60908458994b12497e4f21d6d14e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250074, "uuid": "76fcdddf-61ad-401b-95a9-b2412e073b89", "value": "T196F2F2A8669BB065E17070F7A600974B3B5292F550E63531C2AF436FA1DD31A6C31DCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250074, "uuid": "624439e7-c766-443c-a056-c4f2886c3c33", "value": "768:cBvQmrPqIUoVyY6lV8kJMOuVhjOR5po3YFrD/4AbGys3Uozn:cqmjqINViKmMnmVd4AbGvzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250074, "uuid": "7895e5dd-3040-4913-b5d9-f8260b63a86c", "value": 37476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250074, "uuid": "869623ce-49d4-477b-b202-b80de0191f0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250074, "uuid": "6c3b6c00-d12c-4580-9b48-fb732bd1a989", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05d4f94-5d02-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780240182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780240182, "uuid": "8085ff65-fe80-46bb-8d7e-1dcc30c2b75e", "comment": "Malware payload", "value": "b1bf53cde906dd27993b24221339d05d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780240182, "uuid": "b7533258-0148-4984-8cdf-f480689ad13a", "comment": "Malware payload", "value": "4b7946dbff396286b4c6b7389515ec22e1e16b38271fcc9bb4e7ee50b65d738e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780240182, "uuid": "86a92eab-87bd-42e4-bd2b-bef5a389caf9", "comment": "Malware payload", "value": "b40ba6c8276dd993191bc3a2ba8ee537cc3944f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780240182, "uuid": "1b63ca9a-eb59-4461-8bef-4b0b082f96c1", "comment": "Malware payload", "value": "de4eace78a16347fb798f992d0e65fbb42177dd834f90b27f9762de4b7db1a31ce144566f71a35867bc1f5ab62135a45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780240182, "uuid": "1a049a97-0d13-4497-a2d8-8847e3fecdd6", "value": "T19D37CF77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780240182, "uuid": "9bf69223-3b9e-456c-b840-814125c40d6f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ0:cqYUQuVDt0TZED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780240182, "uuid": "121d0277-2ffd-48e0-9163-7e0551f7f29b", "value": 22839296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780240182, "uuid": "39edd1ce-f47b-4da3-8338-bd437e7a699c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780240182, "uuid": "91e08944-d979-481c-b46d-15d1d72247fe", "value": "4b7946dbff396286b4c6b7389515ec22e1e16b38271fcc9bb4e7ee50b65d738e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6343e4c-5cf8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780235843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235843, "uuid": "0e818316-35b3-48a1-b8b2-9c9f8df1236f", "comment": "Malware payload (Mirai)", "value": "8f30d5e56de1fce8b2b5a8cceffc4343", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235843, "uuid": "c22a6b04-c06f-41d8-a656-340dbc3ff3a4", "comment": "Malware payload (Mirai)", "value": "4ceeb9b7802495c61654e3a23a8911475b7d67d874f2d37164fec0aaa696139d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235843, "uuid": "3969753d-bc01-4c70-a403-eae463b85ba1", "comment": "Malware payload (Mirai)", "value": "5d2b6f7792e53dcea3396d9d3de43ac83e536f73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235843, "uuid": "43fdb7f9-7f69-40ff-b758-4b4a5a05cf02", "comment": "Malware payload (Mirai)", "value": "a50268f659b0468838076ae1a70879e7ef04f844bd7d0be176a05316e656d2397d84727bf5d614356c26ee5da492c18e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235843, "uuid": "bae39f17-d770-4bc7-85cd-0bf3240b5c46", "value": "T1F4145A13B8A55F97C1966FB562F78A740703E8154B430FBBA22AEAF80247DCCB509774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235843, "uuid": "20ae3de5-ca15-403b-9143-a9fbebdc4f85", "value": "6144:vxgHCKHJGNo6+Yxk1iS6oQ4+6hfaA1HWhAtnlC:JgH/Hcr+Yx4R6oQ4+6hfaA1HWhAtnlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780235843, "uuid": "4fbe5b86-b37a-4406-9a89-ab230b8c565e", "value": 201409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780235843, "uuid": "15e22895-ed60-4ab7-b55a-50a08289e179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235843, "uuid": "6a216698-76db-4316-a421-54ec15afeb02", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7afaa04-5cc5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780214075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214075, "uuid": "5efcbc43-6663-4d3b-99ba-9e02d411fdef", "comment": "Malware payload", "value": "43e594b45cdee90adb34c38588c81ea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214075, "uuid": "78b1931e-4f8d-4fe1-aede-58296ddc8653", "comment": "Malware payload", "value": "4e4b56844cd5b9e474062a2a66d1c1eb668f0868ac2af86c5e5baba64ed05c0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214075, "uuid": "f3d221bc-3a28-42c0-9b43-dd15af94341a", "comment": "Malware payload", "value": "35e29df17abfe818ea621a0c2a4f3b219b5450b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214075, "uuid": "6fcaaed0-98d8-4591-b390-2a8064cacee4", "comment": "Malware payload", "value": "200c77ea3749957279b2a8e8e5f9e0399ecb5a381511f8ccd25bd5cd00fb9abe294b9e001876b33eff8888dd36a16de0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214075, "uuid": "3c6edf82-6485-47cc-9346-331a659c8351", "value": "T12763950AEB654EF7EC6FCD3706B9070135CC951A11A93B393974C82CB65E54B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214075, "uuid": "3cd25d51-653b-4010-8209-2a1e274bdb18", "value": "1536:7ga07+JccgprTOldudVU5Zqwmo2dCUsMBY1:7a7+X4rlM5N1MBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214075, "uuid": "889ad6c3-b66d-4d31-a81d-a5a4e80680b8", "value": 68928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214075, "uuid": "9981d5a0-ef9a-449c-9e91-a79cf70d5e2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214075, "uuid": "d80ea92a-1115-4d11-9b69-b906d0564676", "value": "3.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c64f76b-5d2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780258375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258375, "uuid": "dee1110d-062c-4884-bf1c-12b6b408dd46", "comment": "Malware payload (Mirai)", "value": "48843534348681b3630a3a4b90590f7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258375, "uuid": "31420595-ced6-43ac-ad67-b2f5ca7cad21", "comment": "Malware payload (Mirai)", "value": "4ef52a4de79da13258cff72a3c3157f4335180e0462bc7184c9d7ca708fe3a6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258375, "uuid": "b1b40122-bafe-4c2b-b4e3-09ec4accc7dc", "comment": "Malware payload (Mirai)", "value": "bcf7da152d755e5af507f390a32ea716f685ea1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258375, "uuid": "53b5ec00-d47a-4e7d-a71d-12181715cb33", "comment": "Malware payload (Mirai)", "value": "a7fce0ce6086733cca4d5c24bdd8ea51d66558a99c48f0631adde6d388fda4a0035af6ed8a4f9b7cc0317791ba9c39f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258375, "uuid": "7ec83add-2c78-46a9-9fb8-a663fe0dc4ea", "value": "T16DB31B42BD419F13C5C322F6B7AE41493B136B78D6EA3103ED257FA1278B8DA0E67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258375, "uuid": "17ed6d43-1e71-4d8a-b68c-affc6281109a", "value": "1536:60Xr27mMwuRVVZwaSTRnfjXIxHV59dtzA8369kkMqkpa2OM7X54ReHdYVcdgfEaE:7r2dwAVZwNmHBXcb9kkMPz6RCPXap+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780258375, "uuid": "23364296-b2a2-4787-8388-abc6324c5368", "value": 112668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780258375, "uuid": "e26608dc-fb21-4614-8bbc-9c85d501a2e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258375, "uuid": "2fe75b74-9079-41be-bbee-65057f13352f", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bcd73e-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780214388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214388, "uuid": "a851fd30-35bd-431c-ade7-ec4309539d46", "comment": "Malware payload (Mirai)", "value": "b6e34db75b71bc34bcd918e6cb356c40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214388, "uuid": "ab8697f1-fc32-4bb8-9427-d30a7f02240c", "comment": "Malware payload (Mirai)", "value": "500b5619559c6ed68cb260a3b312c583d829393982c477300991fd92637064f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214388, "uuid": "03b291ad-4e0f-48de-bbd3-da7d17830bb7", "comment": "Malware payload (Mirai)", "value": "887deb5cd3a0a90c3c18df55f4ddbfa87afcdafc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214388, "uuid": "fd132ae9-d1ea-4e6f-be3c-e6686e57921b", "comment": "Malware payload (Mirai)", "value": "42c1b452e5bb8e8aa7be16dd6358d4d17f586d99c08255e1e3fee177c20d8aef5bdefd8120ae1bae90217b63839f8080", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214388, "uuid": "d0dda65c-79e6-497e-8bf3-91e217b1a2db", "value": "T1B9B4D096F7062F42D4D7D9360986D2808B6DE46763F393453B43A9BB382D2B24F29349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214388, "uuid": "76086f34-d19a-4f08-acea-d7c81446df3f", "value": "12288:/oGB8on3p6bb9Mhi7OX5BsBmSyfy2gp2ltMIRiep:Hpn3pS9M2OnSOuIRie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214388, "uuid": "69232248-0323-4a36-bcba-04366da9e20b", "value": 505520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214388, "uuid": "2c38a6c5-9a74-4e09-af6e-3c82acb2de79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214388, "uuid": "6481e675-7dfd-4d84-984b-81e80785ea2d", "value": "blue.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d765b55-5cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780212206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212206, "uuid": "d7e9b82e-20b0-4e9e-a10a-2b0c5cc5711b", "comment": "Malware payload (Mirai)", "value": "20005c9ce5ff70884323ae22137c0471", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212206, "uuid": "cc829816-e886-498d-a6bc-b8ea8cf147bb", "comment": "Malware payload (Mirai)", "value": "51b4708a0924626c6c8496e0aa912bba0b59e19a6a46b9e3a45a1e25aeb51860", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212206, "uuid": "0a30cafc-e84e-4d12-9cb0-ae941522bdf8", "comment": "Malware payload (Mirai)", "value": "e046f8c5ef031ca924ece8c3e91811d356ce2d93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212206, "uuid": "fabe5713-a468-4004-8172-a9bfdda7483e", "comment": "Malware payload (Mirai)", "value": "7210d216a5b5104ecf828e6eaf0e19ee6ff372298429b94e87fb3026684858288bb670f62c8884d9383f41c799712b78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212206, "uuid": "2a29e368-381e-4dd7-aa74-7361c2d75597", "value": "T104136AC5EA43E5B1FC6211B6213797638A76E53A153CEB42C7652434EC93A10E72F3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212206, "uuid": "72c7b06a-f98a-4bc7-bfce-14addfc3d379", "value": "768:1fIKORD0psZQey18F7THoDPX/FOu4aAwrx8uYSYcI7d:12RD0psZQeio83FvdlrxYSYci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212206, "uuid": "7fbb8bbf-7b34-4254-9985-6dbc8c665695", "value": 42092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212206, "uuid": "2f6d8390-80e6-4f0b-80cd-3f1337745a8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212206, "uuid": "9ed4e440-211d-4adb-90d5-acd8b5f20b42", "value": "1.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77547677-5d1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250797, "uuid": "004fcbfe-cc86-4a5f-9c2f-6727161df457", "comment": "Malware payload (Mirai)", "value": "8cad7e1777aadb0dedd777c8b35ede1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250797, "uuid": "ab7f2dff-a07a-4465-a7b1-3fa252f8abcd", "comment": "Malware payload (Mirai)", "value": "536b5d4f9ba8c264f0ac0354c774dfd9fdab91cc452b640b14206f09b1aad253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250797, "uuid": "ecdefb39-32b5-4fbe-b116-f9b92e94f43a", "comment": "Malware payload (Mirai)", "value": "8d98cf6e679f0d0885c42c9419e4395d61300df7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250797, "uuid": "c5a420b2-b82b-44c0-8428-f9ff3426b264", "comment": "Malware payload (Mirai)", "value": "c2621b88dd80e6b57cb3bb2fbf4053e02401a2077ab3d1b63c8130d68c24a7ae937664003a9199b186d4511ed45f29c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250797, "uuid": "e7396a31-9697-4424-a9c5-385270ab811b", "value": "T19C23F132D2255AE0C12C44B3984DBDD60E1FF2A711F05A639DC4257584A3F845FE9AEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250797, "uuid": "b3696df4-7fe5-4239-ae35-373a508eace5", "value": "768:AWeMLT46jhPAhzg6gESQpSurldLCkCoQAMVKlU6mIfPJYz1TKgmhxjBJnt3jnbc4:Ae061PAhzg64qldLC8RMVV6lPqTKgqB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250797, "uuid": "50970fde-eca0-488b-9749-cbdecc3684df", "value": 47524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250797, "uuid": "59defd17-d4c9-4a18-a03d-85e2bab6472c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250797, "uuid": "483cb337-0015-4789-8660-6e29bdec4a0b", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af17696c-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780214383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214383, "uuid": "c657f65c-7ee7-4b3a-b0da-9cf012c4011c", "comment": "Malware payload (Mirai)", "value": "21396a3cf72fb645eb0b30a94c3d17c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214383, "uuid": "5026ea43-2148-4609-a032-74534ea5a2c6", "comment": "Malware payload (Mirai)", "value": "5445d8765b0db8241c4c244488a28322bfc60f84dedd9f8bf603c6c714c5afe9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214383, "uuid": "644a9f2a-b481-42d0-a9b5-f41f7c28c7a9", "comment": "Malware payload (Mirai)", "value": "df39a6a20342ab9bd13754c9e34bdec6884c94b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214383, "uuid": "4a4153cd-e112-424c-9649-19d1e62cba94", "comment": "Malware payload (Mirai)", "value": "55bc888e4d6cbdc319a9c4a914c4817396f27fe4e0288b6d69c853c626e19433b505394ec4cbea2d553aa8e2aaa8268b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214383, "uuid": "d14022db-f947-4302-b90f-d9101c5b86ac", "value": "T1A8F46B237711DF65E359D27008F3C6A19AD520A31EE29086B27CC3187E6066E6E5FEF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214383, "uuid": "ff3affff-dd1a-4106-8504-4b9aa3e83bce", "value": "12288:BG+IoOm0AWLFbaqQaXHxah4g4ixGu2qwtI1dJRgpbxMgw1jfwJ:w+aLkqQX4ixGjqL1dJKBwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214383, "uuid": "3cb8df50-93c2-4a8a-8eaa-030753ff5841", "value": 767668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214383, "uuid": "d520ec37-b5f6-4dff-a06c-4d3cbd5e52c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214383, "uuid": "70b86ecb-aa8d-43e6-bdc9-16af08bba143", "value": "blue.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1996422-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780214360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214360, "uuid": "46dc2a60-26df-4d09-90dd-53a288c934df", "comment": "Malware payload (Mirai)", "value": "801a23b18042a03e36e64bc53543de0c", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214360, "uuid": "0b971c99-9bbe-4cf3-abf3-b76e9ffdd5e9", "comment": "Malware payload (Mirai)", "value": "562cbc706a6e6784095f6995a9f75be84f25a36c988c54768f4e1ab7f1bf7124", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214360, "uuid": "3dd9a111-9739-449d-8217-6beb45503640", "comment": "Malware payload (Mirai)", "value": "a3a0a9ae55976176805a9bac8c9c707412088e7b", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214360, "uuid": "35efae98-feae-44e6-9b4a-f54b98d20b2b", "comment": "Malware payload (Mirai)", "value": "942fce3ff85cb88b5b43014a864241c3c62833549c48c9408872b49e741d34b4b43ea1e86d1fd4b4077042cf2cacc192", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214360, "uuid": "40dfeefd-31ae-465c-b613-4bd91aa760cb", "value": "T17B642265B950B62A7652A16636FFD0FC272FC5D420AE7557ECE2D004EC2D8CB101BED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214360, "uuid": "39c8a5ed-3814-4719-b89c-4a4a8e7a58db", "value": "6144:1OBPCqUVjnKv3Pey1tM6tASbsmJLb2GYseOA0JiOIVe:1OBPCqUVrKnkSj7JLqGYsa0Ji4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214360, "uuid": "0cc49cd9-ed1a-464d-bb7c-ec967489db5f", "value": 315748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214360, "uuid": "5f850b8a-81b5-4071-a5f1-244c427dfe5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214360, "uuid": "e819e47c-c15b-4076-934c-4df81b14f133", "value": "blue.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fef4c5-5cdc-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780223788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223788, "uuid": "934818ef-a68b-4077-a5a6-157aacbb508a", "comment": "Malware payload (ValleyRAT)", "value": "76c0e06e397caa91909b0fb7f64b0db9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223788, "uuid": "224e3b18-c917-49ad-8d83-18f26c52255d", "comment": "Malware payload (ValleyRAT)", "value": "568bd1ff0cd7a3104929d78d9c4fcf97d6e49f71d86bba85ef69a1dbbf9ce319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223788, "uuid": "5f2f7701-4b2a-4e6d-b58e-9606e1ac0859", "comment": "Malware payload (ValleyRAT)", "value": "1efb02ce2756f57160542dd91fdd4356d6ede6de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223788, "uuid": "346bd504-b5f5-48d2-9edd-ff5e7d724f99", "comment": "Malware payload (ValleyRAT)", "value": "7e22525d2a0285e1cfde36fdd257bc5cac1ee8ae8a002dd5be69a1178404790e139c9a78772eb7061da7c08a1a6d0a3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223788, "uuid": "7edd23b6-be88-4f1e-b084-de4db1b9d2d1", "value": "T15BF75016B6058D8AF4769278548B4FA0E372ECB18AB1933723B8772D2FFE34C5E91544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223788, "uuid": "c102a6ec-2f9e-4f6a-bd0b-e9e8c45b93ee", "value": "33100aedc979741e5464b8a91cb38f35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223788, "uuid": "264b35f5-1ece-49aa-8b8f-943ea299c911", "value": "196608:XK7zgcx/RDhMea5LRN3fMArDr5nzFo5fMJP3I:aRRWLR9hrp4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780223788, "uuid": "9bc0943a-5200-4700-8914-a3340760997a", "value": 72068904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780223788, "uuid": "e5d808d9-3fd6-45b4-a9fb-31decd4bee6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223788, "uuid": "515df2b8-9fd6-49e2-ad5b-35b63725c8aa", "value": "zmh853563203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd20b015-5d29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256927, "uuid": "19791ec3-c842-4244-bc34-d0a66915985e", "comment": "Malware payload (Mirai)", "value": "79f0f00a4b458c788397b6af302219f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256927, "uuid": "253ab007-8b39-43a9-9589-0b3e007eb8f5", "comment": "Malware payload (Mirai)", "value": "577c49721b97f653ace482a31c6375b3c0b7ab1d77c3af4e28475246ffbcd722", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256927, "uuid": "cf1f2c4d-f00f-4989-825a-d055c9f48969", "comment": "Malware payload (Mirai)", "value": "ff71b59b947e9d4995b401fee570538eac465031", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256927, "uuid": "1ce9c20a-c71a-4d0b-916e-2ab36683307e", "comment": "Malware payload (Mirai)", "value": "12bc227bfea0a60c541a401850d8dbd8548337a8780706015cc5b0bee0d190d03dbd2ae1b70b4db813f6a9c9eed5db77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256927, "uuid": "c56c3f40-fec2-49d7-a9fc-103a27aab7a6", "value": "T13F134C32C938A61BC5D4F37606A74372E0EB6F881140674F7E264D9FEE69340263A7D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256927, "uuid": "6e4eee67-b8ed-4565-93a6-68f29c5182a4", "value": "768:2uN1zM8OQFHWP7f7Qlo+JW70//fU1TmQ6iulY+EuXVWeOXKOukqaRt0guM81:Vqaa7jMx/8P6iulY+DsTlukqaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256927, "uuid": "c9bcd598-660b-4133-9135-36075a320c4d", "value": 44920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256927, "uuid": "1268e763-ca4e-4b75-93ac-6b57162a1bd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256927, "uuid": "38a3c6bf-6e00-4526-ba9e-32e4aff48e8f", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8dc98b-5c95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780193174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780193174, "uuid": "36b34a34-659b-4e7e-b84e-4e7176d13314", "comment": "Malware payload", "value": "345d10e867bb46fdc23e8ed5a5653eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780193174, "uuid": "1a5a386e-3fb2-443a-bd64-0ce60d1e787c", "comment": "Malware payload", "value": "596f88d47531a616020e46a65d5eb6860c6754f1cd8027d5fac11db2a2e479e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780193174, "uuid": "192ca551-4c9a-4173-a78e-2928fdee663b", "comment": "Malware payload", "value": "161c5e7b4f0cf8dd61e52890396c50a00b0ffdff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780193174, "uuid": "e6c32443-3c10-4a44-9f71-88c6d4189bbd", "comment": "Malware payload", "value": "74e12a808a19f7985424b88215af6535def580aeae989b6120a015a020fb55dbea5de73d56af806bd597596e470c9ef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780193174, "uuid": "3e1b1ad7-a54e-419f-90a6-905cd93ce08f", "value": "T1D308331AA171C21EFD329D705DE666518304F78929FA1E75B2CE065BBFC028F21B853E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780193174, "uuid": "f4e6917b-9f61-44dd-80aa-a29932564609", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780193174, "uuid": "f4965728-9c60-42c6-9e92-4c5c5124a941", "value": "1572864:Tt9IKPC3tYEURWYK0ousWROkDlLlQyi/voBGkWtxJ2V9fe7:TUKqm3RW10ouPO8ZSoPWtx8e7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780193174, "uuid": "fe820619-0c36-4c26-88be-48797e590751", "value": 77849017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780193174, "uuid": "9ab960b7-818f-44c0-a360-49bb17641ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780193174, "uuid": "8b4e43cd-eac4-486f-aa60-c1e39e345868", "value": "Setup_3.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561f75b6-5d07-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780242151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780242151, "uuid": "269b8375-5b30-42b8-a52b-40416b845daa", "comment": "Malware payload", "value": "2a94fb82637eb54643fe1283fc1f2593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780242151, "uuid": "9849204a-1f6a-48ca-a720-de79bbcbc6c7", "comment": "Malware payload", "value": "599aec85de267506b10e284937143d37c09ea0a00d6b8381f46f2e40283e2fca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780242151, "uuid": "1b79c6cd-f9d3-43c7-84c3-887c8a57d77f", "comment": "Malware payload", "value": "f45ef25fef2ee9ba104c8f9aa2ef5136290428a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780242151, "uuid": "811b5470-4456-4feb-bc5d-647a7d45d09b", "comment": "Malware payload", "value": "f4e6004c83640bf45ed2acf3baf45285bf551f543dac081313c85fbd33c14b2008e5164c8521bcfd5fb7531fbc699b2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780242151, "uuid": "97ce2ca2-db32-46ff-9e75-598fd7af7cdb", "value": "T17308336972B8C2AAED74ECBD46415C90762D839E73F2024E144812CD9FB368D489E5FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780242151, "uuid": "a0547ac6-cfbb-4825-a0af-f93f2f7e05dd", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780242151, "uuid": "3cadde5f-c599-4404-99d9-46ce255ebaa5", "value": "1572864:9t9IKPXRU2wRWY7NFcxuGBOhZOsQ3FlkKZm7:9UKPR6RW+GBCZ6Fltm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780242151, "uuid": "3907909e-dcf4-428e-8473-5fcfd3f8e2c2", "value": 77336939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780242151, "uuid": "c04e41f7-b83c-4635-9f19-4822c3b30aae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780242151, "uuid": "d9eaa226-6483-4619-83c4-404dbbf47dd8", "value": "Lumen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f523d7f1-5d2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780258739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258739, "uuid": "c2517165-768c-47d4-89c2-cad116bc984a", "comment": "Malware payload (Mirai)", "value": "c376e1f1fa59fef43f62296aad39a9e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258739, "uuid": "47276473-27c0-40bc-acfc-acbbbd7beba9", "comment": "Malware payload (Mirai)", "value": "5b8bec6136ade2a587afec3a379ad85161572999f1d8015438168d4efac08cc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258739, "uuid": "939d945c-47ce-481e-9048-12580e062e86", "comment": "Malware payload (Mirai)", "value": "74e042b4f2e8bdf46a58eab63c8d907957268605", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258739, "uuid": "a13227a9-f4ce-4355-871c-1af3d4901283", "comment": "Malware payload (Mirai)", "value": "4b54db5d0e703c5cede1628db9412c4424c90903f10b91cfe72923591ef961bd982b4567b7db7e5b2d72d915aa0fb9ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258739, "uuid": "33ba122e-fe3d-42ad-b65a-99b90f2f8018", "value": "T18CC31A1679919B12D1C321BAFA9E514933133FB8E3EE3212DD206F6467878DB0E7B512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258739, "uuid": "e54cb92c-4f36-4e2a-87cf-090d2aa4201e", "value": "3072:JrUu6liJD/F7SypAnBvbXac/AhELWSRgOFzv2:q/loDd2QABvLa2VLWszv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780258739, "uuid": "5f72ac59-0f4a-485d-8904-11ae061f0e82", "value": 125024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780258739, "uuid": "34006715-ed4b-4a5c-a1cb-adcbb61aec8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258739, "uuid": "123955a7-2864-4a56-8f6a-628cfc120a3d", "value": "data.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f345322-5cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780212209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212209, "uuid": "8b55024e-f61f-449a-a4ce-f0c74c640886", "comment": "Malware payload (Mirai)", "value": "ac21d775ec1ebb6771d527f4fd04ca58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212209, "uuid": "e2ee88d4-3937-4cff-86cc-e42093f01a1b", "comment": "Malware payload (Mirai)", "value": "5c4c58252e5e21f5ff6aa88e886244991a2e788f67b3273e369308ce7a623813", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212209, "uuid": "318d026b-d6a4-48d7-8da6-c1864d652274", "comment": "Malware payload (Mirai)", "value": "f0611355c673a1e4fc55700029b6d0fab519878a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212209, "uuid": "1114bfad-102d-4955-b852-8a5745a620ba", "comment": "Malware payload (Mirai)", "value": "9accb68a957e713eb5696eeebd9ccbfc23efb59035d2c890ac81b9712b7146266b65e471db51d4ea22858452fc123ebe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212209, "uuid": "3e8925d4-1e6b-4f16-9496-ed067fb1f43c", "value": "T146635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212209, "uuid": "78f463a9-f65c-415a-8429-9b88948592fd", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGc8z3WyL35IUfA5PGFjfnP9:zGYxpTGASC4XT8yyLpIoYPsP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212209, "uuid": "4f220628-3c7c-463f-98b3-9046f2657c6b", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212209, "uuid": "33281c2c-6213-47e4-a8ab-7a5a59dfa35e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212209, "uuid": "3dbbb04d-9abb-4db4-b42e-2f051b01c974", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2947586-5d4c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780271942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271942, "uuid": "17ff2991-e788-4b4c-928a-435895eb7323", "comment": "Malware payload", "value": "1e1689ccc08e361f291393264e275bd7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271942, "uuid": "bf12b831-6596-4a40-bdf7-55b83af968b2", "comment": "Malware payload", "value": "5c7d47b8379f02568f83cba9a007fee0b18d218c3db3cc9238ede5ff5be9b6a0", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271942, "uuid": "1670937e-1908-443e-90a9-81580885ce02", "comment": "Malware payload", "value": "3b6627754b6298584d351c33cbfa37a6f6173939", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271942, "uuid": "386a41c9-2a21-4baf-b859-caf06ccd2a96", "comment": "Malware payload", "value": "9022f3f416c834bed0af2880eb009dc18ee33ae0eb12bf55060a97b95c8590dd1b2c7dbefadc5921a99dba7179f17437", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271942, "uuid": "91eeefa0-5ff0-44ed-9ca2-0c362e2af872", "value": "T1D1342A6BD25331FCD652C07892266232B732B53D47399EF702E2C3359D21AC0AEB9975", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271942, "uuid": "d3a462d2-32ab-44d2-967b-52db5a277ffc", "value": "8b41a1754e41495e9695410df2f316c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271942, "uuid": "527f3411-8db6-4d80-9bd0-2a531e752890", "value": "3072:oYBWrKIvx11uXZ6xCDtCFf/HeeT2kx68/2SHEKjy/iXekw79iGSC1Tn06K:jWms1hwkPOSHnjy/kK79i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271942, "uuid": "2d39e09b-b14a-41bd-91cc-7a3549929362", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271942, "uuid": "c81c7724-7583-4215-a485-0a8d2ef332d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271942, "uuid": "3c3d0289-5ce3-4b6a-a2a9-598db0081a42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc00cbf-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213307, "uuid": "9a08c6de-9222-4717-b37e-1e34245d8098", "comment": "Malware payload (Mirai)", "value": "03288e1c83984e2d09ff57520e509633", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213307, "uuid": "36a88f81-951f-4d9c-a92b-6b5b90efae3c", "comment": "Malware payload (Mirai)", "value": "5c859eac79d999f994048349b0928b4f58cf1638205fb7d088cc5b035e23d3ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213307, "uuid": "e289d64d-59bf-4302-b8c9-4fe603ccb1d1", "comment": "Malware payload (Mirai)", "value": "a9b69428bc4dcc0353299c256a5eb52eb9b842b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213307, "uuid": "eca2fb64-0790-481a-a403-993d110bbf52", "comment": "Malware payload (Mirai)", "value": "aa60ea8c1869e8adb660abc304863076cdbc4cae8ed3624855312150c4fecc50c881feaf07474dc95910a807f992f61c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213307, "uuid": "541d85d1-38c3-44bf-a76e-6814ec59e04d", "value": "T19F534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213307, "uuid": "5e093b45-1164-4c53-b746-963a3527059d", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/XDiQ5ILiKimfFoktCe3fYRMF:WShU3q7cEDlCK/XDu9i8Fok06fYRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213307, "uuid": "51a815a9-c797-4e97-a283-7c482a1fb658", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213307, "uuid": "7193522d-10bb-4f71-a4b3-a08fa536f131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213307, "uuid": "83664777-78bf-4a3b-914c-db522caeb6b2", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab37154-5d2e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780259097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780259097, "uuid": "68d3e406-c479-4b47-b389-09f41829aa21", "comment": "Malware payload", "value": "9b84eee676bf5ac7034f4db4fc1e1a76", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780259097, "uuid": "6b0b0e1a-6df8-4c55-b285-2a8677920de6", "comment": "Malware payload", "value": "5c96f2a17f175d1a094a647c681a823c245550b12586838c5567d8fc7dfcd2f9", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780259097, "uuid": "3829fa2a-2d5c-4e07-aab3-14ae5d2ef1a3", "comment": "Malware payload", "value": "f97751f5ccbc79c419c3f8cb11b18e1ca8b51044", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780259097, "uuid": "b0d95c76-a6d1-46ac-9a54-36653f321304", "comment": "Malware payload", "value": "de77992dfab7f2008106d70f8985727d3224bf0afbeb554567b0e6d09a4082ae70f5cd36c52761c1e10c1ba83137871f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780259097, "uuid": "09463948-526f-4b3b-8797-a177568bd2b0", "value": "T16E3273016BC4A56C33639B3A2A2730D0F2468CA930418566E039FFF57EE9563D3E6D71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780259097, "uuid": "8fa25207-c53f-4c51-8cd1-32df81feb5ee", "value": "192:dMHI6fMmMnJ7cg+JDwmhPwv6MhNteyf02PmZydrjqNk33HBUTrjYwjfQ/yjFH1:GIGMmMnJ7GhwmSRNQyf02PmZypjSknHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780259097, "uuid": "da29c22e-bc3f-4efa-a907-0e26426f6328", "value": 11971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780259097, "uuid": "c0341854-7d54-4c04-8811-fa134831bfc1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780259097, "uuid": "cb294591-d7d3-424b-9f5a-bd75a5d7bb02", "value": "niooetajrs.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddb81f6-5cf2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233225, "uuid": "9fa8792d-ab36-41e5-9f5f-91a7b529aead", "comment": "Malware payload (Mirai)", "value": "47b3a34cd1c247cb5536c68ccf3fa72d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233225, "uuid": "ff696936-817d-41da-812b-c42a2fd76cd6", "comment": "Malware payload (Mirai)", "value": "5cb1b29bb99b222beb533ee294c11ea00f7d9811c813401da571bbb909e49715", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233225, "uuid": "8af2a7ba-e22a-43fb-9f85-d2e8468ac493", "comment": "Malware payload (Mirai)", "value": "250e9c15a4ffc5c902393bd623786c4c41f8fdcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233225, "uuid": "e5fe997b-0beb-481b-aaac-fa8bb5a0d0a8", "comment": "Malware payload (Mirai)", "value": "373246e08fec60239817d9a3aeac5be23aeb268011ec4b2393f56d8d408fbb58f576462dcb2f21e018ed8c8e8a9f6c5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233225, "uuid": "914ca5f1-45b8-4caf-ae49-47e53aeb442a", "value": "T1D144E70A7BA10FF7D89FDF3702E60A51288DE41727662B367638E978F60A54E15D3C24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233225, "uuid": "e1502218-ae68-4da0-bf63-e8eb52924915", "value": "6144:n1EOLafAVCNzHhCg1ob1uW9NNvotVnkenH44Ad:1E92qzX41uW9NNvotVnkenH44Ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233225, "uuid": "b61830d3-1f27-41fa-8402-2e837d79a230", "value": 275404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233225, "uuid": "2934d1cb-bea1-415d-afd4-0f55221bf3b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233225, "uuid": "38773b96-80f3-4c79-900c-b19761848835", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb6852d-5d2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257388, "uuid": "601e8007-8656-47a3-897a-2caf81e622f7", "comment": "Malware payload (Mirai)", "value": "c8336d28ec114ee85447f414ceb926c4", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257388, "uuid": "b8750f70-5332-4df4-a53b-13dc4c1a7bf3", "comment": "Malware payload (Mirai)", "value": "5da00c2d7d374b14caffa9e79b3a10b2dbbc428337eb79ad46082da02dffb801", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257388, "uuid": "32903f11-602a-486c-a49b-3530baf0e67b", "comment": "Malware payload (Mirai)", "value": "4d1108f6532dfe420266d01e897562677e921447", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257388, "uuid": "3994e5db-ea75-4e1e-8be3-4ee7ac01f251", "comment": "Malware payload (Mirai)", "value": "f2f34b4f423915a2a76acb0a11c23da48b8c626115bba5596f717ebd94ffa01a04bc662c8744feac99e3d3980cc74976", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257388, "uuid": "dab33e47-2533-43dc-b91a-aa16e83c6843", "value": "T1C9157C9DEBC6E4E1F16310F0025ED7F75534A12A9013FAF6FF452A6270327916F1A22A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257388, "uuid": "59b24dde-1681-42be-98db-3b91dda42bea", "value": "12288:zFijdM2+93Z1h3YhBya9ot8FQpWn57FnCd51sZE7wYfA20Pyt/1HOwz2Ih+Lu:zgJMx9J1h3YhEtWQm57FCvKZEHAOBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257388, "uuid": "6382306e-f002-4cb3-9874-d7de5a91ab11", "value": 927160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257388, "uuid": "51c76246-8d5d-4691-930e-cb070b8eef57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257388, "uuid": "8b574990-80b3-4f15-b174-751c29c07b6c", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968fe039-5ccb-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780216489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780216489, "uuid": "7af65928-a84a-4f84-ac85-118f303d1695", "comment": "Malware payload (SalatStealer)", "value": "057088cdbf9f9adc15fc02fda9108eab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780216489, "uuid": "81635232-1647-465a-b842-7e9850bb5b44", "comment": "Malware payload (SalatStealer)", "value": "5dae90bc1fc0a01203f006992409a94bd61f843607406eafe36a9889ca0a4c50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780216489, "uuid": "89925e31-f10e-4657-88a5-6eeb7d10fd3c", "comment": "Malware payload (SalatStealer)", "value": "7b99f00f5d32ecc0260d5696ed7b893496a4a78b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780216489, "uuid": "6d0197cf-2afe-421f-9668-a016c88b6267", "comment": "Malware payload (SalatStealer)", "value": "09a6bf00f2ab9418b18fa502147185534c94f20cb5963ac75a74039e7e0275939deb782a48560849b25f9118de92b99b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780216489, "uuid": "f8a59463-f292-415c-85d3-ddc2fdc76a03", "value": "T1E6F6337936C598E9EDD7F97996628412E7713C5A0B90C9BB03C493506E332F42F39329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780216489, "uuid": "60f6aeda-3e7d-4bde-819e-0783f2962247", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780216489, "uuid": "1b78fc19-68c7-4121-9224-dd241819b4d3", "value": "393216:5Ehtz6FVrTjUPc02mfCS+anu3hHTodRGkX844RAN:5YzgmPc4aS+VR0LhX6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780216489, "uuid": "e9569e66-0ef5-480a-9484-e8f811694140", "value": 15382421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780216489, "uuid": "f78fc4bb-ccfd-4564-b650-85c074d0cfb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780216489, "uuid": "55ae7336-8c0e-4b7d-9236-f50bdfba8e30", "value": "robloxproxy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e1e8ac-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "e4e42c8f-4bae-4a4d-8acd-57f4622ba4f9", "comment": "Malware payload (Mirai)", "value": "640bf03978b8a1a4cf10cf1fed4370a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "0bbebb51-1199-4017-87c5-fbd2e811a6a6", "comment": "Malware payload (Mirai)", "value": "5e0d1c3a14966e753c96f7c564e0603fcb9d07a8713835342d6def2c68022b2c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "f90a84b9-339b-4f58-9f04-e30a0c7dc903", "comment": "Malware payload (Mirai)", "value": "f3f4abc3217566e07051e19b5b3a89509cf89b58", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "ff6dc9dc-92d1-4830-bf43-953fd48f721f", "comment": "Malware payload (Mirai)", "value": "71f58362b52222ffdc24d673d17bce081581507389078bc5a472f7f69aa9b41f3ce469b990d26861a576fcaab5b355f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "94adcca8-601b-4d8c-a3e1-deb09db78150", "value": "T16C93D70A3E618FADF76E823147B74E25939833D627E1D681D25CD6005FB438D642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "a90fa45c-e0d8-48e4-817a-dbda136cdce4", "value": "1536:q+P8koWPYrdJEkfKfQSqisIOdTOdgHdNhU6nPzDEmWew3yJc:q+5ArdZf9Sqxq6nPzImWyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213643, "uuid": "f1e5dd4c-fdd7-4c7a-8c48-7c9668e776e7", "value": 89024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213643, "uuid": "aad9b7e4-6df3-4489-931c-0b94ed00dbe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "0a4db6c4-3022-44e5-bcfc-63524404ec76", "value": "kmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a921da5-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213302, "uuid": "f8fbac9e-0cb7-42a1-9411-06063964f39e", "comment": "Malware payload (Mirai)", "value": "2e0a0e01698e9ac2ec92b7dc0ae3bf46", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213302, "uuid": "313b8234-69e9-4c13-8ac9-4eba57ee4232", "comment": "Malware payload (Mirai)", "value": "5f3556d201555c7256faeb777212610a6ab0e2cfde097ffb140a3f3a19f61c57", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213302, "uuid": "3e097801-6ddd-4ea3-9c73-6578da8645b2", "comment": "Malware payload (Mirai)", "value": "e47465ada5ee55d79becbfad2d06c1a5b937693c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213302, "uuid": "6209539a-0820-4a4e-9e95-8082b429faf7", "comment": "Malware payload (Mirai)", "value": "81baabb52c64dafb5838b3efdfdb2dcb3bfefd7e11c938e6bf3189035e2ece4fbc35390df9018691c1cea83e701a3138", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213302, "uuid": "b977556a-4dc6-42fe-bf1f-d3ea8b735379", "value": "T128632BDAF801DD7DF81BD77A4453090AB630B3D542831B3B63A7B9A7BC721A81D12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213302, "uuid": "3b875e7c-1b6a-42b6-9a95-a93a89cd6a9f", "value": "1536:fAgVFBxENsgDYrly8VhyCO1sxyWbxdJiLU11i+VQOa:fAQFBON9ErlWCO1GySx/o+V3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213302, "uuid": "9950ca12-38de-4b6b-8833-ef0dc3f533bc", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213302, "uuid": "f17a153d-4cf8-4ba4-8724-699549aded1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213302, "uuid": "f6fd9321-4499-4ed5-a6f1-7f26e8b7d9aa", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0a6e21-5cd7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780221624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221624, "uuid": "e6d7e5a7-ba75-4e7e-94dd-a7f5be1e1bcc", "comment": "Malware payload (Mirai)", "value": "65cbe1832bd78eb7c2bc7911d74b5c27", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221624, "uuid": "ab5ea05a-0f57-43c3-9bd8-819e47e06f54", "comment": "Malware payload (Mirai)", "value": "5fa12001b03df806c56354c810ef702e88b17df63d4729ae172b26b5f7f0bca4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221624, "uuid": "07813944-dc72-47a6-a944-310f7f0a1f99", "comment": "Malware payload (Mirai)", "value": "7b018aa7f4eb55a1c288f270b4bd01c848cafc9e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221624, "uuid": "29d09962-f870-4ea2-92a3-9c572cbccb73", "comment": "Malware payload (Mirai)", "value": "d25c81c318b64b76ff9b30e12e868c102ea3bfe514e10aa6939deb40ad125d14c963d55039d83b680843a2c6f9df8cf5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221624, "uuid": "269a2db7-8824-4710-b5f4-f5af35618060", "value": "T1D3D3865E6E328F6EF678873047F74A24976D23D623E1D684E2ACC1141F6038E545FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221624, "uuid": "8e384904-bfef-4131-8e50-8adf855dc7d4", "value": "1536:p+5TcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4Vxsd:pWlybKpzEOfGQ+vEubTt4ouftL44d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780221624, "uuid": "bb803d5b-de6e-42a2-915d-37e11508d4a8", "value": 137664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780221624, "uuid": "93c2c725-fd58-483d-99b8-62239fed0990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221624, "uuid": "87cb0d25-4ae4-42fb-bd24-6653865f715b", "value": "5fa12001b03df806c56354c810ef702e88b17df63d4729ae172b26b5f7f0bca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218238c7-5d25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780254948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254948, "uuid": "1011229d-3cbc-4d31-b779-de4cde27883a", "comment": "Malware payload (Mirai)", "value": "830c4b2a3a1b4202277949b22f2e0434", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254948, "uuid": "fb250e8a-2246-4cac-baf0-915207368192", "comment": "Malware payload (Mirai)", "value": "5ffbd02bfe72f9ce7db7fc2699a76065ff984c038d781ebc7e798975f775d5be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254948, "uuid": "1fcc3314-ae23-4257-b762-560e9bdb439e", "comment": "Malware payload (Mirai)", "value": "39e3952a57bdc5cc862382ad31135bdb73d7754f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254948, "uuid": "c6ab13f2-483e-4640-8ee0-1f96a3aa1cda", "comment": "Malware payload (Mirai)", "value": "013bbb1fa42aa99a2527c8fbdd510abcc6aa3530934a1bbc4964c2b7602051703f2afcffff55cec75904ad379f417089", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254948, "uuid": "1b571efe-4105-4dc8-a262-bd8b0576e5af", "value": "T1C4C36CC5E783E0F2E95606B1503BA7365632E93A442ADE86DBB87C32DC62511D71B32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254948, "uuid": "fe98aad2-b9c0-404b-bb70-ddd9560a9977", "value": "3072:4219EGgm+6CtZq0nQ+5gJhj3tuWpXTw6BqV+:4219EGgmGspZj3tDt06BqV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780254948, "uuid": "46a9ec07-f653-421b-b300-bcbb843b8600", "value": 125448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780254948, "uuid": "6525937d-8938-4a75-a903-999b79b92320", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254948, "uuid": "1f65511a-bf21-4a31-8c03-ae4634f1ba66", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896a05eb-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1780213461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "a2e87a20-5335-49d0-9d77-a2adaa053851", "comment": "Malware payload (DDoSAgent)", "value": "4695033a6f872a6e2c16cacd1806d436", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "641d93e9-46df-4bb6-82f7-3afd8ec675b7", "comment": "Malware payload (DDoSAgent)", "value": "61f7f7cf8b272353b6f50a736f977dd9be1a7bbb2d2237124d06d515197359bc", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "f40f9576-8c8c-4067-b652-4edd06435f14", "comment": "Malware payload (DDoSAgent)", "value": "566248c484eb9cfdba12f52f30ad5802592003ba", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "d2753135-928e-4f6f-b8ba-b4aae9705a81", "comment": "Malware payload (DDoSAgent)", "value": "7676f5b59a17bc33f3b9dc113bd308029aa78edb3a0ecf73617e0dbd6cfdfe33e3c579ad657ebdac034886a35f322c95", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "6c00c4de-60fe-448e-8a40-4f1a9c4ab6cf", "value": "T1D7863A137A69DB0FC61821301CB2DA9427691C9582DB961BB355F319FAF20BE496FCF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "eee1dd92-bff1-451a-bcaf-f760adc50767", "value": "49152:rLLH4Nhp0hScB559Dg0iyxTU/zlhOdZRBtVU9Jft1p//gsjHSa2mI8QSxIZ6WvRh:LvxjYv2iQHh9SAnUjEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213461, "uuid": "d4bd805c-0cc9-485f-981c-83cbbc2646dc", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213461, "uuid": "d2777afc-41dc-43fd-9e39-e79f90e1a6ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "9a89eb9a-cd3a-44c6-81b1-54454eac126d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5669846-5d2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257746, "uuid": "188679cc-8fe2-4590-adc8-cdd841d2cc7f", "comment": "Malware payload (Mirai)", "value": "fe55ac3c2d59bc58140490469088474d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257746, "uuid": "60094a38-bd50-41f7-b79e-0b9ad91650d8", "comment": "Malware payload (Mirai)", "value": "6509c79702631b1c4742475b512aefc93c506e0703b9c6ffe2fba3ef08a15661", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257746, "uuid": "6e1f613d-6f3d-4414-aeaa-7f24db218cdc", "comment": "Malware payload (Mirai)", "value": "8f15943ce4bd39f8ac6cfa6075930d527d838ce6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257746, "uuid": "93f293fd-caf7-4ab9-a274-b77a54ae81c3", "comment": "Malware payload (Mirai)", "value": "1e434842f5ec415cd37ab44c004abe24eb019925b40f55f3552bd1a52e5e9e06cdaadd54c7051d087c33c446e7078a96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257746, "uuid": "773e47ea-c746-43aa-b9e9-95f84ffb1f7a", "value": "T120E30845FC558B12CAC266BBFF4E428D772B1768D3EE72039D256F24378A85A0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257746, "uuid": "39a64997-ea73-4b53-a048-69ef106a9ba3", "value": "3072:w5NRO33Ghj01YWoTVo/iCUS/7NvHGhQ0ocmwfUualY4QVH1TyNyX+Vz:wNRO33Ghj01YWoTufolocmwcualYLVAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257746, "uuid": "be0c7db5-7961-4dfc-9202-b1144d10f18a", "value": 156280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257746, "uuid": "0dbb1ba3-1559-4a79-a897-c290ffffbf4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257746, "uuid": "2283cc7b-a373-49c0-95bb-e319d1225290", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba262fc-5d1a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250187, "uuid": "eee79fc1-8946-4dad-8b2d-934582005d47", "comment": "Malware payload (Mirai)", "value": "9f56be10578a9ce1edcc8df87408d2b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250187, "uuid": "95301fed-6513-40fb-bc15-43bf16d03a78", "comment": "Malware payload (Mirai)", "value": "66f57f5d3b01b3073e441dd123c0a7d1aaaae6ffeb1434a5f068a4cf23ab4abf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250187, "uuid": "baa13cc3-6569-404d-a6da-0a9906e45eff", "comment": "Malware payload (Mirai)", "value": "1a3f78d129572d52a61fed50f8762c4091a07f40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250187, "uuid": "2d209391-0678-44ae-bb00-1735b08ed129", "comment": "Malware payload (Mirai)", "value": "0eebf8e67b746f4eceef269dbe41c3745f9ea1eec61e52e9c721b67234428e458ba67b71cc92a6f8c0c0c9dd3059ee68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250187, "uuid": "1520aad0-d4d0-466e-ad45-9b3a50afb780", "value": "T125936BC5F183E9F5DC0705753132FB378AB2E1FE212CDA43D3B99A23A891652D405A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250187, "uuid": "cff24b34-3510-4de3-82ce-e302acfce946", "value": "1536:Bfw1E2o1fSKlk7HwDAbBWlBpJiqt1SI4QgM/g9UH0ajiXr8ZQ/:VwKfSKlk7HwDAbB0piqXb4ZM/cUUYpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250187, "uuid": "b2a58f37-2962-42bf-a68a-4f59981c79ba", "value": 91216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250187, "uuid": "ac520d34-344a-4f2f-bfe8-adb9cb9f39e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250187, "uuid": "d3e5b189-de4c-4f84-a273-e54cd0f47656", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7271965-5cf6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780235066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235066, "uuid": "e8b01d54-2d38-44d9-b0ad-7db710b60f61", "comment": "Malware payload (Mirai)", "value": "c4738952551017912cb9dde2a394a907", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235066, "uuid": "a6e68a9d-77c2-4397-8012-50149e72d131", "comment": "Malware payload (Mirai)", "value": "677aa8a1673cb3af445eab416bfe4d0ca563cdfe09fb1b0f2216bd94f86f99dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235066, "uuid": "2131ef6a-9711-44ba-a3b0-1abefd940221", "comment": "Malware payload (Mirai)", "value": "3eee77e3075fa717ce7e6f922bc09259b3eec2df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235066, "uuid": "9981ef76-db19-43a5-bad3-fd0bc662f7e6", "comment": "Malware payload (Mirai)", "value": "d872ccb9700cbe05e37253d37d8a657ec8a8990cd57ba2c5f4fa829624fbfb60a0e74406dd9a56ac8b729832555fce52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235066, "uuid": "b258499a-6297-45e2-900c-b0b75b9d0492", "value": "T119D35C85FC918A12C6D512B7FB2E228D331653A8D2EE3103DD246F2537CA59F1E7B681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235066, "uuid": "ed274e17-bbc4-43c7-bcf7-f9541beb887e", "value": "3072:vFffxBVamre1d2r3wzUfkALyOaTx4O/14:dfZBV/rAYr3cAWOaF/N4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780235066, "uuid": "88ad2653-5934-4783-8744-4b3244d00eaa", "value": 136672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780235066, "uuid": "26501dc3-1f20-4ad5-a020-b94c6894adbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235066, "uuid": "cfad9442-ddcc-40d3-ae0e-c69d9134e329", "value": "023782pler.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cc192b-5cd3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780219837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219837, "uuid": "2aa4b0e7-be22-427e-b002-a4d3bdf03f30", "comment": "Malware payload (Mirai)", "value": "82656965eac0fad47b54c959cea9dbd5", "object_relation": "md5", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "meow", "colour": "#91FC16", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219837, "uuid": "6eeae95c-18b6-4707-b019-b79b7b8560c9", "comment": "Malware payload (Mirai)", "value": "678aaed50cc6993016653b501585bc4073a60c36c3301a1a45c5fa6c39cdceb3", "object_relation": "sha256", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "meow", "colour": "#91FC16", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219837, "uuid": "5809d9fa-3a34-47ae-b6ba-5395a08bcb14", "comment": "Malware payload (Mirai)", "value": "11a8ac6a0013289d378354e9d6d99dc0695ea2c2", "object_relation": "sha1", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "meow", "colour": "#91FC16", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219837, "uuid": "35d6b2e0-ec60-4425-addb-423a85a37597", "comment": "Malware payload (Mirai)", "value": "9b4a518441e90ae902ccc6ae211e1410e77bb61d39676a5453177fb853b6bd55d0f33e34030613f87f07fc0913bbb4f9", "object_relation": "sha3-384", "Tag": [ { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "meow", "colour": "#91FC16", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219837, "uuid": "0aa8682f-112c-496e-a5e7-d4ae709149b4", "value": "T1CC566A46FC1E7463D6C975712F6602943639AC099F81D7232618FF3DBAF27A88B13261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219837, "uuid": "82719e02-68ef-44e7-9bde-35e9e0a81e9c", "value": "49152:At+hkfUW3bW1TXtqJn4IExVvB4eNTxHzR+CEetNcD5ET:At+GfD3WTY4IErJRPE+NaET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780219837, "uuid": "559ad5fd-240d-4adc-9546-da483d8fef52", "value": 6291618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780219837, "uuid": "74934645-2229-4f22-8c58-17aede3df145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219837, "uuid": "80cc6b7e-be7f-401a-a700-3188cfee687e", "value": "mb_upload_678aaed50cc6993016653b501585bc4073a60c36c3301a1a45c5fa6c39cdceb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a2d1e2-5cc5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780214074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214074, "uuid": "b4047efa-4e32-4fa5-997f-19f59296c17e", "comment": "Malware payload", "value": "22b84cd70f918bbdcf7435143cd6b23f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214074, "uuid": "77d65630-3f74-4f6f-ae0f-73f2596ac70b", "comment": "Malware payload", "value": "67c683e6df5f4cf5cceb78cdda632126f8622feba774d76627a0ba982c22e972", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214074, "uuid": "aee15652-deb0-4737-8333-ce8afd641792", "comment": "Malware payload", "value": "aadc8587a69386bbf2fac1fd5d9ac9407e63be09", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214074, "uuid": "569b6777-4d81-425e-9966-32447f56d1fe", "comment": "Malware payload", "value": "9bfe9f7d9349cef0b6984319ed72fc4349e662b3d2fce000a5956c1b5d4ecc479ec392512ad74595506cede2a4a20c58", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214074, "uuid": "be5fef96-3ba1-49b3-9539-fab97e87aef6", "value": "T1CFA623EE6180374CD01EC4319533FD49E2B6952D1EEA99FEB2D7AAE0379E4409A05F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214074, "uuid": "4272c760-0eea-40e4-8c1b-895ac7be6849", "value": "8ba0e9f582f3097db0084c05b85f2e31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214074, "uuid": "7c159237-8934-46fe-a13f-d38d064317af", "value": "196608:BY0c8uhWPCDwg+SXQttqD+Nv+EMLonqzFyvINipOq9s1YoMcYvO:BY0aWPPSlD+0EMLonqz0vINUfs1K2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214074, "uuid": "f6cb2ae9-51fb-4cda-a15f-64d5565d4901", "value": 10351104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214074, "uuid": "982badb2-3db6-4ddd-abf0-8e7f8ccbeb0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214074, "uuid": "a58292fc-58b5-4cab-a544-df8d2c29aef4", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454f5e1f-5cf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780234392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234392, "uuid": "0712781b-6862-42f9-91f4-9ba1322db6bb", "comment": "Malware payload (Mirai)", "value": "8ea0b4f55fdc00767c8ac539d46a8d2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234392, "uuid": "0cc637fb-72ec-4cbe-b8b8-1b6ed4238bec", "comment": "Malware payload (Mirai)", "value": "6825f3cdb543f4a267dccd472d5f78d0b158d32067ce0d988eba073978f2b80d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234392, "uuid": "2b3be4a7-00c8-488a-9ac2-9a33943df636", "comment": "Malware payload (Mirai)", "value": "92ef0fea97ccef3cc6a722024d831ea58637abf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234392, "uuid": "e41ab538-2320-4fbf-b1f8-cc3760fb1c83", "comment": "Malware payload (Mirai)", "value": "6650d810740183e7b16909bd34900d80d4127deb4b04ed9ceb330868caa7667390604562209427f4091da4bf94340a95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234392, "uuid": "8174551a-08a3-4084-9bb7-e618fc91ba4e", "value": "T1B443F26175CC4AB0C364B476FB3C66D32224467852D161968F8A04DAA3E7CEB19FED83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234392, "uuid": "c1b6ec29-e210-4961-b147-43a9c3858b9d", "value": "1536:Cdn8QVVWeOQb03lO1BqX/6Bfby++SBdfs0g/E+Zz2:sPV9OE03E1BqvAZbB1kcgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780234392, "uuid": "53929166-ad14-40a4-ae4f-a13ef96e0813", "value": 55756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780234392, "uuid": "f67455b0-8e83-4d50-9344-bca20e8363c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234392, "uuid": "7d0c7dbf-4673-4925-96f8-4d1e587230fe", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b75d813-5cfd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780237785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237785, "uuid": "d2073996-f211-4988-b41e-1dbb2a494996", "comment": "Malware payload (Mirai)", "value": "826bbf67ad65458307a4d5d126df9488", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237785, "uuid": "539cd345-2174-463f-9315-a4007e3de9f4", "comment": "Malware payload (Mirai)", "value": "68f47c0b2014b9ceb4d4b7d8133b822bff244f178b8ad4028d977b8f6e21f562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237785, "uuid": "3cf09a59-9fcb-4837-b856-e51f2a3b7f83", "comment": "Malware payload (Mirai)", "value": "2316de0dd0ae116976d9b0c94a6c56bccf4665cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237785, "uuid": "de974c80-33fb-49a5-900f-2712d4c0649c", "comment": "Malware payload (Mirai)", "value": "d128ab55ec9e934fa24852ccea1471f79e511d238f466f58d3d9772f0c2c1d42590ca47c3b1c3f90e0f154dba7f65670", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237785, "uuid": "342348ba-d60e-4842-a8ef-70cbcf2a7c7b", "value": "T127C36AC1F783D0F5ED150AB530B7BB368972D53E112BDA82D7B8AC31A9119C1982B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237785, "uuid": "5801a387-9e7d-4e96-81dc-473cae926e44", "value": "3072:BKIeKCGNl3BuzAiS4xGJZdP6VZktf2+KZRkCXlW:BKO38bxGrdP6V0BUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780237785, "uuid": "a217cc9f-693d-4e64-b843-cccfd1b24186", "value": 120276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780237785, "uuid": "e0b094d1-7b5c-4f9d-b2c0-0a2c642653a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237785, "uuid": "93503eff-9b25-4362-81f5-6590e1bc7244", "value": "023782pler.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34609670-5cb6-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780207305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780207305, "uuid": "343390d4-ee14-4123-872a-9c1ceb600fd8", "comment": "Malware payload (ConnectWise)", "value": "c7f3af6d3919c8a3b0c67682fc4713a2", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780207305, "uuid": "15445ebe-32a3-45ab-b19c-d3a71fa8a217", "comment": "Malware payload (ConnectWise)", "value": "693a1be37f3acdda498b7cb6efd21a90486607fe098a9f492ec16b487e4b81d4", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780207305, "uuid": "d27d3db8-d922-4d4b-ab4a-723d9bdd513f", "comment": "Malware payload (ConnectWise)", "value": "66d8171006b85899cd01d5939fd31479b03f2b8b", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780207305, "uuid": "dabd8633-bc32-4d0d-9905-f26f3eea99b5", "comment": "Malware payload (ConnectWise)", "value": "00f7e707719246ac5ad6ee28f68e2a638d2e3525b93c10fa79e5bc3ca1edcaf2a966e4c028da0df2a132d6371786c31c", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780207305, "uuid": "f9c9ee41-9b7e-449a-809d-1da93e6c9639", "value": "T12CD623116BF89278F0F22A39E876A0B1A5377D515E22D12E2324791E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780207305, "uuid": "789a919b-778f-421c-8c51-1218b5b6868c", "value": "196608:gHxcp9ym3nltDUJVgHxcp9ym3iHxcp9ym37Hxcp9ym3dHxcp9ym3sHxcp9ym3NHP:OGplpLGpwGpFGpPGpKGp/Gp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780207305, "uuid": "f0cff1fc-3d80-448e-973b-38d391801969", "value": 13414400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780207305, "uuid": "f9f605ca-06ea-43ce-8ac6-f3a30d509090", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780207305, "uuid": "602f135a-9720-4d93-81f0-6ce4024bd42a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231f1309-5cd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780219732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219732, "uuid": "1ff36437-91e6-4e79-9b38-f1fd13e92f5d", "comment": "Malware payload", "value": "1931b7b0dc0d2f557ad2cce9da4f0218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219732, "uuid": "8672a181-2236-43a1-aa2e-05ced0482f0c", "comment": "Malware payload", "value": "69a30c074419a9de75830a6c33507cc5fe314530cd2e541c4273b0afa799379b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219732, "uuid": "17b7d723-f633-4dcb-9a32-63444f1f644d", "comment": "Malware payload", "value": "d67f56663bb4d60a237cb25dfa121bb314635008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219732, "uuid": "ae3593b2-104e-4210-80df-672595e3ba0d", "comment": "Malware payload", "value": "e92dc3f923b8ce79e3e2754c12ae1412e368c6dfbca47b1415b1ffc3e2f168dac4a7f6d0a20d28a1dc5d8e6e157ae8ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219732, "uuid": "67ecb973-51c6-46a2-95ed-c2b3b23475b7", "value": "T1AA42E706E3FCC722E5FF0F7C59B7122227B57627A925D31B28A920CD7A523044961B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219732, "uuid": "4458f88f-302f-47e5-8a2a-16edf1d4f85b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219732, "uuid": "2e421661-639c-4fc6-a0e8-43a5475c0fd7", "value": "192:6KaaghJqZNaX5VHU19M5KwqXm9zhmeQesyntIwd:m+W701KIW9/rH9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780219732, "uuid": "e3330fc0-325f-4008-9372-cf21a4d89221", "value": 12160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780219732, "uuid": "2ae6e49d-b6dc-4bd2-b37f-26ff78723db8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219732, "uuid": "28b5d044-5099-4397-be3f-a464bbbe6e16", "value": "SecuriteInfo.com.Variant.MSILHeracles.259143.35144959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d39b24-5cfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780237022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237022, "uuid": "1d1f59a0-5a28-44a2-b60d-489499af8609", "comment": "Malware payload", "value": "f37c803bf281b56e6c09eac98351014c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237022, "uuid": "47d7935d-30e8-4049-95fd-cb3a8a7977c8", "comment": "Malware payload", "value": "6aa904125beb01924243b0dd04e0988b16b8bccd5479224f8bbcd762814b303e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237022, "uuid": "b220b289-a887-4a2b-9cde-11bc1efc1744", "comment": "Malware payload", "value": "c26be9054193291094c7bca0fa40db79eb54e49e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237022, "uuid": "7fedeca0-bfef-4975-80a5-21a08b95dd28", "comment": "Malware payload", "value": "66a6580af323a10ac975bbab4029c4087a86a9faf967af593ebe3b263b712b0f92bdf971955b8eba3f7f27326ad1f69e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237022, "uuid": "07a1c178-5ff4-4af5-a83d-77bb508d209d", "value": "T1BFF317C7F900D9F6F809E3374853080AB130BBA254925A776217357FED3E199187BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237022, "uuid": "9337acee-907c-4135-be87-b4252263cc3d", "value": "3072:hZWV3C9+A7iFoxLynigz8g8P5VhInQGzqeioVEjbiALjv8tx+FOb:hZoTlF0ynfz8g8RVdJeiVLQ6Ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780237022, "uuid": "35c601db-4bb7-46f7-91b8-050bc5180eef", "value": 162424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780237022, "uuid": "840b0851-73a5-4d0e-b9eb-2eb4e32cfa62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237022, "uuid": "8de658c1-473c-4d7d-a7b9-c46d57ff291e", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f628e892-5cf8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780235977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235977, "uuid": "6bd17099-2f5d-4cfb-ab7f-ca3bfc454671", "comment": "Malware payload (Mirai)", "value": "7fd4bf19ab3322081fbec217d88d5c44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235977, "uuid": "782a50c9-a62b-4d13-9e06-5d118c4ef83f", "comment": "Malware payload (Mirai)", "value": "6ac584425e8aa6baa78f38202e473b054db569b0b1d099b79b1ae8a0c0e69e51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235977, "uuid": "0414c7b9-05ad-4e76-9e94-4c0fe048779e", "comment": "Malware payload (Mirai)", "value": "3f7ccaf37277d7cb7b73cbe0edd26deef12a5a11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235977, "uuid": "e5ba6160-e1dc-408b-bee4-bb12b3141dc1", "comment": "Malware payload (Mirai)", "value": "88b4d007527fad1339c65e2854caf45fb48932e23804099e64f7912f9a92a51ce917b9f7f413f5d34bfdcf3306bc29f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235977, "uuid": "ac491498-a679-4850-bd5c-702e611851a4", "value": "T1C7F31946B8819F16D5D112BAFE1E128E33231B78D2DE72029D246F34778B87B0E3B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235977, "uuid": "81c68b5f-60b6-4d2d-91bc-1b459a429f0a", "value": "3072:fjtG3rMHmbQQPpObXvOaBwVaobnwnz99vFjp:c3ruwgXvOaWMobKvFjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780235977, "uuid": "d7a27705-c373-47ea-b6e6-b5364b1be0b9", "value": 162256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780235977, "uuid": "8c3ee599-4c1e-4a37-8aa1-51e13d24a156", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235977, "uuid": "e47be85a-3228-4935-badb-520c56344c50", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c09f1d4-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213304, "uuid": "b8e527a2-d087-4e3c-9a60-78933ba745b5", "comment": "Malware payload (Mirai)", "value": "cb26b626cae3c05c6e37a77d2088e8f4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213304, "uuid": "a1e918ea-cdd7-4718-826d-c70e5f22153d", "comment": "Malware payload (Mirai)", "value": "6b4a66b010f8224aba8a8e9a506b8fb16a68d0e7e6cb86e9b72dd36995b57340", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213304, "uuid": "78921db3-92e5-4714-9b25-d99e1ed918c5", "comment": "Malware payload (Mirai)", "value": "2775bc50c33afceb900823ba5b4bf8b3b4e1ddf8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213304, "uuid": "bbfdd4e3-1639-4584-a69f-e2b919e3c62b", "comment": "Malware payload (Mirai)", "value": "c539a6f23a97dcb67b9e63be6f2e9e219f23ed0e4ff9cb7383e4b9102c0bfe014fa2130b1c5e029f249cd51af80cf00e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213304, "uuid": "a5a2edd9-dd38-44e9-a9ab-8a3b3b6c273b", "value": "T1EAE32B56EA408B13C0D61779B6DF42453323ABA493DB73069928BFB43F8279F4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213304, "uuid": "5ff79f00-ec2a-450c-af58-8d26986ee591", "value": "3072:iJLceVpEpBBc0aAHbz4Nb4JJXpIe1FRUXMknM/9cwAY:iJLcB20aAHbz4NsJJfHRUXMEM/9XAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213304, "uuid": "00dd7707-a739-4525-a0c2-6ac62415df46", "value": 150610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213304, "uuid": "dd172258-3371-408b-8ed9-9832a15fc059", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213304, "uuid": "b7884c39-7d7a-4c68-94d8-caebd87122c6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9d13a5-5d29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256976, "uuid": "b5325edf-e4c3-4981-89ff-0c6ab66fc4cc", "comment": "Malware payload (Mirai)", "value": "07bd59888128a0d09354822879eef318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256976, "uuid": "cec75306-52d9-4fef-8c3e-ad8e2827ee7f", "comment": "Malware payload (Mirai)", "value": "6d76dd44f6fe630af75af9103d173c62f59239bf8b668d5d7e5144b2d986e120", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256976, "uuid": "f0cff239-8cda-4307-8ddf-c6a5265d7df0", "comment": "Malware payload (Mirai)", "value": "1cb5b32d8199570d09fd8a8039199253ee8db563", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256976, "uuid": "554be05d-ea48-4fa5-9a46-7d5f8d727f16", "comment": "Malware payload (Mirai)", "value": "fa869603187639ad5e882f29f8af1befd7567eefc633b17de602a6bf5ab31657a0be21df8c988583454ac3162fd9b632", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256976, "uuid": "dc47e842-8385-4d4f-8e74-e824d7b3c950", "value": "T15A142B03E6519B12D0C251BAFF6E454937236FBDD3EA3102DC24AF64778A8EB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256976, "uuid": "b93a8964-9db0-494a-97c4-9fd6e1bf4b56", "value": "3072:jvD4IzTgFDYYYAuYkXQod94qwMya7fFj5w4/20WUG6mFhvPhUGLz:jMIzUJzYXQfqwTajFjyM2NUG6WPhfLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256976, "uuid": "983eb9e5-c748-43d6-a135-3c48759f7df5", "value": 196720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256976, "uuid": "308f44b4-9cb4-48f0-b128-cfd2b97ceb64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256976, "uuid": "9d392768-7691-4248-9514-5b5771c46c97", "value": "wife.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2531cca-5d0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780245393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245393, "uuid": "dcaf9015-9ca7-48b8-b827-ccff9e128911", "comment": "Malware payload", "value": "01813f1980a28cc9127d33787f398f02", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245393, "uuid": "dc979a18-6399-464a-841e-32ddcb1e8e8e", "comment": "Malware payload", "value": "6dc376c535829409dc2a6f0548504f8d0f07dd4bb17750fb057975965958fa85", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245393, "uuid": "25f1f885-69a5-4847-af73-12796785dec9", "comment": "Malware payload", "value": "6d9622afd4d84a803a47297c87c5489259b70bf7", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245393, "uuid": "adc1b82d-2091-473c-9fe0-4b6f367edadc", "comment": "Malware payload", "value": "0eee3a1174810fd968f0dca3a250eaf69903aedbfe4cb8f5f0e6358a0116bf4612956dcde22f9215ad2bb2cfdd0ef427", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245393, "uuid": "e1e3c70a-2012-4864-ba2a-6875621ce9ef", "value": "T189F7331869BCC1DBD025DCF518F59D23620AF3763EB41A4BA51F829CB1C284670AE67F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245393, "uuid": "e866f079-ec81-4d97-ad1e-b1abaac0b1d3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245393, "uuid": "f2aa3087-5952-4c29-b934-f428496a7531", "value": "1572864:gt9IKPzbRyRWYCoFPSv4i0hVpDrl1H7EC4TWgwWS7:gUKX8RWnoFagi0hVn4TWgwWS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780245393, "uuid": "8ab932fb-c86e-46c0-8793-48fc29cde20c", "value": 75701430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780245393, "uuid": "ef847751-170f-40ea-88b8-be0fa37b5fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245393, "uuid": "9da908d9-3df0-4233-9f01-69fa1ed9478a", "value": "rbxfpsunlocker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105adb20-5cc9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780215405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215405, "uuid": "33713622-6dae-4e9c-9642-08606d95e20c", "comment": "Malware payload (Mirai)", "value": "4535bcf94540feb0ea5f21b08dbb21b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215405, "uuid": "3d23964e-8793-4ba3-a866-dd1456fff646", "comment": "Malware payload (Mirai)", "value": "6e10f499dec64730eed910b7cb56c08421c8569f2948ed792957fd7fb21377cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215405, "uuid": "766fb291-ea88-4860-ae9e-029f3163b1f2", "comment": "Malware payload (Mirai)", "value": "8d41b03f5eac1fe6a95768a825c7c3f541aacd2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215405, "uuid": "1de70623-120d-4455-bf9b-5952b6806df5", "comment": "Malware payload (Mirai)", "value": "2c3e7a671e4fb2fd385e025709a9179d97c9adca5c67fc190a3875de4964750da1a34a780b4b7187c044f93892efa898", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215405, "uuid": "a0eee89f-e794-4faf-b9c1-8d93eb6ea61e", "value": "T1B4C36C85E753D4F6D8530B7401A7E7394671FC22131ACE27E76CFFB29E22682B246618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215405, "uuid": "d0d7528f-c8af-4561-a87f-b2a661b0a8a9", "value": "1536:CD64fcX8O2UMDWwMYR9l47GWS8Axgwkop1fIoUL31QutM2G/rnHebWnJ4StcA2:C24a2TW77GVEDIGuJXz+bMJ4StI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780215405, "uuid": "c726ed17-2449-4bde-a4e1-d0bd4f78bc62", "value": 122093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780215405, "uuid": "13a151a8-1895-4c6e-8237-76b50f26a412", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215405, "uuid": "9cbab01a-8e19-493b-b04c-e7fe97ceec00", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d639e117-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780271142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271142, "uuid": "7cba6bcd-8bc5-411c-ab12-7aee0259ad44", "comment": "Malware payload (Gafgyt)", "value": "672b42e7fb085e8cc180674f7f7d144f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271142, "uuid": "eb90ad65-401c-4292-ac0a-168b978642b2", "comment": "Malware payload (Gafgyt)", "value": "6edad75390dd3c0b9607471fded07ca333470e50d121b2656eb2fb269b2fc5ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271142, "uuid": "93e2d750-3434-4b2e-b627-a3e60d920708", "comment": "Malware payload (Gafgyt)", "value": "8fa11464139ab0a6819ea202ae5b1d7a728c3ea8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271142, "uuid": "7c06b828-29ed-4cb0-8ec9-9ea51e1bd569", "comment": "Malware payload (Gafgyt)", "value": "b128ab6b77f656cd7249b80d0e52faf43a2e7e57395387e99c95955eb057d1ebc2dc910dfc66f4dda245da38b0fa05c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271142, "uuid": "9d764fa9-700c-4eeb-af09-20c32fdd64f8", "value": "T1AF23F1FAC2F551B4D636BDFA3B858250EB0A9057B0122F472784237A7559FE06323BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271142, "uuid": "f875188f-f684-4e88-8ced-3e14b7eabd6b", "value": "768:+lUN7uvgwFndq4OfB1B+kFZct4tGmb7QpY0UG8TQiZn1heqJ4G9ta64iK7HdN5:+lUAlnM4OfR+o2AKUGziZiW4GO64iK7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271142, "uuid": "8a9b6b92-b659-49e3-afcc-63dc71d6d6aa", "value": 46672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271142, "uuid": "b3f4e7b4-e8f1-4349-b042-cea4985c359b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271142, "uuid": "59a26c5e-904d-4012-b460-67c3e6a33d97", "value": "gov.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e2803d-5cf9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780236186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236186, "uuid": "96c21343-75ee-46d3-bf73-54d4b0ed7eb9", "comment": "Malware payload (Mirai)", "value": "fb40d190c7ebe2c6465c10555678f31c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236186, "uuid": "47cd3b37-ce92-4cd2-9d4d-433be49b0df7", "comment": "Malware payload (Mirai)", "value": "6f03b78717ac52a931efc278e92af6d739afff57196828e5293d4b6fc37ea2ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236186, "uuid": "745db51d-e742-4d9d-aa66-2708e8b6a49f", "comment": "Malware payload (Mirai)", "value": "135886371f8ce85719f190a8d18275902d28a5a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236186, "uuid": "85505e3b-9d19-48e0-9c6b-b5994d86d0d6", "comment": "Malware payload (Mirai)", "value": "8e2bdb2b58653ab4007cda82354a76a602c6b4ba08eae65f2031c88e01bbbe6640f6591047b23ee1e80282e4b1801db1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236186, "uuid": "ab43b2e6-e35b-409e-8077-a1731356e10a", "value": "T1F313D5B4B806B1B8D5EB0038F44B76F52D53128C3ACDE3D3A16A0536FDA57852DA5E0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236186, "uuid": "5c3c2fac-5fc7-425c-815e-2373fd74af6b", "value": "768:nskD5ZeZE/iHKXEwfy8/tix1K5HHHHHHHr:nVtZeaCwfyGp5nnnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780236186, "uuid": "08e24006-d8a8-4b4c-b5d6-c1a9200911bc", "value": 42568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780236186, "uuid": "78fa9e31-bebf-4764-8a98-d38cf370c87d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236186, "uuid": "6e08fcd8-cc0a-41d8-ac08-37eecba96e4c", "value": "12.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba55d938-5cc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213113, "uuid": "e98b1e3f-641b-4bcd-9b41-bf2c829d96e8", "comment": "Malware payload (Mirai)", "value": "1116e89c096426eb6ac55601ad41ce72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213113, "uuid": "9519e76e-8ad0-44ce-a636-f9fd50b8b8b9", "comment": "Malware payload (Mirai)", "value": "6f8594ee5d3fc32dd2fc1f8afdaf97b3883252dc3b220cdf661a28b199d1bf1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213113, "uuid": "580e43a8-1fca-4b13-bcdb-dc6b1511c5be", "comment": "Malware payload (Mirai)", "value": "dfa1d86087efe9672e3b0d098b016a4621288ef4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213113, "uuid": "ec01c4f7-6a3c-4f65-8c3d-ba38fecbe422", "comment": "Malware payload (Mirai)", "value": "182c98755129d1824b1e7b4643b87e69435a01dacfd9a71bb5bfe910a0427a7ffc581d0e4386cbcac179f9c520de7e98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213113, "uuid": "6534271a-5b8c-4086-b534-16258933d2e0", "value": "T13453095AB8819B15D9C112BAFE0E128E731317ACE3DE73139D24AF20778B56B0E7B415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213113, "uuid": "69d38234-8285-4dfd-8e7d-135b316cce03", "value": "1536:Z8n9aeyFO2xU9CaQwX1+shMGibF2Xc4/cd5yYuj:5FOPQah4F2Xc4/cdwBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213113, "uuid": "6c685469-cd75-4a9e-b19d-5d88bbbd5b58", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213113, "uuid": "3d36ecca-31c0-448b-9d26-d4886e0837cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213113, "uuid": "2c47d445-128d-47db-a22e-3bcb42b0232f", "value": "6.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ebc937-5d1a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250170, "uuid": "40a7f303-d046-4795-ac82-2128d321f1be", "comment": "Malware payload (Mirai)", "value": "85c32a56583b2476464d93f8e9ccb6fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250170, "uuid": "365b7742-9e3b-455b-9700-dc3e21164a74", "comment": "Malware payload (Mirai)", "value": "6fbab048f4d252adf00a390d0e993513cbbdd8538c5b2d840698127aff4d30cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250170, "uuid": "36b45abb-be98-4633-ab02-d4c8da6036b4", "comment": "Malware payload (Mirai)", "value": "e24edf71114105e97131a27c22ea03c7b5d92687", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250170, "uuid": "0e7247ee-4f25-4773-ba40-d66027879b21", "comment": "Malware payload (Mirai)", "value": "9cf4e849445ed0eb68e03b364362ad09e088ddc611a0f802448cf45cafafefb3ab9664a2c5001640d991b1eeebf396ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250170, "uuid": "88c14a68-6480-481c-9d96-ac508db62070", "value": "T1F0C3C70E7E219F7DFBA9823447B78E26925833D627E1C585D1ACE6012D7024E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250170, "uuid": "c4b582fd-0d05-404d-b665-532c25ba7efd", "value": "1536:4jg+2NyqmTQxlW+vly2rQ1gQGBFQTULjwBv5IaE+Z1ICez/PFza3:AIoz27skiAQTULjwjIabZ1I1PFzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250170, "uuid": "c83a0d2f-67b1-4f03-bf1a-7528490e0378", "value": 126416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250170, "uuid": "00d3e274-5278-4b8b-b611-ca861862e657", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250170, "uuid": "39017d85-4065-4804-ac65-4ed82fa6610c", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6568a4e7-5cc7-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1780214689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214689, "uuid": "a8961174-69b8-4bf9-9f61-1ad80c8ca200", "comment": "Malware payload (CoinMiner)", "value": "c82bb3c68f7a033b407aa3f53827b7fd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214689, "uuid": "0c66f866-eda8-48de-b7a9-f28635b1381b", "comment": "Malware payload (CoinMiner)", "value": "6fc94d8aecc538b1d099a429fb68ac20d7b6ae8b3c7795ae72dd2b7107690b8f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214689, "uuid": "dd22d5de-b3e0-4872-99a9-5da5f847810e", "comment": "Malware payload (CoinMiner)", "value": "6296e8ed40e430480791bf7b4fcdafde5f834837", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214689, "uuid": "fe8769ee-23e1-4a8b-a95a-a0594e773a8d", "comment": "Malware payload (CoinMiner)", "value": "d6a69235f8e23ccce2e91852542775c52af73fb27ca9c3cfe758b5aaf59e7b471ad47ccf0feb11976abdc91e919c682e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214689, "uuid": "d6860729-cfd8-417f-af0a-0b1de010256b", "value": "T15FA533EAC11176B2E507CF22EE6765A21C45962FA514CCFEF31AA9FF05320CA1E18D71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214689, "uuid": "9e88abf2-e87e-46d0-bfd3-40b1ca2d295a", "value": "49152:j03YLQvH4kOUho7iw0ml1nLOkqjUg9m9m:jX+YTbKS9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214689, "uuid": "e5f3355e-7b17-406e-ad53-51891156b102", "value": 2084964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214689, "uuid": "351c0722-ef1b-4c35-b53c-67e95314bb94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214689, "uuid": "3ba7e88b-f181-4f0a-b9dd-e0035fea1abc", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bacfeeb-5cc7-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1780214753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214753, "uuid": "69d3dec9-10bb-4dfa-ab84-168a1972e408", "comment": "Malware payload (CoinMiner)", "value": "00d71842734b0a86b0863618b2670f58", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214753, "uuid": "ea92df78-4862-4691-a5e6-10cf970cc3f2", "comment": "Malware payload (CoinMiner)", "value": "6ffafaa40005d4dff0436ac9b18cce45d99d6b106e840c0cad22fe08e31d2f5f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214753, "uuid": "14f1f1f9-e1c9-42a9-acdf-c28a5191c129", "comment": "Malware payload (CoinMiner)", "value": "ed57d213d1e958d639a8de927ccbbcb431d72eae", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214753, "uuid": "6cb9a26f-5ae5-4312-bd11-ae8894f060a0", "comment": "Malware payload (CoinMiner)", "value": "b59b0a616c1a2ca856308675a022cbef6abf5dde8839216fcaf2efe7244dee172bb945beeae553c68977db527012eedb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214753, "uuid": "c04be8c3-79c1-4781-bfbd-60f31253f2f9", "value": "T109366C46F5A364BDC597C430875FE6B2AD74786802217D7B2290EA303E27F605F2DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214753, "uuid": "1f41a90e-aaed-4c2d-a8a4-5b82b0b64f51", "value": "98304:qWeuURjloCYUVZs4tHSZ5OFsHJXzuItYcOzcIA0OJWRrnM:qWeBRsfZ5OL2YcOzSW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214753, "uuid": "be20e74b-7a38-4a22-976e-2ab811117f7f", "value": 5257328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214753, "uuid": "964b0e1e-2be5-4772-b8f8-708c64463d1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214753, "uuid": "28462fc5-e1cd-4248-b14b-2e1251245e82", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3f3b34-5cab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780202545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780202545, "uuid": "2a171988-18c0-4e0a-8e5f-3fe83a1e8279", "comment": "Malware payload (Mirai)", "value": "d2fdb8283f63dc483572d78578cef24e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780202545, "uuid": "1621a092-0d1b-442d-887f-bf9f42d3d5ba", "comment": "Malware payload (Mirai)", "value": "71c82f634bab1b7d8b619cc9d49e34bc903276b3295ab29154bf1be8af74aa5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780202545, "uuid": "6f75c219-00d2-4304-a616-2232c684ccc8", "comment": "Malware payload (Mirai)", "value": "bd33c51db5b10648904703404a785cce19483330", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780202545, "uuid": "bda88ee2-1192-4f60-8b70-3ee24c4d9544", "comment": "Malware payload (Mirai)", "value": "55a02c812623a2a62fecbc6a4704d9290fd5604832711657457111b34b542c8e03b0cddb629e893b6eb4f81a5386d16e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780202545, "uuid": "88a94e07-9c9a-467d-9a91-b71289268eb7", "value": "T149431ADAF800EC7DFC1ED73B8453050AB171E39905821B362367B967AC7A2A44977F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780202545, "uuid": "1f8959d0-094c-414a-9ad9-adf69e216542", "value": "1536:OnSV8s6iUL3m8u+C8R6b+8kk7y+7PO920zogU:gkUL32+C28D7xK0gU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780202545, "uuid": "798cc6ff-998d-48c1-b055-6c57b5643ef6", "value": 57264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780202545, "uuid": "0b683a3d-7b1c-418b-99f1-52c838e4657a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780202545, "uuid": "d2c908e2-1ed7-4c11-ac01-0b2c809cfe27", "value": "10.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2099a0ff-5cc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780211567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211567, "uuid": "7a0ca5b7-7cd0-414d-9e3f-e5d347139a7f", "comment": "Malware payload (Mirai)", "value": "e7ffdc176f1087f2971ab5d1898c4184", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211567, "uuid": "bfecccc4-3c59-42cb-8991-74e789ea52c3", "comment": "Malware payload (Mirai)", "value": "7252e26f9a9e44c016120567446f19f82736fbc5a11d9806617a069d38592537", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211567, "uuid": "0a404753-a09f-432c-b4ca-3d564eab07e4", "comment": "Malware payload (Mirai)", "value": "593fe9774a21914acb760ffe736104c07c73b19d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211567, "uuid": "6cde3c94-0906-4327-b471-30510d222f21", "comment": "Malware payload (Mirai)", "value": "3287e43dee2c75beec54e7d9efdf0a9b97c0cf0383225e9719d5c355fcfa3ab25944ca296c4742df86a78f108b4ce4a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211567, "uuid": "8ad1a4d0-ea29-4e7e-ad8f-499f34575ca4", "value": "T123330994B8819A13CAC516B7FF0E438D7B166398E2DE7343DD16AF24378B92B0D6B111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211567, "uuid": "b2f120c6-33d7-4266-a385-6bdfde158773", "value": "768:P+Rymx+aUBsI2bd+Wb8MBuk0Aq0cMvCAXTQ2f2d1psVvmuw9bvUKI:GRvs7BRSbRMkr/vCAjSd12ZsbvUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780211567, "uuid": "925d85cf-3e48-408c-8abc-84d664474669", "value": 54620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780211567, "uuid": "a678ecfa-4404-4dec-99bf-4c83d8ef17e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211567, "uuid": "69ac7e32-b216-4a5b-95aa-f96d05eae049", "value": "4.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74a85ae-5cf8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780235952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235952, "uuid": "f992fa8c-35ed-4e44-8966-e141b60871a9", "comment": "Malware payload (Mirai)", "value": "89e01fced0f561c0898dad33a53c42b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235952, "uuid": "26760074-8242-449d-b312-58a222caa595", "comment": "Malware payload (Mirai)", "value": "72a7252a489a76e7c32c83e1e2c018d1d50dbdddc6670a8b220c6234f7b1f68e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235952, "uuid": "861a5a0e-94e2-4577-a3b9-97c6b6f33124", "comment": "Malware payload (Mirai)", "value": "eefb02e68e091179744d32bc8f270a096dbb6ca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235952, "uuid": "23464da6-1333-49bb-a191-99b3e29a7d8f", "comment": "Malware payload (Mirai)", "value": "9eefa0a22f1f84cab19feb5fd80728943d5e7060515726a93254c891cdfd9fa99d26e35e8c801d5f14c8484899051896", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235952, "uuid": "264256f0-102e-42d1-9a5e-d689dc088dbc", "value": "T1E3430119E32F5CC1EA74153EDE9DC0592DC0CDB8F66C67ECA6D849342CB588392647C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235952, "uuid": "5785bfb5-8c03-4e82-ac46-af24b13ea61f", "value": "1536:q20u4IuyBu/97D0xUToKUFTw2J3565iOPe0is22yYGMKiLr:QHIvBM93yUTnUFV+dryuLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780235952, "uuid": "bf0a60b1-d87b-4b80-9a6f-83aa14fa251a", "value": 60376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780235952, "uuid": "a01661e7-1a92-473f-89c5-b53a8a883429", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235952, "uuid": "20c1b1e5-7fad-489a-ad95-247c0f7ba11f", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d612ef23-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780271142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271142, "uuid": "1d4a9a2c-6a04-4be7-96d7-0cc3a013d534", "comment": "Malware payload (Mirai)", "value": "1cf3f605e67fbc9542145aae7b5f51dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271142, "uuid": "0fd07241-3920-4c1d-acc1-d6724b0c4097", "comment": "Malware payload (Mirai)", "value": "74001aa3da7b8c50cae57cb6693a929e0ae5d092ffae5fa0c4621a77245ba8cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271142, "uuid": "9cdea117-9722-4309-9212-bc5fff14acc8", "comment": "Malware payload (Mirai)", "value": "74fd3e231a37fa654efa024ddf31c292a8e7575f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271142, "uuid": "fc344a71-6765-4504-a650-01ffd131994b", "comment": "Malware payload (Mirai)", "value": "f4a30eb42470393475da3100a278c1866250cf357b862182836615bf1e95c12a261226f58ccf1d78bc99b3759a8066be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271142, "uuid": "03b9ccb7-f48d-448a-a9a3-60f340301d50", "value": "T14BE3B71A9F910EBBDCBFDD3702AD0A0135CCA45722A43B763674D528F54E94B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271142, "uuid": "3e444a13-0d2d-4294-b4c2-70521cf9b851", "value": "1536:S7frl7qRNRFvK1gptIMTIxkaZZv5l9mcVD9ezS4ouaxkYx/wmFJWhbs/:EfJ7spKXZvXxezSeaW0/wtbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271142, "uuid": "57bfd217-8c76-4f5e-b4df-094a40da3e0a", "value": 150468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271142, "uuid": "4753f644-407a-4fc9-843c-3e1de26c286c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271142, "uuid": "8d2e92e9-057e-4bc2-a2aa-fa048460ef0c", "value": "gov.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab6a83c-5cf1-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780232764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232764, "uuid": "79423cac-8f8e-4dda-849b-e27288a5a77c", "comment": "Malware payload (QuasarRAT)", "value": "3ece021a0a619de7e0d8470e1acd845d", "object_relation": "md5", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232764, "uuid": "9fcc2436-e4cc-4d9d-af6f-77be9cdcd8bc", "comment": "Malware payload (QuasarRAT)", "value": "7458c325a91844ae1794fd54ffbeb33e8196123065f84e6174aea7a38a6dabb9", "object_relation": "sha256", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232764, "uuid": "dbbbdd18-813f-4902-9fb2-6c6a65c26b80", "comment": "Malware payload (QuasarRAT)", "value": "8320c922b8d75ab596ff3e8d07396c7b5bf488f0", "object_relation": "sha1", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232764, "uuid": "0f619604-b7ab-47e9-aae8-8ba207bdf527", "comment": "Malware payload (QuasarRAT)", "value": "e03bba3c67c4d4eb157d6830fe786d590876f058c37eefd63c3e8fb5f6515ab490cdc0e0f048d89ced77489937656977", "object_relation": "sha3-384", "Tag": [ { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232764, "uuid": "9be69e90-8688-4ffc-8281-60b14c2bfef3", "value": "T1D735121BB78630F8E4A7D139DA914756AB7334231B25ABAF036486241F136E4CC3B776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232764, "uuid": "66b2be2e-185f-4b51-af05-67544703d5b6", "value": "cbe38d59706d64beb1315c060f9494a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232764, "uuid": "d3e9981e-d052-4684-88db-74b312bafb71", "value": "24576:6BH0JsibZQplR6lxVr0X0Z1XHWS9qwaSzFLhwOlnsmKFnVImHxPuhUflPVto1:cTcyplUrw0ZnOWFLhDGBPd5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780232764, "uuid": "378f46eb-d040-45b3-aba9-4b5eab701523", "value": 1133824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780232764, "uuid": "a56cfe82-f150-45e3-8b24-c82081f5c760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232764, "uuid": "92132ebe-f34f-461d-973f-57ba678f4a78", "value": "5tpap7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b747c0-5d28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256458, "uuid": "c2e83127-cbc0-4244-93bd-5eb6a7db3bc5", "comment": "Malware payload (Mirai)", "value": "632877f0f572abbe69877a4a55f118d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256458, "uuid": "b23a41b0-d160-4843-b017-190727735bcd", "comment": "Malware payload (Mirai)", "value": "77034659aee62b3f50201feef70b1603af285478a6a9511de194d99c4fea7832", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256458, "uuid": "223b6785-e311-4e22-b6e0-32cf538a21d9", "comment": "Malware payload (Mirai)", "value": "57e991c9cae4e587206f7a5736ee8e06eee55ab0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256458, "uuid": "c748bfd5-7304-4edd-8439-84dd9b74f4c9", "comment": "Malware payload (Mirai)", "value": "61e85639bb194fbfc4900735e21f9dd37a9856f53bcc5d18f942d14ddfc91ef9682a1f6baf1eb5c1e8e0679dfa5b4e4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256458, "uuid": "c0115561-404b-4ddb-8991-95a118c720ed", "value": "T140F32A85FC918B17C6D612BBFB5E42CD372657A8D2EE31039D255F20378A96B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256458, "uuid": "21610735-7c75-4f7c-b84f-be4fb4dec2dc", "value": "1536:g4tuju1s2HzdkCqgspyd/foF7UANnSk0M4VL5E7H+G9LIZhHr8F/HlxowywzuUkt:g4tk2HCz1pyNfo7UANZ4oz+lLw6HEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256458, "uuid": "0415aa33-5913-4641-bc99-37a3cd375f88", "value": 158060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256458, "uuid": "938e443f-7d81-4581-a28b-0e4b22be736b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256458, "uuid": "c228887c-a54b-4730-9d64-9268f94ab8b5", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8965694e-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780213461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "7889156d-afc2-4b86-a228-ee08bd93b91b", "comment": "Malware payload", "value": "b2dfc31c968b0f6cee25c330baf36792", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "c81f834a-d62b-4466-a000-e9509aabfe36", "comment": "Malware payload", "value": "77043049860decc635395cadc18df775579d04300c391190b51e2412ef5ed8e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "1ac2f065-cb62-4c0e-863c-1431fd3d827e", "comment": "Malware payload", "value": "b76bde682d75fb77f35b572d4ee50e6a687b2dea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "679921b5-8a1b-4bc6-8c65-d5e077b021aa", "comment": "Malware payload", "value": "56745ded561165c567cb58672b47070225d9c34e47d0fb250c8f20f461203a625091bdb61dc7fb066f5aab67e2fc68d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "3ce3005c-fc3c-4499-8f6f-917cf743324d", "value": "T12B762A47B8924542C4E43A77B8BE81C432631EBA9BC756576D05FE383EBE1DA0E39344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "37a27b2d-5168-458b-8dcc-f719ea73495a", "value": "49152:8RkbbJSpZfIztuWf8rr6KJdT6twofDPwqF9k78pN5EG:T4pxIBuWf8rr6KJWB9k78hEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213461, "uuid": "007315ae-a883-488b-9616-1bba9ffb6225", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213461, "uuid": "09db4e99-b6a1-4bfb-a584-ec3c1df15bc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "915ccf68-2447-4051-b580-08f073955464", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a124dbfa-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780214360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214360, "uuid": "b69cc048-d91f-4711-9602-ceebaff57dce", "comment": "Malware payload (Mirai)", "value": "3228d4003061351466413f811de59023", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214360, "uuid": "5d491b57-72a4-4c81-8e37-bf0a96480fc9", "comment": "Malware payload (Mirai)", "value": "770beae5884ed619ba4c7ca41595a44644f1139a81616b174c82125abbd9559d", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214360, "uuid": "b17d565f-507e-4482-86a0-d75fd560a2aa", "comment": "Malware payload (Mirai)", "value": "cd647952d0ee576cd9238ee0d063af1e7a2e6276", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214360, "uuid": "c916a8b3-0173-4c04-8637-484ad679a2db", "comment": "Malware payload (Mirai)", "value": "7b3d476c18518e8d07db5cf5e4ef6a163feb509dd12afcb8662ba9af2a249b7e437e372db1be43824dc83bc26ed7cc76", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214360, "uuid": "6d0cc8ad-1bcd-499b-91f9-10ec27abb7b9", "value": "T16D7423F9E671EAF390047BF350F5C8C4E1C753B084E85A1A2A5C964F5E2F7044AA27CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214360, "uuid": "14856cfa-a989-491d-8b3b-0ed6593540d7", "value": "6144:givHVS6kaaQu0eTaxhqHx5lIpCmeBO/e7eLKVqtYGR2pVhO1BEbom3v0T60XIRt:gi/86aTVkso/se+Vqtx2pHO8b93cT60o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214360, "uuid": "95c9435f-177e-4353-a357-6bfd8731b85a", "value": 349720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214360, "uuid": "9380d2a3-5f0b-41e9-a335-29f7e2331a2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214360, "uuid": "4bafa7ff-a073-4f9f-88b9-fb9107c8f8b8", "value": "blue.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671a1329-5c93-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780192358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780192358, "uuid": "d4117111-767d-4110-a0bc-209a7b63c6eb", "comment": "Malware payload", "value": "8b7be5ad2e6e182fdbe134604ef53d2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780192358, "uuid": "0959862b-c31b-4ba3-99dc-06488bc763d5", "comment": "Malware payload", "value": "77274004408ddf9c5a9aea9d31f4e13fc2e4539700e92e7514a80551b97818c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780192358, "uuid": "18428e66-8cd3-4156-8f29-ab432ae9e6cc", "comment": "Malware payload", "value": "6bfe719754d72d6c443969e33d6a08502187bfd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780192358, "uuid": "86d97e9c-4138-4f12-a842-ceea12dd4347", "comment": "Malware payload", "value": "430235b0c7bfd9a35a0c5bbb69b63e5e1b16145147ef652c31630fd7a4d73630311ffac0a41286917dd0b62c8654111e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780192358, "uuid": "277bc71c-7613-4448-aae5-052a273a89db", "value": "T11146D013FBC38075EFF30170C92BB7A987796D314620654BD3D837499A726E1A72B21A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780192358, "uuid": "80940b73-0197-4d17-b38e-9478a362a661", "value": "f60eb89b57d075717d8c699740586fa8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780192358, "uuid": "10d09f71-abf8-4052-955f-9e82391052b5", "value": "98304:LCJR68luX4Zvyys1pWLX2XZT7+KFdu9CwJsv6t0Ye/K9saVRa9b8+NH:eJR68luIZvyys7JZ7+KFdu9CwJsv6tpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780192358, "uuid": "5567c2ff-0ca7-4286-9047-0a5fe61e1502", "value": 5412864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780192358, "uuid": "f64d1035-ace7-4b6d-9040-b41bb29273f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780192358, "uuid": "853a7202-5cf7-4471-a536-57289fdb0799", "value": "embedded-stage3.unpacked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1beacf7-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780271135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271135, "uuid": "592edf6c-996b-48a1-9486-96311b4a1254", "comment": "Malware payload (Gafgyt)", "value": "c8a3e1d60568bc84a5da7352b302a6c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271135, "uuid": "00a33e74-fbb9-42d0-83e2-80008a448eca", "comment": "Malware payload (Gafgyt)", "value": "773f58441c188331eaac96c5850df79e42596778c536f5a95ea5cf664759eb01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271135, "uuid": "23f06ed8-3151-4bb5-8d1b-036d3d5067b8", "comment": "Malware payload (Gafgyt)", "value": "0e2f058e988a780567756fd4970108082c6885d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271135, "uuid": "dda4081e-f20d-4cba-ab09-c727c184d304", "comment": "Malware payload (Gafgyt)", "value": "98531c7b0d07114ddea3540857860d1c003e235e0a54934d68516190f592d412494145ce3ef49e8aa3fffadba58b3326", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271135, "uuid": "134f4af9-8e68-4b5d-8e33-4cda718f682d", "value": "T1D3E2E1A041818131E7B215BDD8EB5B12C822B3F8A7F7505C1ADE0E35BFA565A60E43CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271135, "uuid": "f9fabf50-b804-4f02-bc9e-56bfa372b821", "value": "768:NpQlDitU5SGAAhM7DcqSSGtiyW4IvoTA35d63U03wfc:NU0ieR1ByFImQdbfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271135, "uuid": "02891ac5-5cf3-4562-a94f-44555d83ce67", "value": 32676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271135, "uuid": "31502592-2646-4e99-8ec3-8503de6aa6c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271135, "uuid": "3a50cf25-dd69-4980-a9cc-0830303d780a", "value": "gov.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02205a4d-5ce2-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780226119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780226119, "uuid": "70256bc8-2030-491c-9ac4-1c7b54e18ec6", "comment": "Malware payload (WannaCry)", "value": "50a4fa1bb1f1e928c49a311ecffc1f48", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780226119, "uuid": "d610c62e-2c69-4c24-ad15-b29230b773a4", "comment": "Malware payload (WannaCry)", "value": "7757e6b58b9a920aa4fad72cbeaca1a7b5c18c4b2152f6b3c31c7fb1c778006d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780226119, "uuid": "9fe95618-01da-4f49-92e7-99f31121e571", "comment": "Malware payload (WannaCry)", "value": "e8c85ecb21691e21dba476cebad4fd232eee66b9", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780226119, "uuid": "cda592e9-dc64-4116-b129-838a65d9c20e", "comment": "Malware payload (WannaCry)", "value": "01fb04f21a879b36dddd597cf0395415baed0e33ce93d88d7a10c0ae2e21804870a6c02eba7589b804e04abd6f4158a2", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780226119, "uuid": "55d55938-ea5c-499a-98fb-0bb5b28f45e9", "value": "T13A36338931B881FCD106197484B78E26F3B37C5A26FE5B0F9B404A7A1D53B46FB60B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780226119, "uuid": "7e784005-461f-49ad-a3ce-6a01d50016e1", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780226119, "uuid": "1a7fc09b-d6ac-4d67-abfb-4cfb0aaeffec", "value": "49152:jnsnHqMSPbcBVQej/1INv+TSqTdX1HkQo6SAARdhnv:DMHqPoBhz1avcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780226119, "uuid": "e9fec560-5ff7-45fc-b814-64068815d87c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780226119, "uuid": "49989bca-8600-43bb-b9fb-a87090c21c98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780226119, "uuid": "badf4292-303b-4d04-a39c-8b538ab1a02c", "value": "7757e6b58b9a920aa4fad72cbeaca1a7b5c18c4b2152f6b3c31c7fb1c778006d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57433455-5d1c-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780251172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251172, "uuid": "07645aa1-eab0-4592-b09f-b4c147954ba1", "comment": "Malware payload (Prometei)", "value": "e93dcd96c9e5540143173bc7fa728d0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251172, "uuid": "7475012a-5534-4117-8dcd-d6c33b08c989", "comment": "Malware payload (Prometei)", "value": "77bd50f5f45bc364014a015c203bd353881e59ecef3ca7ebab005cfaacca6d36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251172, "uuid": "d420083e-6033-421c-9cda-165bf13ccf9e", "comment": "Malware payload (Prometei)", "value": "db22b303f1db9b38552d1bf536d0abe509c5d085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251172, "uuid": "05ce5b79-9a3c-43a6-a647-41f6f708354c", "comment": "Malware payload (Prometei)", "value": "a0aec6fd4a6821d3812dc060a2b0a237fd9b56f1df897b0eb0bb547be336b40953e3a4e90e17924262e46a7137792512", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251172, "uuid": "80552f99-62ac-43cf-a3a3-85391ec4e288", "value": "T1FB34BE63A4BCAA9FDDD82F379C4E880713B66FE4D890603E1C44710EFE2A5085F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251172, "uuid": "c453d2d8-dedd-47d1-9a16-9249ca0f1dba", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251172, "uuid": "8a024347-db36-4e33-b5b8-bc5101bdcdcd", "value": "6144:zGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOr:zG60BpL8jk1FGjDc8GVdOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780251172, "uuid": "55cba62c-3e51-4c42-81c6-b872077557fe", "value": 245870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780251172, "uuid": "55a73dbd-6bb1-49ee-9e30-56a0e771e4a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251172, "uuid": "a82dfe12-f286-43c9-9b6d-4ef555ecb188", "value": "77bd50f5f45bc364014a015c203bd353881e59ecef3ca7ebab005cfaacca6d36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f97c3a4-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1780213471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213471, "uuid": "6541a7ff-7d5f-46da-83a5-ccbece7b16bb", "comment": "Malware payload (DDoSAgent)", "value": "87add645a0c53e9c9cbfa6b9822ce220", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213471, "uuid": "73a6c6f7-041d-49b7-a0f5-9d113b0f942e", "comment": "Malware payload (DDoSAgent)", "value": "77ca7418f5fb335fe83fcd5d3d79596466d57bf7c0bca76e12180f5b3104d22c", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213471, "uuid": "2e02979a-f1e6-4707-8467-74416efd2aac", "comment": "Malware payload (DDoSAgent)", "value": "cb0eafca9c2164e28b8a05c708e5a8ae6e90d415", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213471, "uuid": "3311b282-0f9e-4f25-ad8a-aeb97feaf07d", "comment": "Malware payload (DDoSAgent)", "value": "8d5b816b059221737101fae1138003b531475b5942f39dd24ab84ef19565f87c9540137ba7239c4015aa56878a1bec5a", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213471, "uuid": "55d39ceb-0f73-4dbb-b4ed-4b0b1a5908cb", "value": "T12F860915ADC42BE6C02C5E7494EAC95622B05D144AF2463A65A4FFDDBCBA2387F07CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213471, "uuid": "ddbcbb8e-5720-4604-aab7-717044d2737f", "value": "49152:1YGJeH0KwVl9E5BwXOnimotTnn7auNQmsdoYV6kH1qm5Eq:qUenidn7mmfyH9Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213471, "uuid": "a5bd426f-59c0-4e52-93e1-1db6949bf27b", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213471, "uuid": "3911a21d-d0ac-45f9-b32f-2f44978a1f95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213471, "uuid": "990e27b5-469b-4d3d-ae7f-96ddfb07a7ca", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01000c0-5d2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780258650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258650, "uuid": "97533f03-4bd7-44ae-8702-603cd05fbdcd", "comment": "Malware payload (Mirai)", "value": "e406969562c3f587be5423ddb3e4225d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258650, "uuid": "63dabe52-c70e-4462-8046-95ce77eadc28", "comment": "Malware payload (Mirai)", "value": "7893cc3dc18323c15b1006aaefcd9fe0a125f18449731eebf278107ad0cad989", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258650, "uuid": "7ac992d2-44d1-4fc2-86a0-76a0138c71fd", "comment": "Malware payload (Mirai)", "value": "f3f16f32d2ebfb65e6e805858c0322c383802e21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258650, "uuid": "35ac00f6-9eee-42b1-9d24-35430f5e2f3e", "comment": "Malware payload (Mirai)", "value": "c0ababaf7706b639d78eab6a4f48dba05675514c3d23dab52922879742fe56c79d9dbc687c3758243daa06f487cd2d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258650, "uuid": "91aac29e-7423-43a6-816b-9ab9f22942a5", "value": "T13724B50AAF510EBBD8AFDD3706E90B0635CC650722A83B367674D924F64A94F49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258650, "uuid": "70ff5bf6-72ab-4139-80a5-038e1e40e7f1", "value": "3072:wSaTF8vUoIi5eigDuOPzQRTQzejlZUrmZjAX/+h1S:wqvvNIuOPzQRTQzEZbZj2/+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780258650, "uuid": "902edb46-4e21-445f-a07f-37af784a0ff8", "value": 215084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780258650, "uuid": "a5290bdd-9dcd-4b8d-8d85-4b7853655666", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258650, "uuid": "444394ed-9446-4944-9091-edcfaff81ae8", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27ab3c0-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780271136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271136, "uuid": "05b3911e-0337-4a96-99d5-ed78617560d8", "comment": "Malware payload (Mirai)", "value": "bc730c18232125e8442f253d47465168", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271136, "uuid": "b4049e8f-8803-496a-bd73-6ef8f02a804b", "comment": "Malware payload (Mirai)", "value": "789b28ea15e7be0bbce9619cd416a15cda6d441a088203de5e5953c3b3377efc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271136, "uuid": "847d3e0c-7a8c-40ba-b83c-57f8b57302e0", "comment": "Malware payload (Mirai)", "value": "e673f25ba0ba5ceaf74b734410b5213c9c741d7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271136, "uuid": "7bb060df-b207-4436-94a2-ddcae2579d24", "comment": "Malware payload (Mirai)", "value": "30a294fa00df87b32218528387212dade1a22e37bdce2893368fef29c0b1ca4970903f1d254c7727056d3f686ee9ddea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271136, "uuid": "e6bf6e4c-75ca-4804-85ca-05bf162574b0", "value": "T1B423F18161842B24C6734C72FA2BC385E97A4E24D1FF36B53A105574AAD290E52FFB4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271136, "uuid": "1ab06ad5-409b-4074-a184-6dc50472c9ac", "value": "768:6lA5N4+PNvMYh+1BlZ6k53JJP7iCKANUlmuQTIr/OB6BZb4nmcvu8dHCZGt3U037:+A5N4+P2YmBb7/KTmie6BZb4nmcvuOiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271136, "uuid": "c90d1819-8495-4556-ad84-303143ce932b", "value": 48256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271136, "uuid": "4240598a-f050-4598-ba06-a3dc92e47594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271136, "uuid": "ffab0646-929f-4b2b-aec7-4c42e4ddee17", "value": "gov.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e37828f-5cc1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780212207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212207, "uuid": "5ea710af-1c43-450c-abd4-e0eb0558f2c3", "comment": "Malware payload", "value": "2431ed1c7df814a69b9466c2fca35b0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212207, "uuid": "c6de4a2d-8d17-4195-bc36-875e087048d9", "comment": "Malware payload", "value": "7949fc0152920c93923cafd41dbf6565788ce6b3c9fbd36fd15d334a79664b53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212207, "uuid": "5def0a39-f850-456e-a664-33024c262a45", "comment": "Malware payload", "value": "f0053d07bf76b6268f57ddb38df29de822b48936", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212207, "uuid": "a4d4e11a-4495-4716-a412-4e09c0fde236", "comment": "Malware payload", "value": "8890a3f48b0de31d7116d108ffd2978ad5fd386dac8906d9323d097c5616f83a54d6af5f5140d48a952500ff6f831b16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212207, "uuid": "abf1d0ae-9eb1-47f9-b401-1fafcfc99b4d", "value": "T166331B41B71C0443D5732EB0363B1BD0E3ABEA9122A4E389751FEA49E175E339586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212207, "uuid": "7e70ceac-0e03-420e-bd64-18830e414c90", "value": "768:z3uhWf/SAoHFUGrWhcL9WSTJHjSueBPl3x0FObtRBrqeIy:CSgHm5h4WyJDBeFlBjbr0eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212207, "uuid": "0b2a6114-b7c9-4d3e-a68e-85d9a1cbeaf5", "value": 50624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212207, "uuid": "34915fb4-7b63-4916-9cc4-91c5c3633d2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212207, "uuid": "282c2925-f8d4-4b57-94fe-bc23c5ae5b42", "value": "8.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18eff35-5cef-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780232077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232077, "uuid": "eab5bd5a-46c7-44ad-a7e0-d5781e97598e", "comment": "Malware payload (Mirai)", "value": "67938377ea5a850891018fee99d99b45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232077, "uuid": "893d6da9-e051-45aa-a7dd-222b1f9d6aed", "comment": "Malware payload (Mirai)", "value": "798312a1889a135c42bd969a3d22a9cb77a62f71b83616bf51a9c5fda40fc7bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232077, "uuid": "0a2aa931-1549-4c8c-8a32-59f4e21536cb", "comment": "Malware payload (Mirai)", "value": "a2b93692730454aa6dad777e0d4eb1a465860576", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232077, "uuid": "b5670efa-2b0d-49f1-91a3-871b1b32e5d5", "comment": "Malware payload (Mirai)", "value": "b568e94d97177916d228ec9faddffb62874933d1096b7389b6ebe66fcc78f360dc9f6a818ce34049592a3c74fa871d07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232077, "uuid": "fa920542-b8e2-408f-a5e3-f7c0024a5a0a", "value": "T195E33B06771C0987D2A32EF43B3F27D193EFE98121E4FA45294FAA899271D325446ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232077, "uuid": "01d51624-0ed8-4700-b3a3-1a118b5d6046", "value": "1536:KijcHZ13404Hus8YpQDsbZisxbNgv8tpR1vDwJne44x4nvAn5PlqFR5qE1xwx2l/:3eZqrOs8Y+QFisxZgvurGenxlnuZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780232077, "uuid": "1da74b0d-42ba-4c2a-bee0-4dd5c5dbc2e3", "value": 150336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780232077, "uuid": "24f238c3-c512-423f-9634-71841eb09b57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232077, "uuid": "cbb7990b-05fc-47b1-83e4-5827e1d1d3b2", "value": "micro.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4540c6a5-5d0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780245129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245129, "uuid": "baae306e-61ac-4d08-99de-4aabe00c4226", "comment": "Malware payload", "value": "120749b744bba3120a3097d2d0feaaae", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245129, "uuid": "db0ee3c1-1b7d-4a28-b865-07c2ba9dbd37", "comment": "Malware payload", "value": "7a6d027aa2ae856b193a91db8c09e1c0750131bf3cf1ca0777db78c6b41045af", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245129, "uuid": "cb94cdb5-f610-4a54-8545-05c95579afe3", "comment": "Malware payload", "value": "2be614a45e436d7326e992b724500eea3fb239b2", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245129, "uuid": "9aac925a-5c35-4da1-96c2-a41617227cf1", "comment": "Malware payload", "value": "d13cf9d5dd3a28e902c3af42d6100dde57cb6ff6e44f2224f35770cb16296a673001b1738200d79ca4a54282d5bcf615", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245129, "uuid": "37f47fad-dfe1-4c38-977f-e3bf7d47b426", "value": "T1BA08334D413DD074D257BCBC7AC6E8BE4926333FC95E2A07AC6461807EEE12606F961B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245129, "uuid": "3fa572a1-38dd-4e04-b26e-8fff5562ee09", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245129, "uuid": "77ba94c4-9fce-4d54-8d8a-d43bcadc0d59", "value": "1572864:/t9IKP1OBYGsCexgk5bnTGqfxnJdOZYXxAAH7:/UKNOBYGsBgUbTGqfxnUYXqAH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780245129, "uuid": "c349317c-41ba-48cd-9af2-f2fc2df8cc29", "value": 78011600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780245129, "uuid": "074a8467-9f4d-4015-a772-45f7ade7a1c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245129, "uuid": "54b241fe-2130-4292-9f17-eb8b173d8312", "value": "ecore-start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304648cb-5cef-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780231780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780231780, "uuid": "50fd8f99-0215-4e43-934b-00b2d50ef284", "comment": "Malware payload (NanoCore)", "value": "37c48e65ac986b64a8c1e0ac31dcc1ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780231780, "uuid": "5c33196f-24ae-466e-8bf9-8acf68fdd5d8", "comment": "Malware payload (NanoCore)", "value": "7a91a0f708266d100017814211736836481884f1e2dbe69e1c8def66379383c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780231780, "uuid": "b95125de-624a-4440-856d-e13d0e69dc2e", "comment": "Malware payload (NanoCore)", "value": "24c5a591e68b14e901b57454997ade3bd3820356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780231780, "uuid": "e0e5bae3-108d-4ffd-a2dc-111ec72d2369", "comment": "Malware payload (NanoCore)", "value": "64854c029b9ac25c03141be45c03abf98904f0c247b200183b400a6698252cebf168aac11e96b5da18ca8d525401e5db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780231780, "uuid": "f4e07351-0a3f-4765-a05e-855cc155d8a0", "value": "T15364F11633A4893FE2CE86B96112511293B8C2E3A9C3F7EE1DD455B34F667E1024B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780231780, "uuid": "507f242b-3337-479d-9bd0-9427e42152d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780231780, "uuid": "321a788c-9437-4216-aaea-e0c665969bc6", "value": "6144:OLV6Bta6dtJmakIM5/A4cvmgWlWgeqlFSNiREGfQpvKcUvi1:OLV6BtpmkbFvmgUxSNz0TvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780231780, "uuid": "8c5ec818-aa14-438b-bcda-26a1046bf51e", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780231780, "uuid": "ff06e6a3-9a5e-4fff-991f-eaed68869738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780231780, "uuid": "b3e63e2e-9816-4023-acc0-c3ccbb3bf234", "value": "welshasianwomenaward.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4f2cf5-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780270936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780270936, "uuid": "bcbf2674-92c0-46b7-aea3-93de9e3d9e0a", "comment": "Malware payload (RustyStealer)", "value": "1ce0c67452783626825808b6b0b1b386", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780270936, "uuid": "6d9a31b7-4d4d-4076-8f88-a924fc9c6238", "comment": "Malware payload (RustyStealer)", "value": "7b6796b96db474bfab3205414d056822abea33110d8653dcbfac6217c34a700a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780270936, "uuid": "2b7b2c82-99d8-46e0-bebb-88fde11d7641", "comment": "Malware payload (RustyStealer)", "value": "13d451e5d277ecf70049a921da35e732e5caa2af", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780270936, "uuid": "cc5ff066-ea86-4f1d-99df-a7ee11279d36", "comment": "Malware payload (RustyStealer)", "value": "c061097ff7a65dc2d2878e905f8e0a1bbe1cd292c2ac295128de91b665430b991f9773043bcab46b25d102f78a23aa3d", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780270936, "uuid": "a7211889-26d3-4bf2-91ae-6a23b93a08b1", "value": "T11706129E33D9D999F1E3D03A4B0B9072DE37B199190A7DBB4274E3202E369C5DE16E40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780270936, "uuid": "94e0e55d-c14a-4a57-b745-ae3f29a8484b", "value": "56720a0219cc1a5225b827e19e3be6e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780270936, "uuid": "a93d5d5e-f440-451b-b562-cf00680e14a9", "value": "98304:/4pxKMGuTxBxjtNHQ74FcNjkWEMEyN39pR46WG3:XMGuTxfjtpQ7tNj9EMf9348", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780270936, "uuid": "46a348a0-07f8-4084-8f0e-6f572b5f345d", "value": 3693568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780270936, "uuid": "80331231-d266-478c-aa0f-62d333525c10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780270936, "uuid": "64e32f12-6d5b-47a8-93c7-592b508295b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c720d2d5-5d0d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780244918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780244918, "uuid": "5f014453-6707-4ad9-aeb1-988b0eb8a445", "comment": "Malware payload", "value": "98746eca8ade314cc3ff3cac62fff338", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780244918, "uuid": "f44e6fd5-cc49-4865-ba7e-9a1d652668f5", "comment": "Malware payload", "value": "7de041828e166e3d0a63672360897868e9b96d879aee5597a4cced308372831b", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780244918, "uuid": "e7337572-c25d-42c8-8294-a1b3ddf8d785", "comment": "Malware payload", "value": "27cb5c7f9dba1e716b0d89de95afbf4c33a25755", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780244918, "uuid": "b2a6da6d-d8f9-4e5a-a795-0e01b3b85e44", "comment": "Malware payload", "value": "28f8b36abd0c0479e005e188682ec705754766923b518af28b7f82e2af5b57b2741be28d08da696202afe6b85a6c57e6", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780244918, "uuid": "b5cdcf37-7ba6-4b36-b068-59f0bc70b333", "value": "T1A1F7337C9F0DB8F7C00471F370850470793E661B62AA9AEA65F992E6B6610613B0D1FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780244918, "uuid": "656b3745-26a2-498f-a23d-f6dc5af42e2f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780244918, "uuid": "8462b031-b4e7-4554-b6a2-46ddc82af1f2", "value": "1572864:tJejOYfp5GP/Gs7JMgizAWvdAERHsEJ53a1C6Da4:tJ4C3AxA2AOHbBa1C6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780244918, "uuid": "dcbf9169-4568-4fef-ac8a-8753e9bb2cb7", "value": 77053708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780244918, "uuid": "8c9029b5-53cd-48cd-9991-046da9fc1e8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780244918, "uuid": "ac4003bd-de07-4a68-aa3a-843c03597360", "value": "CodSouls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d4b9c8-5d26-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780255658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255658, "uuid": "0a446d34-394c-47ea-8e49-6a9078e3b140", "comment": "Malware payload (Mirai)", "value": "f6923de28b1bd6da62c8ace89b2954ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255658, "uuid": "40482454-82c1-450a-9993-8e90e73094ab", "comment": "Malware payload (Mirai)", "value": "7e51659cc1a5e184e447e44288ccb46ff7d4383687b187f137aa8442c5766fa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255658, "uuid": "2312542a-fbad-4c13-8e47-3d20502f3e3a", "comment": "Malware payload (Mirai)", "value": "6f862c6c25a168361ee5af31e894f6a1aa2fe491", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255658, "uuid": "76a41c54-082c-45ff-97e2-ec072dea5dd6", "comment": "Malware payload (Mirai)", "value": "4219971aeea6a627cdfddbca5add25c929be64eac03302ab85a9d8d1871a8c1e2dbbb399cd0de33bc3966cd19a26df1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255658, "uuid": "edc93129-b44d-40e4-90b0-3c48efb324a7", "value": "T125042A56F9819B11D5C156BAFE0E528E33131B78D3EE72129D246F317B8B8BB0E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255658, "uuid": "849b13be-af10-49f1-ae5d-edf0da241ffc", "value": "3072:8aFhTH4XKSHcD60Cqh7OZf76QGVSbtCVviNaHlx6ea1jFmJHslU9WAy/WZm:5FhTH4XKS465qFOZ29UtCB6aFxt0Fmix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780255658, "uuid": "df0ddb52-6fe7-487f-8bfe-2e4953ed4fae", "value": 175028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780255658, "uuid": "f7120415-1873-424b-bafd-321f4a95b4e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255658, "uuid": "d4495414-ff5c-4f37-94f6-7a274f376d25", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855db18e-5cc3-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780213025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213025, "uuid": "3fae7162-6578-4085-972e-83f34e4b69ab", "comment": "Malware payload (ConnectWise)", "value": "1ddabdc582e34264fa5b62bb3fd79c45", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213025, "uuid": "eb996b96-18cf-4bf5-a257-10e4d56e75f9", "comment": "Malware payload (ConnectWise)", "value": "7e9ca8eb2d77d5f46858e2b9e9beea06a6c3785ff9ca87554b545f94e0b2b596", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213025, "uuid": "a5c465b6-106d-4ed8-a7f3-b364af94a5fa", "comment": "Malware payload (ConnectWise)", "value": "290cb3acab75304930009581980d8a8e21181721", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213025, "uuid": "71f47d59-8c72-443d-ae4f-e82799e88bba", "comment": "Malware payload (ConnectWise)", "value": "ac7ac16e097be7e3d7389237b07c0a105c18ae7e1144fadc4db4393de60ff90250af6c50d2e391daa69de2e1a93ed073", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213025, "uuid": "a7879634-e184-40b8-8aec-b28a337a0d85", "value": "T17946E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213025, "uuid": "aaeb1988-5a7e-4057-9d59-6701033a4fdc", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213025, "uuid": "37eea96b-fdea-4f5a-b120-56413a680618", "value": "98304:CzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ChfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213025, "uuid": "ab983e8d-193a-4cba-91fa-c9f6d5d6d512", "value": 5645776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213025, "uuid": "6e6fb1c5-7964-447a-b8f7-af685e7e7b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213025, "uuid": "762203db-bd70-4a02-890e-6336be8fde22", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897a5b03-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780213461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "2732fc82-d0f6-48f8-aca7-ac3ab7f0d7c4", "comment": "Malware payload", "value": "563492d8f81e0164afd4b93e326e85cc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "f255b4e2-7570-41c0-b913-730e659e4195", "comment": "Malware payload", "value": "7f8910226db6aab48a211e8c5b45c9692d7b49d8e4c6a76848079a4ebab3904e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "3ac2377b-2def-4821-9c31-c839a67e9abe", "comment": "Malware payload", "value": "9a2aafdb14d2b7b06bb1cedaa8463292f10a06f6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "42f6e958-d4db-431f-8919-0b80996e124c", "comment": "Malware payload", "value": "27855f9135c3e829444fc893b260e90e40042b766d0c5352c3ce61f7d82cfee9956c6446d889f68f4490f8b5cbf4731c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "def58fc1-c7fc-431a-a448-6b894260a7e0", "value": "T1A4761A57B8924942C4D43A37B8BE81C432634EBE9BC7165B6D05EE383EBE1D90E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "cfa1520f-fcf6-41a0-bcf0-1f999b548e4f", "value": "49152:rMkbZlANcv51zbudn5xvRGLT7dUfjiCdniho/yMImLPUFskMRVV5E0:gkoNinup5xvRGLTBCts6PUFskMVrE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213461, "uuid": "6c96c9d2-7426-439d-b632-62117301baac", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213461, "uuid": "d646b610-238f-4cb6-b28b-aed37a352bcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "e32d6893-8a1e-48fb-b7b2-ecfac78f1b7e", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d17f9a-5cf7-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1780235433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235433, "uuid": "7aa50d4a-a769-4d36-878a-9c1da492f48b", "comment": "Malware payload (Amadey)", "value": "f0ec2d5f21bf218cbeb5db3ec4825927", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235433, "uuid": "506fa06f-9817-46de-8e85-98e188ced3a8", "comment": "Malware payload (Amadey)", "value": "80639be96575f3ef0da92679ef8271e48111a0209bbbdaee9657ff0501e8c4ed", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235433, "uuid": "ecab4a12-6edb-4101-ac68-831b9fefaa43", "comment": "Malware payload (Amadey)", "value": "3a543ffa778364fedd1b09e849553299ca2797c5", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235433, "uuid": "4c1a4f52-acba-420f-9f91-4d42c96a14e0", "comment": "Malware payload (Amadey)", "value": "e0f1c993b4a584cda6f9fadaf710f12930ffbcd10d9095f010e0b701061fb8bb6709bbf5caf09c8ed9f1bf9e48487ed2", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235433, "uuid": "559b05ee-7b4c-4e8a-be45-cc97cf7ebf73", "value": "T108D56A876C62E1E1D81972B368A341B17B24FC117B71A7F72E9861392F322C449F6F94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235433, "uuid": "b8ed4aea-5021-4422-99f5-835d7c8cd6e9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235433, "uuid": "32deb589-47f7-421e-b9da-397fe0f9debb", "value": "49152:/HR+M4hE2gjctiY45XdU014Rxi0HqqOGMt4e6NDTshY7qdF:/IxdNtS5NU0d6qqOGreSTuY7EF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780235433, "uuid": "426837ca-78dd-49df-ad6c-5dc8d2c27010", "value": 2872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780235433, "uuid": "204a676e-c8a1-4399-9a8d-97a6efe201d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235433, "uuid": "e790951c-6341-4ae0-946d-90e81ae93edd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793b18ee-5ceb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780230184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780230184, "uuid": "2f044ac0-dd64-4edd-ac8d-312cf3fc2300", "comment": "Malware payload (Mirai)", "value": "2539fe7b4b465c24bcb8c1f064e4097f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780230184, "uuid": "a5b856fe-a149-482c-a5fb-7b325aca2bae", "comment": "Malware payload (Mirai)", "value": "80d85d205aba7bdd4abd3fc9b91aed17d16fb5538a78b7241382fc5eb1e3f27f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780230184, "uuid": "6eb50d12-89ab-43bd-9bb1-4f7c41b5737a", "comment": "Malware payload (Mirai)", "value": "973fadb931925f4d32f6d185c8940b2cc8290899", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780230184, "uuid": "adc7e423-50b5-457a-ac12-fef308881177", "comment": "Malware payload (Mirai)", "value": "d569f55e700a6aa0e70b4226aa6aedad9768e78735db96fc50f78d5a2872a2d0b2e32afad7279ed948f9bbfdd3f04146", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780230184, "uuid": "700a3e09-962c-4633-a3ba-1d0a18a15fdc", "value": "T167243B45AA408F13C4D72BBAFB8F424533339B54D7E763069528AFB43B8779A4F62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780230184, "uuid": "e4790726-e90a-4751-bf0a-3f9b6f8b7540", "value": "6144:2QylbEzsS/Sex9HLartpvTa9R5jkCIeaZZ/M/RxXiNhgp:2QylbEx/x9HLaJpvTa9rQ17ZE//Chgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780230184, "uuid": "39f48293-1c51-44b0-a08b-c0a7911bb7f2", "value": 228305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780230184, "uuid": "f5d50117-2bd8-478f-96cd-62c5fe62e02f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780230184, "uuid": "fd9e53de-7be9-4024-aea3-4a7287fe4a89", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d26da84-5cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233492, "uuid": "2e3511e1-8806-4cb0-adab-237f8c8bd689", "comment": "Malware payload (Mirai)", "value": "f9f155e0a15b16cc95e6f2ed7911a9c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233492, "uuid": "7203daae-2ac2-40e8-bf3d-4ddc035367eb", "comment": "Malware payload (Mirai)", "value": "827b28b2fcd6370688459c0b166565147eb59af6aec83712c43f9ee9d449fbc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233492, "uuid": "0514c265-e26f-41fd-8cc0-f494061fde70", "comment": "Malware payload (Mirai)", "value": "469b1ae50758a609edc6fe4e163ea4290d769469", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233492, "uuid": "fda7cbc5-e597-4287-91c0-3f1296540438", "comment": "Malware payload (Mirai)", "value": "644be82949ea33a158ee98923d4b1c67a07dd9b24b62307fadc5a15d6dc66bcfb8c7f3cc97b01390584c1679d1e79741", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233492, "uuid": "ad1cc573-8b3d-4f68-90b7-6bd031478da4", "value": "T1C3D349C1F68B81F6D90B8C3060A7B73FCA32947940339B99EFA59E31CA375815617399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233492, "uuid": "ab1fca8a-13a5-40f2-bb56-427ed0b462ff", "value": "3072:2D03cgM5Zrs6zJweLg71yb7S0NbCNSCCXNy:93cgM5Zrs6zJweL7xJC/UNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233492, "uuid": "25fe66ed-dd16-4208-84d1-b542b9187e5d", "value": 132372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233492, "uuid": "3f7f9bcc-2487-4e38-b172-3bd9e3d76a2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233492, "uuid": "c297fd2d-f4c1-4a46-97b6-85617abb6903", "value": "023782pler.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d67a189-5cf9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780236070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236070, "uuid": "afbaf5bc-5936-4d48-a6a8-3b53986d1522", "comment": "Malware payload (Mirai)", "value": "56dc04137e597db3853ce1cd839f7b84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236070, "uuid": "67250cf0-64cf-4451-b56f-992cbb282733", "comment": "Malware payload (Mirai)", "value": "82a66b9d08da7e794c239e1e589d01c798b47a1691d0f53fc12fa5e9bed7cbf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236070, "uuid": "116354ac-2f2f-45ce-91ec-8edf910beba4", "comment": "Malware payload (Mirai)", "value": "d979d22abc1e78018976819eb7dd2db6b292bf1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236070, "uuid": "39b2b942-1996-4607-874a-69c6c04eed15", "comment": "Malware payload (Mirai)", "value": "76977a69cfa06469cd9e6697366848c915521d01ae16f07dc0675eaf70cdc92d5f582f3458482d2620c9194043f8bfcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236070, "uuid": "69f7deeb-0fe1-4739-ba2c-f6627c79e29f", "value": "T13DC34B43B68044FDC449C17453BF7A32D826F86E023A7297A7C4FD263D4DEA1262EB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236070, "uuid": "835047c5-3646-4b16-905d-34886dddb3c6", "value": "1536:EKhMoU35nVqA3sUkO47InzMGUCTueLdWAdOrUIW7W3hpN5mQ5NZqDXDMNHxAd:9hCpn3sUoInfUCTue8yOk7MhpN1wDax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780236070, "uuid": "5e31b1f2-78d5-4d48-ae42-b3f45d11380a", "value": 129040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780236070, "uuid": "e25cc074-4e9a-4a37-a2f4-ccf5d3cfe64a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236070, "uuid": "70e68b90-0a80-4fa8-b023-83d3b0921e5d", "value": "023782pler.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0892469-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250087, "uuid": "7ba18866-a83e-478a-abb0-d5460f738520", "comment": "Malware payload (Mirai)", "value": "91cc4721cf0e60e153672c55156bd1f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250087, "uuid": "c1ec4e25-074a-4e24-93bb-443382082cbb", "comment": "Malware payload (Mirai)", "value": "82b6eb8108d0ccb8dc62b36d24005d82dc7be46af0bca7d09b5c1cc273161d62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250087, "uuid": "78664f74-b048-4909-a13a-67fd8a53ae44", "comment": "Malware payload (Mirai)", "value": "2da1224f78025a530a13d3d91c68dcacded77871", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250087, "uuid": "9c61384a-271b-4629-944f-487755ae5d6c", "comment": "Malware payload (Mirai)", "value": "11a9f33f0ea494ec9199f2b119801ef8af0fe7263afb478943b53ea39ffb3e3cde51488f6c3fc0ce9483c015a2ac5be2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250087, "uuid": "675c3729-e449-4de8-88b3-d77db98505e0", "value": "T14EF2E0EBA5B18F8BE24B02742CCF95BE981112154048EAE5E9DD753F0CA5F182F1D3CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250087, "uuid": "04b9800c-e29a-40cf-a0a3-2d02de7e18cc", "value": "768:ArZlPsATea76oFGEDI75JEw3vImJ4Sw77dQnbcuyD7UoQRj6:SZxDea7R0ayQjSq7unouy8oyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250087, "uuid": "b01aa2f3-3035-47c4-bb24-80a00f310bad", "value": 34876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250087, "uuid": "3725702f-4419-4d63-ab6f-aabb790dd408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250087, "uuid": "085f4d7f-6fdc-4d5a-85fb-254434b7f972", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d30990-5d27-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780255837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255837, "uuid": "d4718c44-6bfd-4ef1-ad52-5b051fa07ec1", "comment": "Malware payload", "value": "ecc7f4fecc163b74b940dccd05f91f0e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255837, "uuid": "8ab9ba0e-2736-446c-9c5e-6138908bf944", "comment": "Malware payload", "value": "82d0ce260b0972f28db08a2e617eaa9b29f14494b431e00af7e9b0c53d8b2be0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255837, "uuid": "b04464c9-e1bd-4f82-b079-d1a92effe78d", "comment": "Malware payload", "value": "1e4396d44331be8b7f75c0856a8898496571b906", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255837, "uuid": "22eeccf1-4113-4491-a50d-b4dbb01d4c32", "comment": "Malware payload", "value": "063e1f4d03d4baf2f223bd19a1f849a6f2503d5cd534f1bd1fa7c056da3ea5b7034644d2d22b3caea973acbfed612e76", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255837, "uuid": "d328f698-29a0-4598-a9e4-05f84ffd8baa", "value": "T1C73141CD10E0F163D6A8DE00F575C144A84996C632EA3F1CECC57C21D8DA9867899BAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255837, "uuid": "ba62472d-a45d-44f5-aaf6-8f441c6f9f54", "value": "48:syDMn2WaS7N+CfWJY30fWaZ6EVyeYiizCvuY:ZZRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780255837, "uuid": "d975754f-3e30-4ab1-adad-5dbb47adbe2a", "value": 1725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780255837, "uuid": "d6a9a67a-5e55-4753-8e80-a601a92e82b7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255837, "uuid": "c71cbc56-2a24-4fe7-b141-fcfdb8bc8876", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ca5e70-5cf5-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1780234389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234389, "uuid": "89bd0e44-00e3-4748-969a-c440b8d63a92", "comment": "Malware payload (DonutLoader)", "value": "0dc04e389baec95881ca60055dd3146a", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234389, "uuid": "56d6cab1-3723-4478-90be-12a62da61740", "comment": "Malware payload (DonutLoader)", "value": "83e617a3ac17024976949ae0d20ea0610e2b58ed93986dbdbc08e47fb8ecaffa", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234389, "uuid": "dcfdb7a4-4c72-4559-952b-03487ba4e124", "comment": "Malware payload (DonutLoader)", "value": "9c0d3f68ede714f77b98c6338d629e1e7b66f47a", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234389, "uuid": "14822b4c-2855-484a-a044-7332eb47b8fd", "comment": "Malware payload (DonutLoader)", "value": "af0052b48be674bb8cc06a4d120388a207b42f5f086aa7e54a2be18a168542771796f5607a5a783a2cad56d8a1bb731f", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234389, "uuid": "2b00066f-0627-4b79-a625-47c11ca53309", "value": "T135310F4AD81AEFE21B1777FC6A549A64EC360A37881C8906764CCE483F0572D9284AF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234389, "uuid": "eb14acfe-4eb3-4565-86e2-74fc20cdf74d", "value": "24:68A/2+Qe43eOywCLbyMMGBXMxHqaGp0KP7Kp2rhJhxJ1EuKshwAJ+M/AaV7DLNv5:/gOe43+yfkMxG0w/hJhL1TKeA47DLNv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780234389, "uuid": "45c35d83-4a47-411e-8874-8443c566b00e", "value": 1515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780234389, "uuid": "86c9afa0-c474-43cf-aa0a-3f370e72995c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234389, "uuid": "8163353c-6fb6-4276-aa3b-a66a3797b10d", "value": "document.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33411d02-5cc2-11f1-a769-42010a9c0008", "comment": "Malware payload (SVCStealer)", "timestamp": 1780212457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212457, "uuid": "e9ba3699-d9eb-4c58-8667-4704f7216567", "comment": "Malware payload (SVCStealer)", "value": "87cc56afe121b414c7e0f4a23be93e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212457, "uuid": "b6d7041b-139a-4213-a7ec-f447cac7bd44", "comment": "Malware payload (SVCStealer)", "value": "8528d4120816d6bc2bbcc70b6945bebe0873ddfaa2d4a41032c04ccffdc0663a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212457, "uuid": "5d571f4a-136f-463a-8f21-b1982eae7325", "comment": "Malware payload (SVCStealer)", "value": "e73b81fca2ef7fda46ec392e50b6ca437e59d264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212457, "uuid": "b90e5241-48eb-479e-85a4-662180da8e4b", "comment": "Malware payload (SVCStealer)", "value": "24ac7320eaadcece6522251eaad5e88cba5e9ac4563371f682430ab672ce8359d1de7fbb03e047d1603da8328fcace41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212457, "uuid": "a16567ae-e692-40f9-ac5c-21e3517d5341", "value": "T153559E4AB2B400FCD557C178C5165A0FEBB278061374ABDF5298CA5A6F13FE11A7E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212457, "uuid": "914bb1c8-932d-4099-b329-6563290c150f", "value": "5f6a43a1159e2e41207b962a097e6db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212457, "uuid": "2ce2c8af-61e9-4153-9cae-ee3158c9bc09", "value": "24576:tF2+fPeS080OrBjWACMs9qpL5KImt0y+S5GUGgDy:KSKO9KACMsjhtIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212457, "uuid": "9f9dfd93-c4be-406e-a978-f647e336579d", "value": 1338368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212457, "uuid": "8cd4fbcc-86e7-4d35-b524-bbc475968738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212457, "uuid": "82bb3745-5482-4ec3-aa04-57c5142473bb", "value": "87cc56afe121b414c7e0f4a23be93e05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d03092-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "59525aef-4eed-493e-869d-58dfb06a9085", "comment": "Malware payload (Mirai)", "value": "8ef911359ffbcf9e2e22282ef8087000", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "e0a519f1-3853-4c4a-bc3b-c87a6ebfdbcf", "comment": "Malware payload (Mirai)", "value": "856d0ba434b020bb3b3f94f4e1bedca8a04c96c48a3aac7f9e1c51f416af8e05", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "51ee717d-decc-4ce2-83c8-4275ad038aac", "comment": "Malware payload (Mirai)", "value": "9cbe6317809cfe7336d11d1137b45f4c56f7fa38", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "415b229d-8a95-46ad-a93f-c27b9b818ae0", "comment": "Malware payload (Mirai)", "value": "ad61900072402aafcef74c15bdbcf507db661975e011b771adfa7ed9123b5357f23c5f23f0fe7d8b12b5f4d1c1f4d0e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "a09f68be-3905-4682-8d72-d45fcde733f9", "value": "T1BF933949F8815B11D5D522BAFA5E128E33635BBCE3EE7212ED105F2123CA96B0F77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "49dbadd3-41cd-4a65-93e9-1bd08e221fa9", "value": "1536:A0n7wnKTGMslsxzU+PuPiPgHMPnaXnKRmgTrbNlapi0PekLc9YkrU:TpT6lsxzdgHMPnaXnKRmVvP1Lc9VU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213643, "uuid": "8a4ec7bd-d83c-400e-ad31-e23779e33913", "value": 93312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213643, "uuid": "a6c099b0-9b71-45f9-9f76-8c0269c6df05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "2f48d080-5a63-4233-96b9-64e910862a0d", "value": "karm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe6c16f-5cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780212291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212291, "uuid": "d5c91fdd-f7ec-44f4-acb1-9ca6a4a02b0f", "comment": "Malware payload (Vidar)", "value": "731728f4d572bbf2b59be9ce55c643b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212291, "uuid": "63c32cb1-bf7f-450f-aa0e-2b646f69975c", "comment": "Malware payload (Vidar)", "value": "8575175da0c7ba320c70741a0977fe3e8ee35d251d82def1ef405eed34028b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212291, "uuid": "aa660cd7-94e5-4917-9166-44313654ca74", "comment": "Malware payload (Vidar)", "value": "b87fcc95002dbbb7d0f6012b3c6f4942b27b04f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212291, "uuid": "269e6fc8-1f5e-4cb3-9f5c-76058a308b98", "comment": "Malware payload (Vidar)", "value": "cca8cfc800e26e892a8c7e71b0b0666e68d3f7d19c99d1d6d32f090e50f52176b99afe6350e41d3c7dce6fb56966e0e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212291, "uuid": "bcf23cc4-0309-40c5-888f-cbd7eef9ad93", "value": "T1DAD55A87AC62E0E1C859B2B364A381757B64FC257B75A7F72A9C25341F322C048F5F94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212291, "uuid": "149ce20d-ad87-495e-8d68-bb9a0d3c745a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212291, "uuid": "1db16fa8-fcf4-4af6-a338-002e6ac80493", "value": "49152:bYL31MAdHemENaEbQO5IQzbWKrV77laFaSRIJqF:byXlSDbf5xbD6FIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212291, "uuid": "664c6f56-70f7-4996-84c2-89683afb24a6", "value": 2859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212291, "uuid": "8f8c77dd-a2e6-4e98-8f80-37904f264a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212291, "uuid": "891b3fd7-ca56-4795-a9c1-5481c617a356", "value": "__zst____r_64-v.5.416.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd572e15-5cc9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780215695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215695, "uuid": "c687bdf0-8920-436e-8a5f-c3e239244510", "comment": "Malware payload (Mirai)", "value": "e2c7ba8759c780d7eb38e549e662f79a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215695, "uuid": "ab0f2ec1-c9b2-4790-9283-2e8da90f33d3", "comment": "Malware payload (Mirai)", "value": "87edbe96605d35a2828ad32c09a926e2dcc6e8534a3abd91d62e59875afea487", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215695, "uuid": "7a6aa57f-f666-4733-894c-64c12e3fd197", "comment": "Malware payload (Mirai)", "value": "6c51bb7f8c32ab5b1072ed095d126f80a5f39a61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215695, "uuid": "a2e66b0f-15e0-4d5f-9c9f-43f06d23a0d1", "comment": "Malware payload (Mirai)", "value": "9b72fae22312090d9fc49bd2bccb7a178d60766189f797abe8ec93a698f47dfffa8e26b81975185f5aefa76335d47005", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215695, "uuid": "3132647d-0e91-4c00-83ea-5c340b280f1f", "value": "T11114A71E2E228F7DF668C73547B78E24976933D627E1D644E1ACC2141E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215695, "uuid": "6adba3ee-afd7-4e93-b548-2507f15dadfb", "value": "3072:vJpG82LxkATW0V+WS72QMVeflCWPId/5g48fxM:TG88XTW01SzMVefwPd24exM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780215695, "uuid": "a2dfca78-7c5f-4992-9931-40a62136ad61", "value": 198188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780215695, "uuid": "8cdcf109-ba13-49f3-9bdb-de07e83e5af5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215695, "uuid": "7b4acd72-e633-4fba-988e-dc827b81d9b8", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96344c18-5d2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257291, "uuid": "0f337486-6517-4a31-88f0-90287e709dbf", "comment": "Malware payload (Mirai)", "value": "ce06a8373315ac1bb4e77653d4fdd58f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257291, "uuid": "7487112b-8bfc-4b62-b88e-dfbc085765f4", "comment": "Malware payload (Mirai)", "value": "87f4392e809faae54583cd6e22f8947a2d5fcb04224a142ec8e3c882e3d7fc41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257291, "uuid": "6fe69f5c-40b2-4e45-b9f7-8d89504801b4", "comment": "Malware payload (Mirai)", "value": "d801bd8f654b851da6d9944636900594886579b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257291, "uuid": "a6d4b916-9354-4a55-9103-132fb04cb689", "comment": "Malware payload (Mirai)", "value": "69bf2819e797874b995dafb1e82d488d399c5cddf00adbe1d55c11bb0312fe679d7cae71c8f412acad1a9d582e5599bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257291, "uuid": "e95bfbe5-a8c2-4259-a7b3-690c4a13f364", "value": "T11ED30816B9919F12D5C331FAFB9E414933136FB8E3E97102DD206F54238A99B0F7A612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257291, "uuid": "d08d6f19-e00f-413e-9970-4dd532287818", "value": "3072:9qVOXi4Sc99Z1anAXZVZaw/ZFhrmorLVvvUU++8oJMIZSy:kOXRSu4A/Zaw/ZFhrmotvvK+3JNZSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257291, "uuid": "6a1edaba-48dd-4d2b-a783-6b5ecf75e44e", "value": 141572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257291, "uuid": "22b9b0b1-9897-4583-94e1-85f58792a8e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257291, "uuid": "c7a4a164-16cd-4f75-9ce1-7e3b2e7d67bd", "value": "data.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eadf664-5d13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780247293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780247293, "uuid": "bda4a5a2-cd84-4b1b-bdeb-5588f7183e5f", "comment": "Malware payload", "value": "9a0a7556ab12fed9702ba80208bfb1bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780247293, "uuid": "2ed0f3b4-2be5-4f19-832d-a789f1192857", "comment": "Malware payload", "value": "880d44bc4310c80017e14e1ffed543132168d7ec4bd2c8d9a76c82a9ac5368aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780247293, "uuid": "1aceba23-f4ad-4523-8087-1655b31dc342", "comment": "Malware payload", "value": "f0b0324adbf961a8c2f634d91a8c3863ef9ffc65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780247293, "uuid": "e39186a1-9193-4408-bfb5-25c28bf8b7c4", "comment": "Malware payload", "value": "e752691597fafb4cfaa7642fa10446ce3580a18096a236f13d21735f992686d0fe52f1e6e9fee0b50761762742749ece", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780247293, "uuid": "cfb14849-42cc-495c-8d04-9d16aea36443", "value": "T15AA5F857F49590E4C0EEE174C726A213BEA13499073437E36FA19AF11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780247293, "uuid": "0121544b-1b1b-4970-8d1c-da9e8167c934", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0E:cqYUQuVDt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780247293, "uuid": "a422fca2-2a36-4977-8034-6103ebfebc5f", "value": 2228224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780247293, "uuid": "033c3a65-bb31-47f5-a545-a3cea1d8218f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780247293, "uuid": "2a0ac533-2583-4727-bb82-c2d2cb7d1ab4", "value": "880d44bc4310c80017e14e1ffed543132168d7ec4bd2c8d9a76c82a9ac5368aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588690c0-5cc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780212520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212520, "uuid": "72100dbb-91d1-41f7-96b6-91aee7a293ff", "comment": "Malware payload (Mirai)", "value": "ca321a1ed48c4765ceb41184adfd22ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212520, "uuid": "840b3665-4725-4b9a-ae62-52d975e7c87d", "comment": "Malware payload (Mirai)", "value": "88b8605224a45ff308b49a18e557b4a24b011abd9c611103cda2ad6e81a67409", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212520, "uuid": "38c02ea6-7d62-4308-85e7-ef21aaf581ce", "comment": "Malware payload (Mirai)", "value": "f2f43f9124c83f5cba6812f3557eae61355f08ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212520, "uuid": "b3d429cb-b2df-4377-8d98-e1f6c3731dba", "comment": "Malware payload (Mirai)", "value": "df9d66465f500a7f0456c45fe6d7b2808ddfa4302a245b91eff18af66cb258f856b9573fccdafe3da2198706aaf84f62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212520, "uuid": "b3361706-37ad-422b-ae44-4146884c0c0f", "value": "T1FE932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212520, "uuid": "c8f14cf4-9b7c-4fe4-8b59-0ceac95b3acf", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs21:AGUJtkyYEETn0T32TDBf0nsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212520, "uuid": "33e785f5-98d6-4865-98bb-6816da67f5cd", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212520, "uuid": "5022a5b9-73b6-4444-9c58-fa5d4e32a335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212520, "uuid": "24e56a11-1167-4c34-9fc1-8647cab03299", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c428eb-5c84-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780186130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780186130, "uuid": "f96b284b-19b1-4a70-a275-9f0ca69bbe5d", "comment": "Malware payload (Mirai)", "value": "f2ba626b694874459670bafbb4f34f1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780186130, "uuid": "2407ad23-6a62-461a-9a7a-fccc7aad0a76", "comment": "Malware payload (Mirai)", "value": "8ac8f8437634eff0c1182e9abe3fbfe0ee22c69dc424455ce0e31edce8b69397", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780186130, "uuid": "b6c6745d-c09b-4223-8c03-38078969acab", "comment": "Malware payload (Mirai)", "value": "6def1355987f27d82c95ee60a80abde54cdb62eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780186130, "uuid": "17875d2f-e774-43ad-a5d4-97b2f5478f3d", "comment": "Malware payload (Mirai)", "value": "381f4eb84f102867d6db8765214ac982a29f38db06180746da43b759000c4276e1edc404ad6ae477999ab3a64293cc06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780186130, "uuid": "8d937ba6-67ed-4fba-8f14-c59fdfb75ebe", "value": "T19563290368A081FCC155C570AF7FA53BD623F43E1135AA8EBB947F267A4AD211E1F189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780186130, "uuid": "002aaefa-b2ac-4b10-984c-a2cede89f694", "value": "1536:RgCa8F1GyhS3oD+X2YLKu35mzu1/ZLZBY:RgCa8r4oe2YLRpmzu1BZBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780186130, "uuid": "39b8a9f4-85cc-42b2-93d9-b7922a6f1bf1", "value": 67872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780186130, "uuid": "1494a7a2-d668-4c73-b20e-b81110d736e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780186130, "uuid": "585e1ee4-6be4-48cc-826b-4f690436fa71", "value": "lmkjn.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579a6fb6-5d29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256756, "uuid": "2384915b-3c1e-4f55-b03d-4857adf24ddf", "comment": "Malware payload (Mirai)", "value": "ca41dc1824de7c488a9f0b626ffc1c2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256756, "uuid": "4659511c-d6fe-4447-b048-240caf35fc8d", "comment": "Malware payload (Mirai)", "value": "8b48fb335776e7d1f2804ad77d73e6786a53c2f68868780b60a92a1b8d5c73a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256756, "uuid": "49c97a24-67ef-4217-83e4-4ef981717670", "comment": "Malware payload (Mirai)", "value": "3c3ea94fee4d2257801e51b030e6628394e5b952", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256756, "uuid": "a076dffb-c8bf-419c-9d15-84d2208e1cd2", "comment": "Malware payload (Mirai)", "value": "fdd1237459028120063f4b238e1ad0536e2a196fda8fb9077d74b7312b8cdcbc991f139f43e8cf6893244ddbb5842833", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256756, "uuid": "f3639d72-1e5b-4be2-8f8b-b44672d09477", "value": "T147243A46EB404F13C4D627B9F69F42453333DB6493EB73069928ABB03BC779A4E62605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256756, "uuid": "dee288af-dba3-45c6-b457-aca6b28f02f7", "value": "6144:M2VemxroEhffa/JHDmRXcxFfBOuV/GSOxQ:M2QWoEhXa/JHDmR6d/oxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256756, "uuid": "d6de86fc-6b1b-4b6e-a81a-9e821b08eed4", "value": 222917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256756, "uuid": "0493e866-7e0a-4139-a2d5-e907c7673934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256756, "uuid": "645c1bc4-d6d2-48e1-a639-70161e059d5c", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643d3262-5cdb-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780223277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223277, "uuid": "e0999cfc-cf6d-4663-b3f6-a7a2d42b8dda", "comment": "Malware payload (ValleyRAT)", "value": "18ac377446f25e3b57d8b84cd81f1c69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stKCP", "colour": "#A5C96E", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223277, "uuid": "e25a87c1-1edb-4958-8b51-4c26339c411a", "comment": "Malware payload (ValleyRAT)", "value": "8d33791edb7a9744dba3df3b0b23435b495436a11aa72c7956599abbe56d1197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stKCP", "colour": "#A5C96E", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223277, "uuid": "a43723e1-4110-4964-b62b-57e9209a2bc5", "comment": "Malware payload (ValleyRAT)", "value": "ad2bf9574dc58976a04f3f3ca69bd76d552538f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stKCP", "colour": "#A5C96E", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223277, "uuid": "af1dcd0e-e5da-4933-8235-8ad543971005", "comment": "Malware payload (ValleyRAT)", "value": "0d8154fd0084bbd40b788cd959ece7a31cbb9ae610f540a66f4dbc3079f7018c306955c45dfcdc9d85770cf74f3eef4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stKCP", "colour": "#A5C96E", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223277, "uuid": "1d7bfa6b-94a4-4042-8e01-1d0f942245be", "value": "T1678673CAFC8124E4FAEF6A31721739B2812B2EB56E1574FE4490F19227374C26536D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223277, "uuid": "2e83a4ce-f2f7-44ea-9163-11aa2cb55021", "value": "c790dc3fa433a5ac26b0a82e4a56a25e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223277, "uuid": "2e672722-0ede-4a9d-bc70-979bb68db470", "value": "24576:ydoRfaNcevRx0555b55N5HIzLUQQYMgTmF1XIqwIGyZ0aC:ydoRKcGxJzLUtYMcmF1XIqwIGyZ0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780223277, "uuid": "e1cac614-b69a-434a-9964-b9936a2faf46", "value": 8068096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780223277, "uuid": "3db1427d-9e2b-4042-b259-7a0b8cbb4a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223277, "uuid": "beb7676a-3189-4a11-973d-83bd5f299500", "value": "BevySecurityHealthService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fe3394-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780271144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271144, "uuid": "c8763aee-6878-4150-8d8e-599bd21084b6", "comment": "Malware payload (Mirai)", "value": "4a770c63937ee323c173821d7ce14a39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271144, "uuid": "20497921-c154-4dd0-b01a-ba8b2f26c483", "comment": "Malware payload (Mirai)", "value": "8e41ee07a8fef4595b0849212ee5952502e0ff334fd645cf65707c929ad7dce9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271144, "uuid": "db955e3a-fa2b-48a9-be83-807048341e80", "comment": "Malware payload (Mirai)", "value": "4aa7d55ba68a480770ea07d25ebf8524b7f5dae2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271144, "uuid": "cb9c3b4b-b2bd-4faa-990e-b516a8f1e301", "comment": "Malware payload (Mirai)", "value": "656acd4be5eba0419d8382b4d661a2d1ad811412baf27b106e4f5432fda8194b173b6be51df352eeefd0c89c10bbadd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271144, "uuid": "2a13af6f-8acb-47b4-9fe7-0aca95717b95", "value": "T13DD306C7F900DAFAF81AE3374853440AB230BBA245925E333257357BED7A1950577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271144, "uuid": "7deb22b2-c207-425e-bde7-43f3750e125d", "value": "3072:axdkNU18YYgYc8vR3VDjbiOLPb7aoyirFkSnlOk:NNU1nYQ8vdLHyipb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271144, "uuid": "3586d3a9-a90d-4d6e-9e82-e3aaa2e0ed72", "value": 133476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271144, "uuid": "79027aa2-11e9-4350-8365-8e8f49628aad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271144, "uuid": "c4330070-a130-4a41-a5cd-3399aa89e246", "value": "gov.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bafbf4a-5d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780243556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780243556, "uuid": "89d056e5-d2cb-49b9-a528-59ed86fd2c18", "comment": "Malware payload (RemusStealer)", "value": "9a730a922bf92d60d2856d7f9a5fd03b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780243556, "uuid": "3ee95dba-3a0d-4e10-b79b-fceb86c2e356", "comment": "Malware payload (RemusStealer)", "value": "8ec1921fea266bab9d1357230bf637a52d2c7c875c388ffd38d1c8c2b5c1589e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780243556, "uuid": "97c9dbb7-ee75-48e7-b409-4e9b64a7f185", "comment": "Malware payload (RemusStealer)", "value": "26fcee2da1ef0b4a230afb43b084f420479a151c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780243556, "uuid": "3d9d5ff9-e236-4491-bc13-3ea59572e460", "comment": "Malware payload (RemusStealer)", "value": "f28393a544d72f786980b6bd0c50119f16084c0e0d5ed25417968238273431aa343147fe98c3b8e49e9e47eb218abf49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780243556, "uuid": "984b5e3d-4c07-4832-aa08-827883e4dfd3", "value": "T1CC7559477CC425B6D5FA923288B51291BB31F88A0B3127C72F55A2F92E777D80E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780243556, "uuid": "1a93f47e-fea1-4f88-9142-14afacdfac19", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780243556, "uuid": "7d085e74-cf10-4474-8bb8-c8cd70fa4d50", "value": "24576:hB4RFSSuXgjGzDy9MgrGasEiyk3ZJheSgk0Hksh+D1cC:hB0ASuXyeeKaKZOSgk07+D1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780243556, "uuid": "2d45687a-216d-4005-b9b5-141d6a6580a5", "value": 1632456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780243556, "uuid": "05eb502a-a629-4c74-9347-972056bc2135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780243556, "uuid": "61bb3e3e-45ef-4f6e-908e-ca51524c232c", "value": "InstallerX64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a267ba50-5d12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780247004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780247004, "uuid": "c3c64239-7615-498f-bbac-701bb9615d7f", "comment": "Malware payload", "value": "a1d9e7a76f7cc9926464f677318deb46", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780247004, "uuid": "ada87609-7326-4c2d-a7f7-44558dd64841", "comment": "Malware payload", "value": "8ed4d1a368ada7db7c22b472c357c9401a445c1155f8f455d209759df1f9884f", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780247004, "uuid": "c33c1ccb-e19b-459c-8c1c-fd4501173e7d", "comment": "Malware payload", "value": "d532ecb46dead7711121433799e8df6bda158e4f", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780247004, "uuid": "90f05b26-3c27-420b-99e7-3f6b5f390977", "comment": "Malware payload", "value": "4243b5f9953ac817b63dbd26a069fabdc79526c864aefc418a6fd84940c76e43aed4c2d44fbd9774ad06a59e8bbbae94", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780247004, "uuid": "aa594947-8860-4b02-93ba-1e14adfed1ed", "value": "T10996339996E411FEE4A3913D8C79C616E2A1BC120F52C9DB07F44F2B2F676E01C3D626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780247004, "uuid": "66376c30-58d8-4e84-93f8-5188f1baccf2", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780247004, "uuid": "16b9ce79-4bf3-42f7-8f67-ca4c82b8427d", "value": "196608:Rhtzt1Acj1xuBwB9drbdXQaN+MofR4RmhIuAEAHswqApCTFDE7Ex:BDAGx/hrbdXQfM6R4RmhIHswqAi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780247004, "uuid": "475f2927-05d2-4efe-a19b-2bc2d97ec1f4", "value": 8832289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780247004, "uuid": "1d31a9a4-150b-456d-8970-dfc36ccdb0d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780247004, "uuid": "8ce414ef-2c26-4d4d-b5ea-beaabce16a16", "value": "dama.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cf7b07-5d28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256571, "uuid": "46bbc4bb-7013-43ee-9797-3121db2bbcc8", "comment": "Malware payload (Mirai)", "value": "b012608cba00207ebf00608e6afa71cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256571, "uuid": "b4ffab8d-d4b4-4fb2-9493-b0d655aeb144", "comment": "Malware payload (Mirai)", "value": "9058fe91ade1ad133a48e2ecb46307496d955ed76ba1acd6aacb6a168a0a28c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256571, "uuid": "96a8867b-973d-4d18-9405-ca6ca9abfed7", "comment": "Malware payload (Mirai)", "value": "38166656be2c9a0774bd29f3eb856386ab4f582e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256571, "uuid": "95f64a7d-34e0-42e4-aab9-4ebd916ed334", "comment": "Malware payload (Mirai)", "value": "5d9dd634f1c8984622dab0ab7ca48cc9ad035b245a206ddca19c764956ee4d828d0e6c39aab00a9633d576cd7b04fcaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256571, "uuid": "ac5f5004-fd4c-47b5-b642-eea732be07c7", "value": "T167042B46F9518F13C5C751F7FBAE42883B266B7ED3EA3102DD256F6423864DA0E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256571, "uuid": "0850e29e-b151-4ef9-815b-72e7a86418bc", "value": "3072:oYMrCciiXL00KRViJ5KslFqY4Eny2hwJEkeLBxCky:oYiCciiXL0fwvKm4Y4Ey2haE3BxCky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256571, "uuid": "94638a3c-4541-433d-af20-c27ba1e84143", "value": 180092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256571, "uuid": "00ffaa74-b3ce-43a2-b39d-b840670e3f87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256571, "uuid": "73f20ffb-910f-431f-96f5-f5911b9282a1", "value": "wife.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a582887-5d28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256385, "uuid": "7410a0d5-0c4c-4484-ba71-b8e059dfb4e1", "comment": "Malware payload (Mirai)", "value": "8828a8d074b8626a2cd892e821fd12ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256385, "uuid": "db2c04ea-f6d6-4ade-807d-f026cfc5d9b3", "comment": "Malware payload (Mirai)", "value": "90bb21462f787e9aa6480713f3c0bbb8dffb83be277a5757c5a351852224ea03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256385, "uuid": "0f507216-2d23-435a-8a9a-13455c23142c", "comment": "Malware payload (Mirai)", "value": "ab29047feaa7cf8771ef879f842d345449b45f40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256385, "uuid": "cd711f5a-cc64-4c70-be31-9f6bed28bc69", "comment": "Malware payload (Mirai)", "value": "8410beca9a9d9ef10132a3bc9d467b5286136a4d2169c87961a23e6545dfc19bc9d311d3292e8b683f3d3971655fdcab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256385, "uuid": "90243de4-3bcf-4756-8a46-a605506daa3e", "value": "T10863021ED352356BF53756788B171F65A9970D37B803D24D1CAC9CC2CC8A0B77882B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256385, "uuid": "0be5ba29-e052-4adb-be9e-d289a81e3c9a", "value": "1536:/jCWsOOU47wqvDVmVbjviqblWxMmrfhSWjYz/Ic3WgJTQZ0V8Ze7U:/jjNOxsqJebjviq+D7TYgGRJTm0VUeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256385, "uuid": "3967bace-2c5b-4a3f-b4d8-717f84bab81e", "value": 69468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256385, "uuid": "41e8f773-569a-4f45-8207-815ea130a053", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256385, "uuid": "d3d60fd5-3ae2-435b-9ee6-bae77bec66f7", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc377509-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250161, "uuid": "9b39c8cf-eee6-462c-a438-bd63bb6d77f7", "comment": "Malware payload (Mirai)", "value": "5afd6782ea817fdf63e4635d4a5c4024", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250161, "uuid": "2fbb1a13-825b-454f-b8d9-101df3a10612", "comment": "Malware payload (Mirai)", "value": "9129e6336a56ddcf9d23ee5ac7bb425cf906ac2d143d91358080ab1c5c728e5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250161, "uuid": "46c05421-97b8-4557-b2c0-51e4429b890c", "comment": "Malware payload (Mirai)", "value": "511751ffd7b477ef52c0b915ceb0c99d69d60c10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250161, "uuid": "a29c9453-09ea-4463-9344-804ea30add4c", "comment": "Malware payload (Mirai)", "value": "7979c89865c4c2402878bc51dd509cab59d480efbf44861fd9ffe52e24466a878808c33d731fd99096cce48d3af87f2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250161, "uuid": "6cb1efba-b13b-44ee-bcdc-7b6433db0b04", "value": "T1AEC3C50ABF950FBBDC9BCC370AE92B05288D665722B97B367930D818B54B24F55D3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250161, "uuid": "cfdd4f71-15f7-4ba9-970d-980ce11ca6c6", "value": "1536:ZwH9TgukJYcicQtm+VoNOUqK6AEdggeTI6laKENeP5IZ4k886ZEEvZ335iE0:qH9TgjJYhDtm+VoNO/YlaCk886/4E0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250161, "uuid": "e71d710c-9cea-4280-8ede-f694e159658f", "value": 130000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250161, "uuid": "addeaa42-e688-4f05-b064-0741503a997d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250161, "uuid": "15d47b25-9eb5-477e-bc72-4dc7229bd0c4", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016ce036-5cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780236426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236426, "uuid": "d7f06a40-307c-4ac4-868e-068220100bdf", "comment": "Malware payload (Mirai)", "value": "61b319ed83f2fd09c0f5738d3cb35dcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236426, "uuid": "34feefae-cd20-482f-a53e-b741ce2d963b", "comment": "Malware payload (Mirai)", "value": "95077aa12ee9e710746f896a03728e2bbd0199eb24d228ffc9254f8721e0684b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236426, "uuid": "8f2008af-8334-4bbe-8694-b25bfa537315", "comment": "Malware payload (Mirai)", "value": "03cbb282c79d80a873aa5bffe3ee9add93e79f9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236426, "uuid": "ad0e0c20-4fba-4e12-8c01-d04f8e77e35e", "comment": "Malware payload (Mirai)", "value": "eb47271f0ff7b37f66e16402bc868d94d3871f5268a5fdcfcde445b6f9a8c373cad9497d7d3e297fb87432a62c5a4887", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236426, "uuid": "7fefec4d-ac64-43bb-bc1c-cf06112632b3", "value": "T114A2082346BA6E07C4D0B7BB11935763A2EB9FD40160D71FBE081C8E9EA53401E3E794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236426, "uuid": "140eec08-9ce9-4bf1-b9c4-cf3c9359b9b3", "value": "384:2ZGchiVq0Go9Lf+zjmDfthVGs0E7a9UyfBm4uMF3hq0oW61APzt:ip7o9Lf+AthMs0o+fBmbS3RO1APzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780236426, "uuid": "1e767988-0af3-4ae7-bb57-4dc519316078", "value": 22140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780236426, "uuid": "40e248b9-c00e-47e8-9bc0-c33db9cd2751", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236426, "uuid": "26ddfa2e-e3fd-49fd-807d-6e8fddaf75a9", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d391dca4-5cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780212297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212297, "uuid": "179bc760-111c-45fe-8123-b6eff8ba46f0", "comment": "Malware payload (Mirai)", "value": "dae0b029e003c720eb349a2b21226c79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212297, "uuid": "dc197d49-21ac-44c6-be8c-1770d056a669", "comment": "Malware payload (Mirai)", "value": "960ee52e7b3231f0907a967df33019f222e3a23a1540652a3e2fbde7b8739773", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212297, "uuid": "4d0b1ecd-3762-4630-8eda-6d7b0ad52d66", "comment": "Malware payload (Mirai)", "value": "914d802cda1e6c6aa34c80a5d4c8ef3ab56bb4f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212297, "uuid": "d8317f6e-0611-4f1f-8840-9db5decfea9d", "comment": "Malware payload (Mirai)", "value": "0140b2cab85432d1b92c2c3464cf48861635ac4dc2efd538de44b292d7739c876cab61517a91eecdb53cffb408ee1f44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212297, "uuid": "26b03ae7-372c-4d3e-8757-4be7b3d4b221", "value": "T1F45301DEB9DCED8DC9CD2EF54BC6FAB008889706739D82ACB393144CA71DD5968525C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212297, "uuid": "ce722b79-7a43-4c45-adfa-cd2181dca762", "value": "1536:yk1ii9OTXSwsEX1p0WHUPc2ssNkDnB+IQ2JjZ6+L:91itxX1p0W0Pc2ss+xjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212297, "uuid": "4e26afcc-0610-4ed6-b77f-25ff50aeff74", "value": 62692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212297, "uuid": "9a2ad69a-1f74-4cb2-b365-8555bacc314f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212297, "uuid": "6acd15b7-5fca-4654-a431-06ee4c0cdd79", "value": "micro.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ce9b23-5cc9-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780215651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215651, "uuid": "e29d0748-3d59-406c-b705-2b8107267eff", "comment": "Malware payload (SalatStealer)", "value": "a6f909b80f8f1c06c804f08b74b7cdb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215651, "uuid": "a2f4affa-8362-48e1-9122-6f8bd28e75eb", "comment": "Malware payload (SalatStealer)", "value": "96a9bb4f5110e49dd8165b977114de448e356ff2897e43f1d639fd42d960497a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215651, "uuid": "1ae856b6-e8b3-47dc-ab8c-e53b7e8a8046", "comment": "Malware payload (SalatStealer)", "value": "580ae3f1d51159cfa08be485b2dc861d0b14fe6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215651, "uuid": "084f5fea-5972-4a59-9c32-69dbbd7f3db7", "comment": "Malware payload (SalatStealer)", "value": "9e4522feb5a2f3761d1b1b37bf7fcf26bdd17f2c9152f79a0b3effb25bcb33b00f4d0d3d22b0fa169eb6ffbe792fe3aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215651, "uuid": "9e327bc9-bc63-4b2e-bb4a-2d98289b4d06", "value": "T190C66B11FADB95F2E903583101ABB37F23315D048B28CB9BEB547B2AF8776A11D66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215651, "uuid": "3b095131-2e8a-469c-9b69-51abd1c4c680", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215651, "uuid": "58cf003a-79f0-4b25-b233-2cd613577491", "value": "98304:KwYfUXSjt1C7mW35iCVJn453HoU1EHO/:0U+gm6Eip/1HO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780215651, "uuid": "3b1c157e-6ea2-4f7c-8966-5b7946e91e89", "value": 12573696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780215651, "uuid": "1acb2ac4-26fc-48e0-a24a-ec21e372a66d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215651, "uuid": "e96574b6-fda2-40cb-97ef-5590a0490a30", "value": "winwsdriver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bdca05-5cc3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780212993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212993, "uuid": "0add6402-fc88-4402-8c04-f61fe5db39a8", "comment": "Malware payload (Mirai)", "value": "7f8c42d08c7ac8a62daf057d8de78618", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212993, "uuid": "6e7b6618-0eec-4c77-8ee9-4a37e8908515", "comment": "Malware payload (Mirai)", "value": "96b88c13ba8a6aa5057111787cf73d1436b8ac42587d34250ef28f97afdada75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212993, "uuid": "56e80da1-1d9d-4945-9705-cdbb5e5320ad", "comment": "Malware payload (Mirai)", "value": "1f0730ba5888934ac164b64b3a2e61150cf6dd43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212993, "uuid": "e96f3c44-7afd-4c3d-83a6-48cce5f244a9", "comment": "Malware payload (Mirai)", "value": "d4c76f0e7326184d8461e6000a9e8b7d5f01091205a466b83df1e26cc0b3a792fdb5f672ea8352a3caebe2c8bdab0a4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212993, "uuid": "dc987abb-a930-446f-bfa6-64934c78f708", "value": "T1CC13518CF869673FC3E273FEEB9952CE323A17D8678B7626C635425537C8314A825910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212993, "uuid": "9f56a24a-8ff4-46a4-9d92-bbddee72337e", "value": "768:7sJZSH6wx3wGwz6umOHbTD8URzEB67jkcxqHHHHQ/q:74SHbT4F5XDxpEU8Mqnw/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212993, "uuid": "497037cf-594d-4550-ad1d-1f57803249c1", "value": 43055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212993, "uuid": "51b98dee-2e0b-4b66-ade7-a3e604924193", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212993, "uuid": "42cf6036-2891-47db-b392-64435d95d143", "value": "7.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451a8e22-5cdd-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780224084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780224084, "uuid": "aa2eef0a-e03f-4c8e-862a-94befb1b5dfc", "comment": "Malware payload (ValleyRAT)", "value": "b88377ae7b0e6ecac57d5ce846abd8de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780224084, "uuid": "1ee29810-5db3-4bf5-a238-f75ee012a00c", "comment": "Malware payload (ValleyRAT)", "value": "97f9ee5981568817898cdc4a213e2c6efe019eae630e652b0eeb42195ccf6c4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780224084, "uuid": "9985bf2c-beb6-4fab-82b1-ecf8db75bf93", "comment": "Malware payload (ValleyRAT)", "value": "82d0d3ba10324e57da04c1a2bc68344fc46d49c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780224084, "uuid": "d551c893-e2d4-4f73-8139-34400f4c2143", "comment": "Malware payload (ValleyRAT)", "value": "70f25b24c6bf403cab6111ade0855b2478cc56cc865d119863085847b5d21497e35f8f0f3df1c25ba4d11ebba83da52b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780224084, "uuid": "ffda501e-5c40-4c02-aa2c-69addb7497fd", "value": "T19DF401F0E771B965F020D57CF89683753AF9DF605B318542A6617A3A293E2BC3C264E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780224084, "uuid": "e1d4c158-4990-4e6c-a47d-e64cadd5b980", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780224084, "uuid": "24f5c9e8-0039-4915-b618-9daa2bdd9807", "value": "12288:m6VI5ZoeUMStm8dw30gP2J5EVUYY4D7wIdYFCgenKcafSoHi//mI7U7:m6VcoeUMStm6w3YJSVU3E7ZY8gM/meW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780224084, "uuid": "8e66030b-eaf3-4255-839d-1b1803dc199f", "value": 773519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780224084, "uuid": "5c3f842f-bc46-4167-9e33-2cc875d1a367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780224084, "uuid": "933b75a7-7f81-4c09-a0c9-47966bf211ce", "value": "k\u76f4\u767b\u5668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49cadfd-5cc9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780215761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215761, "uuid": "aaeba6da-2af9-4f7a-b17a-a7a9aa76dfc0", "comment": "Malware payload", "value": "93a7d3aef2ac86c3c92ed9b3b1520ae9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215761, "uuid": "dc5600af-e749-45e4-9094-da5219444c68", "comment": "Malware payload", "value": "983a9ee1284b3d3d3d3dca95c240005c2ba171ae45b5c19225df3ba8799030eb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215761, "uuid": "93421fd4-573c-4bd6-92ad-c2ec3e3268b3", "comment": "Malware payload", "value": "0573a7082c50e5bcb3b6b8b3ae6f8d4fd60b9928", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215761, "uuid": "02a786f2-6681-4f39-a9a1-96e6eb83dac1", "comment": "Malware payload", "value": "f1de14c7f1259bcf22c838d4d1078f618ac9cd292b3623c404368fe11f4d7507f09bca3d2e2e6b1b45a637129fed9e2e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215761, "uuid": "d4e9dc28-993d-4232-989e-4b4ce2b75651", "value": "T15A137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215761, "uuid": "040bdfe5-e8b8-422c-bac0-63f34918119a", "value": "768:N+J9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:N+Ccy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780215761, "uuid": "6bd77704-737c-4eec-86ec-4f353c7e6e1b", "value": 45510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780215761, "uuid": "cdc8f06c-c3c8-4a5b-84a3-8c5f90c67f3f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215761, "uuid": "d8d2922c-a38f-4c1e-bec2-b135de0b9f7f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fcd1a2-5cee-11f1-a769-42010a9c0008", "comment": "Malware payload (OverlordRAT)", "timestamp": 1780231578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780231578, "uuid": "94264d29-8834-44cf-a7ae-9d71b7016157", "comment": "Malware payload (OverlordRAT)", "value": "c0b738780669e7935b3962e6f46eeceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780231578, "uuid": "bdae8141-b5ac-454a-90ec-bbf9f809740b", "comment": "Malware payload (OverlordRAT)", "value": "9a1b80b37fbaff0e30ce1666b4a7cb8db864eb4247f09fd45ed1a63ae353a784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780231578, "uuid": "a70139c1-fa1d-4556-b264-b227c4dbf2ee", "comment": "Malware payload (OverlordRAT)", "value": "34f7498e5ca7ec8172e43dd242ee71b0344c0d0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780231578, "uuid": "c2a21c15-bea1-4201-8615-a9a5ca4970cd", "comment": "Malware payload (OverlordRAT)", "value": "c22d89a8bcb1e1a55b5188b9d64deda68f9c2a7fb48d7d77b2ea6d5796fd52a389a02ca0b284e040819f01886c76d08f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780231578, "uuid": "ee22fe92-c8c8-4a01-97e4-dc8231a729ce", "value": "T106A6339E6256DC13C8D61FF148A0E3B34B340C91E921C61AEBE9BC87B9E73F61B15046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780231578, "uuid": "e450bbcc-ae1a-4e47-bcd2-c135963a850c", "value": "196608:dQoJQfo5vlwPAqEXiZhn0/dP2GAV5s5gkIAdD9SHqygLc0nZy9FQVwubp927:dQo6Q5HqEy7n0VPlsC5gvAdEeSywuV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780231578, "uuid": "3569f231-b395-4ac6-859c-163b7d4053f8", "value": 10186752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780231578, "uuid": "6d0a015d-be8c-4064-b83c-c8459fcd92d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780231578, "uuid": "9fb08a63-7548-4bae-bdf7-8bee3b79c5bc", "value": "AetherBeast.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb82d73f-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250079, "uuid": "218e95b8-51ef-4580-9de9-d6ea8ae8c195", "comment": "Malware payload (Mirai)", "value": "13411b797eba9976b04e83b24c483562", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250079, "uuid": "7c409d0d-7924-4065-a597-b351c3cb761f", "comment": "Malware payload (Mirai)", "value": "9a1f87886065530d0e112292c7e00161033c1d923be4b2a58ba09407e2f2f5d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250079, "uuid": "2fe04d1a-1b96-4229-8f65-06edf0e41021", "comment": "Malware payload (Mirai)", "value": "72e2a7e0a4590c886f1dad127df4dad5eac6ab44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250079, "uuid": "cce0ea73-a246-4f8a-aa84-1bbde0d6e6e5", "comment": "Malware payload (Mirai)", "value": "cc851f98b4a4c251cbdeb445ac1f6db94aac8de8da592bca8ed16eb4a7ed2dace85a61e9c29d2256f13958feda75fa7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250079, "uuid": "548baaeb-8527-4c1f-9f3a-70d8725d54cc", "value": "T180030264DA19AB30D7B19C72CBAC06DE37472632EB7F787B45830FD5C6E390619A0509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250079, "uuid": "2a4018d2-a828-4a5a-96da-b47d9f7ecbf9", "value": "768:cageCHBrN2iBfJfdhF9IJ8yueni9OECDKN0P0XQWKdee7PhwJWP9q3UELOU:cageCdNlfx9qJ8hPVDQ0XQpdDPx+Ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250079, "uuid": "d8d945b9-2122-4c52-a53d-ca923b7498e4", "value": 41392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250079, "uuid": "699daa56-151b-4e65-82bf-69900ac8d22d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250079, "uuid": "d26f9889-a46c-4654-bd58-a6635463a865", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1eb55b-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250085, "uuid": "5cc25436-5b2e-46b0-b690-271a9aa731c2", "comment": "Malware payload (Mirai)", "value": "c3a7912a1e341da3afbc99146990fa38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250085, "uuid": "894382bf-89bb-44da-b0ec-2d7c0be702fc", "comment": "Malware payload (Mirai)", "value": "9bb59f64c03c1dcc8850679572b3569be20c33f2f4d281398228a5fec13115af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250085, "uuid": "39090c33-a8d7-48ed-959d-22eaef181fc6", "comment": "Malware payload (Mirai)", "value": "a1c3ca339669845d3da82be4d6606310c5e780da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250085, "uuid": "fc24435d-7bfc-4a99-8a1f-849fffc719dc", "comment": "Malware payload (Mirai)", "value": "ab820fdd2bb52d2bf6784c54f7461d29c671d5a3a1f6508d7128fb1c1eb292eb187baeb30fec617fc378bd2afa57602c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250085, "uuid": "f3ec9e30-30b1-4890-96ff-ca201c98881b", "value": "T1F2A34A9AF801DE7CF80BDABA04170D0AF931A39116830B37676BFDA3BC721B55916D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250085, "uuid": "570cca3f-1ca2-42da-90bd-386613b75119", "value": "1536:NU6qhmloc/juH6qt8dr6ymO1MUVa5gqkGSEn7vFr3waXv:NLSc/6H6qvymO1WghGDNlXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250085, "uuid": "306af715-6044-4714-b504-407f2ed72805", "value": 106772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250085, "uuid": "67a4d6d9-f206-42f3-86e8-d3c726a40d06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250085, "uuid": "260f9c58-c83a-4c23-9fbd-399cbce2e7e6", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fceef341-5cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233841, "uuid": "f0aa22ac-b2ae-41d6-9ff3-7c41aa5a97c4", "comment": "Malware payload (Mirai)", "value": "14c12e43f45847cac1d93257268d58e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233841, "uuid": "95a461de-2336-4c7e-a8c2-c4ef5eeb841e", "comment": "Malware payload (Mirai)", "value": "9e26c831143dad2a70af38a2d0173993443d06a59c430090f054a894db14a5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233841, "uuid": "f655e90c-c1ac-4a3c-a5a2-27af732150d3", "comment": "Malware payload (Mirai)", "value": "3bc72813e641a113010c181a2b9bf05481a0cc38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233841, "uuid": "daa48387-d1da-4822-a09b-7f43a3443187", "comment": "Malware payload (Mirai)", "value": "6d73c1ad63143b4f31d1d62a19f2266f84df6d1635c3f13a75c5c20c8d980f14baa0266e8be099ad9859874be4dbf778", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233841, "uuid": "b63a8f0d-3341-4d09-bff5-f31044168ac9", "value": "T1E3E34907B9C184FDC8DAC2744BBFB13BE932F05D1238B25B27D4AA262E4DE301A6D555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233841, "uuid": "fc87d36a-76c1-4870-a0c6-d37242349f6a", "value": "3072:oIKTn0aoPu/maG+1jRBaD7qAEbanT+nZithW9y170wa:odn0aoPu/mKnZeJfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233841, "uuid": "5ff3211e-9f31-4008-8256-0d33773b4eb2", "value": 154456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233841, "uuid": "568f6689-88e9-4c98-9409-5c83a9e9b2f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233841, "uuid": "bd50842c-2025-4369-b8df-013d067bc15c", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7390ad-5d2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780258191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258191, "uuid": "267951bf-deaf-47a5-9bd9-1c6987e9799f", "comment": "Malware payload (Mirai)", "value": "79ecc187299cd569c9c5413e8df33169", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258191, "uuid": "d1549923-6bd2-4ada-8129-5a839a9c0586", "comment": "Malware payload (Mirai)", "value": "9ead10f334a07a4e558f6c25ada2652c487431f4a7bee8ea7c664477fd0c574f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258191, "uuid": "44731ca9-0dd7-4a49-9c25-573713c56ea5", "comment": "Malware payload (Mirai)", "value": "c50b15b3faa6de8bdba2761663c1a7561659bd01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258191, "uuid": "ead0c7e2-0ec4-48d9-8cfb-40fb1c8e788f", "comment": "Malware payload (Mirai)", "value": "cc2f4e3779e8f891b15a6304ebfd42d22fda7a0a55772dd368e0f4a91faf97490e5f6f6b276777a4e26b91de578eb54a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258191, "uuid": "d6ba5d6c-2776-44f8-9388-546ed8a26021", "value": "T1DA530215716C9D10FCCA963CA83AAF067D2CB46DE9186F46B4F2703C9CE5AA0AD1E905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258191, "uuid": "dcbe7f7a-cba7-464e-84f1-b4eb58b46106", "value": "1536:rYpTrRZjj+c2C4TRuztedS4NM9lzTuoBL4pu6DZpnouy8B8A:clll8uEd7Sl3uoBL76DToutB8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780258191, "uuid": "5047a004-e307-46a5-8361-ec2d48a6ec08", "value": 60932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780258191, "uuid": "8889aeec-71a3-4a46-a0ee-07ccb729f609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258191, "uuid": "640a05a4-7664-4eae-b162-15a144e6a0c2", "value": "wife.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7e7459-5cf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780234619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234619, "uuid": "ae754236-d6d0-4c75-950c-fd46c3e26b61", "comment": "Malware payload (Mirai)", "value": "2b88343cf6f23c274ac6f695f42b36e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234619, "uuid": "3160b5ed-4523-480c-8fa2-efbf6f9a5c81", "comment": "Malware payload (Mirai)", "value": "a07d9f4ec6ec082b328409b6e9b881d4d2f01ccfb9635e0013daf9eac495c16a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234619, "uuid": "3f42fb78-5277-4105-bffd-792eadaf88fa", "comment": "Malware payload (Mirai)", "value": "368d6e58d82d5da674ad5a6bf06743ed1f15fabc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234619, "uuid": "473137a3-a632-42b1-aa89-bd08dc1647af", "comment": "Malware payload (Mirai)", "value": "67721a63189cef8d00f529b9bfeefc14743726b86b1983cab52232eb0f27d178caa392cb6fb616e304ef619c7acc2d0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234619, "uuid": "f197926d-bfa3-4998-862f-4272870e6d06", "value": "T1D5735C89FBC3E0F4DD0705B1116BB77E8734DE121124CE5ADB94BE76AD32602A51A62C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234619, "uuid": "a5bce3a9-dbb5-437b-a16f-178deb3b2525", "value": "1536:g6xUarE2VlXRstx2FtAFartCnoSdkWMU131fMI1yAg0J6r:g6xpLRXFtAFESviFiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780234619, "uuid": "1ce64313-158c-4784-9a60-74bf1a4f6afe", "value": 79020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780234619, "uuid": "41216ee4-66cb-4e50-8119-852e3da21087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234619, "uuid": "294bd275-2c69-4b85-8695-aaac6ebf82d2", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d784df-5c90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780190906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780190906, "uuid": "a1d7a913-5cfb-402c-b4ba-bdca499a2cf4", "comment": "Malware payload", "value": "1b9bc4ddb5e2e7152080523905e07135", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780190906, "uuid": "efbbbc0b-36ed-41cc-8122-6e0d651dd47e", "comment": "Malware payload", "value": "a0bcbfcf6a6324d8879d05bbe7952147eaf4e2c957dcb80784d54ce60fbee8c5", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780190906, "uuid": "c47b51e3-53a6-4e53-8bee-a41364ef1e0d", "comment": "Malware payload", "value": "164f8e3a9ba7963b4b67234b78e0f39cce77de0a", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780190906, "uuid": "f4d80774-6a9d-442d-bd35-ccbb593ba4a9", "comment": "Malware payload", "value": "a0379881b9b77750100a68c3e080e3c6d4e90e239fca95aaf5d244860295ee301297f8771266e3bd42b1652383dd0290", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780190906, "uuid": "71894c8e-f78f-4bae-8183-f719c7246ed7", "value": "T191563325F99948FCC156D434C39F89235926B4CE1325F8FF428906692E2ABF53F3CA85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780190906, "uuid": "7f6ce8c0-cd53-4cd4-90bf-f7991f6ced48", "value": "614977bf86dd7ce26b9c10a6c9ac50fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780190906, "uuid": "529c1098-9860-4b03-9fb6-d87cb582507c", "value": "196608:JjxXCvtmhYgC38wkDPaPqJQXFKwuSezzA0HoK9:5cmhY58wmPaiJ2FKbBzA0o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780190906, "uuid": "b922db53-c6c7-4aab-988f-cbce0cdbe30b", "value": 6361132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780190906, "uuid": "8959c684-bccd-4a7d-b1a8-ce0ffb844a5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780190906, "uuid": "67e7a251-d0b2-4904-9184-2e7ff41e2982", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70060120-5cc9-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780215566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215566, "uuid": "92f014bc-ebd9-47ee-b493-2bc281d4a9d4", "comment": "Malware payload (SalatStealer)", "value": "d94447fd5b63b56f66f33a659f858d8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215566, "uuid": "7ab41ec0-de15-4af6-b2a0-ddac83142c2f", "comment": "Malware payload (SalatStealer)", "value": "a3a2fe509cb278c84202c7f6023db15692a1e501ea3dc6c46a1d45788cacd1f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215566, "uuid": "e6b4b036-9b0a-400f-aed7-e197552f3af0", "comment": "Malware payload (SalatStealer)", "value": "61e19cd16d2acd8c33ec1fdb4597be99a73cf2af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780215566, "uuid": "d1e75e0d-cd66-4579-81f3-a11975a184ed", "comment": "Malware payload (SalatStealer)", "value": "e4772ca76d5d5f251b69f455bbe2792237738a9f01b7fa92b9aebfdb2580cecbc943d3a8e8a7f7563b1853339769f724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215566, "uuid": "b9fb3a14-a512-4ad6-87ec-690462509300", "value": "T15FF533848F53F8F1CEEB37BD9C55D6BFE0C1249A962D74142E9F0C9E4312E81A06A1E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215566, "uuid": "45927ba0-5ac0-4c1d-b091-f26c653f9afe", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215566, "uuid": "305fe7e8-541d-444b-97f9-8549afb49de5", "value": "98304:gB+KsQfOFCuTgc5N1UPIUF/SkbtySj14scUEXoO/UCWRjTUwsqBY:I+BQfQh0cxUPIUVSkZp4syXoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780215566, "uuid": "213d7f80-d477-4e40-837d-66e215ba0103", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780215566, "uuid": "5a8fe952-b382-4dcc-a5b3-04e8b4b3475c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780215566, "uuid": "96dbc4e5-2910-4355-88c4-a73ec24bf5dc", "value": "winwsdriver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389f8705-5cc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780212466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212466, "uuid": "fa8295f5-d2e2-4011-bc9f-4ce3453f970f", "comment": "Malware payload (Mirai)", "value": "4c6e54477786df368e3c78842a6d41b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212466, "uuid": "29695858-c5df-4154-a613-4e557c2d0489", "comment": "Malware payload (Mirai)", "value": "a4421a2c454c3da5fe93237f6b5371ae00b4e8aff2c29e7a509b91ed5bc19381", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212466, "uuid": "10ab078a-2e1f-451e-842a-a786e6b5868a", "comment": "Malware payload (Mirai)", "value": "3317d7a64d4cac68a02fe0cc9191cf001f34a776", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212466, "uuid": "549242af-e80a-4330-ae6f-978f9ac64625", "comment": "Malware payload (Mirai)", "value": "f8fc7a5c59cfc8fc8704e14d3a689b35e932fefe9e6f32cd90fc35864ae68e18ce05bf5a562fcae3e9658bbfd7f9a824", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212466, "uuid": "ec6b955f-6da7-40c6-bab0-690d1ab0da48", "value": "T1D743E782BCD1995BC5E423BAA66E428D3325A7F8C2DF3717CC254B20378965F0D77A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212466, "uuid": "db4729ff-5b45-4e7b-8ae7-603f81582aa8", "value": "768:6ONXRg5juwtKUs/VLOCEuEaOX4/8z+9W9Jx2JOzbSQIRz/CuytxZtuccrtGk5YAD:6ZuwtKUqZEjXSWZ1IR+ZuGkWAVBd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212466, "uuid": "654b9502-0b67-4a79-b801-8f05fe5c4418", "value": 56436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212466, "uuid": "b26a714c-eddb-47bf-b1f9-56956cca4a0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212466, "uuid": "8d6caabb-4092-460e-bc93-622e40708a22", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5fa09f-5cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233491, "uuid": "063446b5-2226-4bad-b192-c69738e80ea6", "comment": "Malware payload (Mirai)", "value": "910dad794d959fc4a6c8063a6c6c91f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233491, "uuid": "17399182-79f6-47ed-9d80-f5c28eb8f35e", "comment": "Malware payload (Mirai)", "value": "a532a072687f5bd6f8f4c2fb1ce899a5d3c4264453fe2e7bafc270e83661c893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233491, "uuid": "86773240-b62b-4a7e-a482-2128a231f948", "comment": "Malware payload (Mirai)", "value": "35ae9bcfc1d9cb0f73d70ae287005d390efb885a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233491, "uuid": "66e96dbb-5011-4b62-894d-2b2227acea04", "comment": "Malware payload (Mirai)", "value": "29f319441c08079ebaebca77503ce3ce424e447ff781ca65c53f49b47ee8626b364f844f2a904c835ea62d46aea79a56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233491, "uuid": "3f117a88-5d3a-4202-ae5f-79a64e3d6678", "value": "T1EC246E46EA408E13C1D617BAB69F524A33339764D3EB73069D286FB4378679E0E77201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233491, "uuid": "d287628d-9324-4bf0-ab15-567782c51586", "value": "6144:aidWes4aDOYZGO2kRhtcGPkiu5hM/9tEty:aiIes4aDOYZGO2kbeVXG/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233491, "uuid": "622d4aca-d6e4-4448-8ef2-c6b2284eeae9", "value": 224461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233491, "uuid": "fb754b51-ca62-45dc-bc3a-b8c8665ec0a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233491, "uuid": "dbe41631-f95e-4e43-ae23-b908968a43f4", "value": "023782pler.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887335cc-5d2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780258556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258556, "uuid": "0d2a0aac-f556-4c87-b267-258bbbf68672", "comment": "Malware payload (Mirai)", "value": "e8f3550666ef075dbc30f6795baf4f96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258556, "uuid": "b71e554a-0676-4147-96a0-a8499f51520e", "comment": "Malware payload (Mirai)", "value": "a74490f7f69e7eb40e827f00ffcd1194861fde9bf94521ec004fd81e66d92779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258556, "uuid": "24791fcf-c7fc-405d-9a9b-b7d495d68cfe", "comment": "Malware payload (Mirai)", "value": "839726e198493634365b1a93739ef1ac04f98930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258556, "uuid": "bf9e618d-d879-47bd-9dc6-c0a73db9a5e1", "comment": "Malware payload (Mirai)", "value": "9acb07df58690c61705d2b5275229275f453fab7f07f88077e9f4956ea021ab935947dadb5b53140438f15e7e80e9495", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258556, "uuid": "66752804-ffbc-459e-9b73-24b9868f6137", "value": "T1A5E31956F9819F12D1C151BEFE0E128E73131B7CE2DE72129D246B747B8A8BB0E3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258556, "uuid": "ff8ce1ce-3991-41a7-b7cf-24f11f3b2ed5", "value": "3072:O2JfVt3jQ3R9AhtpaVHeb/NaEdjuBNV/msrK1ckJB1Dl:OQDUR0tpaVHE/NoBH/msAckll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780258556, "uuid": "3e569c8f-006b-46cd-953b-4457d9c7def0", "value": 146516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780258556, "uuid": "88ff481e-72b7-40d5-bb43-26a0bbb966d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258556, "uuid": "2560b3ad-c973-491b-82eb-2ffdce358f31", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425e8db4-5d09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780242977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780242977, "uuid": "a07f8419-ff28-49fb-b9b0-5f8795a132f0", "comment": "Malware payload", "value": "4bc46e77a091dd7a30845586afaee8bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780242977, "uuid": "f1aee4d3-0466-4ffc-bc68-0c49be2a3721", "comment": "Malware payload", "value": "a81079a9b9e6a032d2647ab909f78a4fc39ec171454e184b4831ebd0f92ce5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780242977, "uuid": "5f21a8db-65c2-4ec6-9c64-72b51fe71137", "comment": "Malware payload", "value": "9c1758a99ef8cd3c904c510d25c8e2785c3b9066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780242977, "uuid": "cf2f9ef4-6fdd-4337-a3be-e3488bef54dd", "comment": "Malware payload", "value": "17adf485c65bbe0377a4992e50e7dbe0f6706bece728dd1a1aac9dc345f5548d344aabce9682fcb307c92b9400b37a29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780242977, "uuid": "6b63791b-b2ac-4d18-8027-69b29126b29f", "value": "T1CAF623D7AEC9B2D4C4838E40539B47DD70F1A3DE06A6582D37CA7D02AA32E5B4749D23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780242977, "uuid": "24e6013c-9a44-40f5-b5fc-ebddb0bf772f", "value": "4250a7c95f4c97e273c0c7bba69af2d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780242977, "uuid": "4c23c5dc-73e0-46ee-99bf-eb074dd96907", "value": "393216:ty3pYXRjzLi369MqxssJulj3otoHtvjQ:A54Rf+K9M0sMK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780242977, "uuid": "32786dd5-2393-4046-a1aa-07c2cbc52813", "value": 16197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780242977, "uuid": "28ad4e1b-e660-4d88-996b-1257f5254bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780242977, "uuid": "e2e91126-9a30-48a4-9fa2-8e87abbb7d21", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357bdb1b-5c8a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780188409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188409, "uuid": "db483990-cae4-4bc6-9b14-80c436bb3339", "comment": "Malware payload (Mirai)", "value": "2d0463d82576beecf48fe8510a2ea78d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188409, "uuid": "256df42a-8a71-40c9-99d6-0f9d9877fa3c", "comment": "Malware payload (Mirai)", "value": "a82eaf0edf5a396668f2256ce059cf5ee6dd2eb1b91742d0626fa63e0c4de127", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188409, "uuid": "655f810f-5934-460c-9839-37ae9c2513f7", "comment": "Malware payload (Mirai)", "value": "a4f526b79e54e2ba615d083831f1d1946ec66e4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188409, "uuid": "c7dc3696-0686-47d6-b35a-44daa3171c2b", "comment": "Malware payload (Mirai)", "value": "983d6e75525f6bf8672e08e01a16d7cb79c7e95db109fb1662b119af3b0fea19cd9986a5da72baedf8d5c87d8d99e2bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188409, "uuid": "fae1a86d-6942-4fe7-b0c1-ea3724d1fa23", "value": "T154D38248ED68A73DC3E372FFE75902CE732A1B9877D671258E324A5637C8B95A434120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188409, "uuid": "4060a0e1-a126-4065-8a15-77e4ff8db2d2", "value": "3072:TfwjrYa8FQiNnQk13qVqyD76t9k7iDw1E06Hh5ZC5M5b2:YcUOf0E5C5M5b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780188409, "uuid": "0150c1a8-6ba4-4c86-a6a6-3563cbf5b585", "value": 131344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780188409, "uuid": "f4dfca97-9695-4d5d-b00e-b9c1e59a51d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188409, "uuid": "18e23031-a2a9-46e6-90d1-916273017db5", "value": "a82eaf0edf5a396668f2256ce059cf5ee6dd2eb1b91742d0626fa63e0c4de127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16182ce5-5ca2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780198665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780198665, "uuid": "8660113b-2c79-4f7d-8116-3e07fbba7f8f", "comment": "Malware payload (Mirai)", "value": "8b269c75e05a52068ad1e724436b6723", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780198665, "uuid": "3e98f7d1-1b99-424b-aa7c-7b71cbdd9259", "comment": "Malware payload (Mirai)", "value": "a99ebc872dd9b894ed778587e3df5728993682d154b95d78efd944faf5be9924", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780198665, "uuid": "b9b1b100-a98a-4534-a591-b93613f19cea", "comment": "Malware payload (Mirai)", "value": "cae6b50beeb3b0bcd92b99daeb49aa134552165a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780198665, "uuid": "c61a5479-2a3f-4aba-8582-39774c628279", "comment": "Malware payload (Mirai)", "value": "b2370ad68b6e5bdac2e8582a2b5808106601fdfc55699fb209941b70534619be65a1ff2622cf2d039d53ddd16196762d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780198665, "uuid": "eb9e0818-a0d4-453c-8f75-562d72c7fee6", "value": "T12C233C076481C0FDC9A6C2F45B7FA61BDA33F07F1235B65923E8BD26AE4DD211E1A148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780198665, "uuid": "65773c94-560b-43cf-ad19-e3d8e62ccf28", "value": "768:t+Cjdo18qax9QKfFv/CtVD/7vt9rsnKVHbx1pKVgrOUXU23qkpg8It:0CjdW8qC9rftCtVD/DtoKVHhKVAOwjG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780198665, "uuid": "1f0d3203-6c1f-45db-b03b-0e4ed611597f", "value": 47408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780198665, "uuid": "7eb2b341-1f8a-4620-851f-d169bccd1ef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780198665, "uuid": "67bfb7cc-e29c-4b1b-bf2c-dd8a517a526a", "value": "13.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e0420f-5d1a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250175, "uuid": "bf1bd82e-fd83-46f9-a8ab-513d54deba1b", "comment": "Malware payload (Mirai)", "value": "74e139eccbf1dadc08f803d1c371be2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250175, "uuid": "8967acf9-8383-46a5-b51d-9bbfd2009b38", "comment": "Malware payload (Mirai)", "value": "aa6f291f0992a55e84623f1889f5f574a408236b43476a1ddea2c0437152d286", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250175, "uuid": "04dfb47b-1ca3-4337-8358-85a375a920d4", "comment": "Malware payload (Mirai)", "value": "9768e01a3e85752f36f17c30487506f159493b97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250175, "uuid": "fab5c129-e23c-4eeb-8faa-10a4648498ee", "comment": "Malware payload (Mirai)", "value": "e0b7d25c18c59edeb218467d5d2bc53f4984595d3d738750a4ca37c03fc3ac48f65e92f0c3e0488e2ecf2ab69af404c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250175, "uuid": "9e10df8b-fdf6-46e6-bac8-62905dccf23d", "value": "T11DA34A02B35C0E13C1A34AB4253F67E587FEE9C121F4BA85290E8B5696B1E335489FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250175, "uuid": "670a000d-f784-496f-bc44-741af6ef6102", "value": "1536:qOWQrpaTe5zCGoreYkFTYmqO2YPgzUqcRisdImhcK60fn7:qOWgse5C5UBbqrY4qdItKvn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250175, "uuid": "549ef735-ccf7-4508-8c2b-e10fb864eac1", "value": 99744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250175, "uuid": "d5d90d89-a884-400c-b535-0fd56f7c7837", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250175, "uuid": "4e486897-5439-477a-a67a-21593f9c0a28", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55f9643-5c97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780194234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194234, "uuid": "f69fc019-801a-4e0c-8f99-fe7d2325a388", "comment": "Malware payload", "value": "7a3383b14ec217a992cf615f20c8aad5", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194234, "uuid": "13479989-9b8b-409a-b19a-5323f3d5aecc", "comment": "Malware payload", "value": "aa93d9b66e2fce334c05d53025d0201102ad000e57d541adb92c87c025c5e438", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194234, "uuid": "81909fd0-0ea6-4b24-83e5-76cd95e50589", "comment": "Malware payload", "value": "9691adf8be5d775a89628ed1af37553522ed86fa", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194234, "uuid": "2f3bca5b-b932-4933-8f25-8d236c431e26", "comment": "Malware payload", "value": "d1801d1508ca9ca71c7239f16f93c683b8c29a7facb138ac42e4ea363c7412b9239c66d4690e426ab41979544e60ec81", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194234, "uuid": "5257dc9f-ee4c-4127-bdfd-bdd205460b14", "value": "T1C3849F55FBA514F9E177C138CD634501EA71BC9E07A0A7CB23A44A961F37AE08E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194234, "uuid": "0fa8115a-b247-4493-bb0f-b5986815c828", "value": "ac731fce9e603310f7c1d30307044289", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194234, "uuid": "eabc7406-d75a-4960-be41-fe7dacf306d8", "value": "6144:nIyFUy+PO2C4rPTKExYcjHx4LQMTN3da7yDKRYnZWja2m:uXS4fsoHx4cE93Zft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780194234, "uuid": "ba209faf-a7c4-490a-8cba-33eff9b82c4c", "value": 405216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780194234, "uuid": "f2b736bc-e3d3-4bb9-a747-eef5aaa2b924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194234, "uuid": "11d4806e-816c-499e-a55f-98ce50c0ed10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b46ea8-5ce1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780225964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780225964, "uuid": "e543f1a4-0d6d-4659-b04a-3e8f53d699c8", "comment": "Malware payload", "value": "c05dbf7a4029ab03938eb1e8073c1d96", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780225964, "uuid": "7b2b6c68-4174-4f39-9ce4-5197520d3ee5", "comment": "Malware payload", "value": "aafff516a9b07e46e974f7a99aa78406c30492c1b927ec6a53709a81c574df2c", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780225964, "uuid": "0b94409d-ac99-4e5a-8890-5faed65c70a2", "comment": "Malware payload", "value": "1a3f1092ee59964bfb8c0b8cd97d071b1301cd62", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780225964, "uuid": "d3f416f1-2c4e-4ca7-9900-a7b88031901f", "comment": "Malware payload", "value": "35666d04f18c7e104e4131685d9b3450626f91fd1a766e517bd019eedcbd0e25223627844a3e30a897ddea15fb59d19a", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780225964, "uuid": "4c14642d-0b68-413d-ad16-deec4573a014", "value": "T1DD935CD463C1E50366CD1B93BF02BDEDE07BA8B568C8A54786A47A9C24BD507C2B4DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780225964, "uuid": "bbb53de1-665b-4ab3-a693-c117cfe1a6cf", "value": "1536:aaCdgx/s14HI5Emtwk+r+cIDep6gft2wyHrz3yw1jAIZ:avgqep6gfJyHrzh1jAIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780225964, "uuid": "143e5030-7efe-4f62-b887-cb6b8a6fecd2", "value": 92786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780225964, "uuid": "10e95bdf-3dcb-438d-b12f-198e7a7a7876", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780225964, "uuid": "9aa25b05-ebe5-4e6e-8d47-3e0d9e0171d6", "value": "main.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6be8a88-5cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233750, "uuid": "4cc0fe60-3cf6-41cd-a9a1-92a684393eb6", "comment": "Malware payload (Mirai)", "value": "3b2fc6d182a2e66c4bdb55a34b5cbeb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233750, "uuid": "f528ae9a-8760-440c-a773-63cad454d7f7", "comment": "Malware payload (Mirai)", "value": "ac179894414f1083488f8a906af85017c747c5870ad089cd90b9fba8d72f157d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233750, "uuid": "226e50d5-f51d-4058-a801-7cba6fda00bf", "comment": "Malware payload (Mirai)", "value": "6158c6589c009f9f4d61636f1bc83752471bbfd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233750, "uuid": "814d3e7e-6f7e-4a0e-b17c-1b249888ea36", "comment": "Malware payload (Mirai)", "value": "5fb992d55a2ddb0f167861534439c8986cb9b398577046f9dfd850b59f2effeaa84364d2ab4008655d1e34367aa3f8d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233750, "uuid": "b7059c6c-f292-4008-afb3-35b9fcc72d3a", "value": "T12BD35C86E753D4B6D8470BB401ABE7394631EC2213298E66E76CFFF15E216C2B145B2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233750, "uuid": "e55178f2-1933-4dd4-8447-dc1d5cb24977", "value": "1536:4Sgu4UV6B0hTcxMS7C6iq8ZvxgeYS8K7Ri/kArBAPUc31QGtcGq6fIr6F2oEu5RH:qu4V0yxNOLgermc3uhIIyBZ5R/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233750, "uuid": "0967f500-416e-448c-91b3-b7cb83f4dddc", "value": 131465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233750, "uuid": "9bb33ff9-4c33-460d-bcbb-993e180148e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233750, "uuid": "8a6c2303-e006-4ad4-abbc-bbdd912efec9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41132d7f-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780214199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214199, "uuid": "fd243c15-29c2-4bf9-bb80-154235a32805", "comment": "Malware payload (Mirai)", "value": "00c5bf8fb4517fa252424af6ad55da95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214199, "uuid": "7f9fe925-0881-4d07-9598-00868625f663", "comment": "Malware payload (Mirai)", "value": "ac5c9bc70821669e77e5936ad7d71525c8e9779132b18fb386283614c416f5bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214199, "uuid": "6b0ea86b-3ba3-45bf-8c8a-2900c7c3056d", "comment": "Malware payload (Mirai)", "value": "b8c21802db622a9c83f4b66753f8a25a63f770f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214199, "uuid": "cf4cc2e4-670b-4c95-a453-b61dad600e1e", "comment": "Malware payload (Mirai)", "value": "27b7385acf8f5f4d1c6aac2b83627d1f64e800ac602f10f86a8191a15f4275bffc265424fb5ae35703814afbd30ffeb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214199, "uuid": "482e0af8-d2db-4c06-9408-72c876b41747", "value": "T14313F151882FBA04CC3ED2BB1ADE7A6A010B9578A7870A7B8706351F9CDBF7071902D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214199, "uuid": "446c11d9-c7c5-4ffc-a68d-7c642b0ae439", "value": "768:+3LyYESr/wVYekSumh9BYV9RTGS82f6Gf0Rqb2P+4zjOnbcuyD7UtQRjP:2LBESsVhbYV90Shf6GfJd4zjOnouy8tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214199, "uuid": "5410e3f1-47b8-46b7-a2dd-ca304808f32e", "value": 44792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214199, "uuid": "f0500f50-ad8a-4be5-9ec6-361848c03666", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214199, "uuid": "8fd00220-1ab6-4541-8b9e-e67ea5bf4d55", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5e40e2-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250084, "uuid": "63f50f7a-ac94-4b9f-b197-c6484678866d", "comment": "Malware payload (Mirai)", "value": "6949101822dc8c0d3c35f826ed0dbe98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250084, "uuid": "9836df4d-4742-4f40-8bdd-4178754c4e2d", "comment": "Malware payload (Mirai)", "value": "acdd136213b46248f93c1f6220da9b0edec77039869a7960de45e89acab62a47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250084, "uuid": "046046de-094a-42e3-b54e-2943250e64ec", "comment": "Malware payload (Mirai)", "value": "860b1aa97f6cccf369e83ddeb4eef2b701f4d57a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250084, "uuid": "4414d618-462c-44e3-a453-786f850a44e8", "comment": "Malware payload (Mirai)", "value": "f75da15dbbcbd3621d959d76e0d9012c01e06f7ca4c5e4732c62e5057a1a544088e388be5a6b0bbd7092d7dd84aea9f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250084, "uuid": "83aef33d-2391-49eb-b099-827c5f1d1e6e", "value": "T1B9F2E1B0E7874EB5DF1BDAB48E96DE427B900F0853A36B4170858F051B07152A62BEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250084, "uuid": "7a31aea2-61c6-4deb-bf76-600ff280784b", "value": "768:leDVCKyXQlL4eutJvYoX6sE4528WzbGyHMvu9L4uVcqgw09Z:sDIKyXQlkeUBYoX64WHvM2N4u+qgw09Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250084, "uuid": "a0133457-e1d7-430d-9c1e-b458c6b239d9", "value": 35780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250084, "uuid": "65ac0296-9e47-4389-ba28-66db1da3e852", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250084, "uuid": "8b13f4ca-f13f-4f58-9d09-6a23b6701242", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46198d99-5cf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780234393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234393, "uuid": "e9924e9b-666f-44ed-9e96-9189d8e0e225", "comment": "Malware payload (Mirai)", "value": "6abed5fc8d1bec8eef4424071c1ce6a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234393, "uuid": "091a19ac-5b93-4e42-b59a-5a8d74297e15", "comment": "Malware payload (Mirai)", "value": "af40cd33cb040cc6fc2b57ee2db6c6bf1fe184dd8bc94ca1888ec8309acedd77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234393, "uuid": "fef9a92d-bc96-43bf-bd84-1235225e6b84", "comment": "Malware payload (Mirai)", "value": "9ccea3d046980e7f0337dca57f45a57aa9e050a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234393, "uuid": "49ef29a0-187f-4ba1-b14e-326f8543ba6c", "comment": "Malware payload (Mirai)", "value": "5426bc2b963f208bcd0c253312690188d6425255df9828beb09b0484d846e3c5a629e6b2258aeb9140d3d2c2aa5aebe3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234393, "uuid": "93177b87-8420-4513-94d0-8ecd1c8e0c55", "value": "T13D342A0775C08DFBC4C6CBB41BE7A1328933F8291722665BB798FD951F0DE986A1D604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234393, "uuid": "46b6ff5b-85a5-4745-afff-fbe785fb990e", "value": "6144:6ITvReiaJRvzIFlmMTGkmqHgPhqa0KHW73tNl/:6QvReXJlkmqHgPhqa0KHW73tNl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780234393, "uuid": "5d90b051-b640-4527-bb0b-83258774a677", "value": 243218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780234393, "uuid": "a928fd92-aae0-4051-856c-c5050a36db8c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234393, "uuid": "5404bd8d-b1da-422d-9ebf-db05a69e8388", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f92ed7b-5d0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780245254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245254, "uuid": "1bde5fb8-ecb7-4e4e-88fc-9652d3beff54", "comment": "Malware payload", "value": "3fe07b60d3f9d8a70d616d2cdfed2ba1", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245254, "uuid": "e2d90ad9-e0cb-4e7c-b15c-e98aa9b3c9e6", "comment": "Malware payload", "value": "af694f8e3d5f1eca4abb657c6c8c21a730488c4352649e6c9902556d08ea1bc2", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245254, "uuid": "ce0ce3ee-eb7e-43a9-a131-6138b19059ea", "comment": "Malware payload", "value": "42a491882d3cfa3e024e60268ddc698041161e13", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245254, "uuid": "859b07f3-f076-45cd-81d5-ead2bf425046", "comment": "Malware payload", "value": "d94ff5e8af0f0a5da2dc48e036473aa2dea42eeeaee3e74cde4ad1902f48e70556857e22b67390064c85bca504cbd84d", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245254, "uuid": "dd95f731-7788-4467-a378-71d51ebded2e", "value": "T14A08332879688326F5CA3CB625D3F435DB6DF9564A703819BD4C80F0B4E6F2056BC2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245254, "uuid": "0ce227e5-248f-4fe3-8623-24cf604634a8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245254, "uuid": "8d86fbeb-e378-4ec1-a1cf-e279beb4140c", "value": "1572864:ct9IKPKk94tlg4va/OfyTD6O20sXrUNUPT5Uv0pGXyevQnnAG7:cUKSk2lBvtfmg0erUNUPT5UvujevWnAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780245254, "uuid": "47459a2e-3314-42d1-8de1-15f3222b08f6", "value": 77469287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780245254, "uuid": "1c6e7847-6716-495e-94bc-2870cb143f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245254, "uuid": "256bc952-5515-4cfb-9c33-45614ffc3681", "value": "ExtremeInjector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3317c3d8-5d27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780255836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255836, "uuid": "690b2cc1-e560-4377-900f-bda861617acd", "comment": "Malware payload (Mirai)", "value": "fb771d0ae1d4061c70f62a41ecdd43c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255836, "uuid": "19e4337c-74fd-441f-8b1d-768f81e9811d", "comment": "Malware payload (Mirai)", "value": "b0039764484cd56c09da8eb2863407cb05428debc1fe02ec998013e1cfbca997", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255836, "uuid": "8703c2df-5dcc-4f9a-b85c-a2bdaca3643b", "comment": "Malware payload (Mirai)", "value": "8ed27a0d77b93cc68f5a6a056c07455a21e724e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255836, "uuid": "63c4759c-0cf4-44a0-9376-56301db3313a", "comment": "Malware payload (Mirai)", "value": "0ff07353910ff7d2070e26cbd64eb661048c3251621985d981e09353d8ed5c94a6d2863b61788eaae9d6793ac39a71da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255836, "uuid": "61c25b16-213d-4778-ac6f-a360b5624d38", "value": "T15053020F979A5C98CD383874E4DDEB3EA914E0C015DCA2C98B7578C1E79D5ABB04A374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255836, "uuid": "e88bdfc9-403f-4fa8-a14f-b96bbeb1d809", "value": "1536:coZP1igSyruLkI5QGW2CJPnyoaBs/OxRUMYa7otEN:vPMgSMuLtQYCJPny8i17oEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780255836, "uuid": "230d9155-4583-43ba-9f07-f426be91b789", "value": 65856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780255836, "uuid": "94cbf3fe-1da6-448a-9410-a9447023df83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255836, "uuid": "d1fbac2e-2096-49d3-98b3-bd86903baee3", "value": "micro.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb2abc9-5d1b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250858, "uuid": "4a577dda-243c-4edd-a932-d3f9e133c455", "comment": "Malware payload (Mirai)", "value": "a0c2b2de23a0e8c150218b855d77fb59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250858, "uuid": "cb9ed683-c589-4466-ac98-08f4b927abbd", "comment": "Malware payload (Mirai)", "value": "b13882d83b66160fa1fbf67786b9905560a21d8b6509fb6d08118d922c73c976", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250858, "uuid": "070d2adb-0df4-4f8b-b19f-0c0ffed34e41", "comment": "Malware payload (Mirai)", "value": "1343b2b3aecb182f04c024a66b42404bd53d6518", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250858, "uuid": "7bf53fd3-8448-41db-8ef0-794ddb7a275d", "comment": "Malware payload (Mirai)", "value": "09afca28896df5bf84769c5e151a31f5f38e126d1a6de54622cb97079d0d1c14dfefaa9bb4f4eff1c7a126bdd6b0f320", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250858, "uuid": "fad25a5c-a4b6-4780-b96f-1959a91bd4c0", "value": "T1FAB37DC5E643D4FAED0201B11176E732CB73F23A552AEE83D3A8AD32DC62641C51A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250858, "uuid": "bd5f3874-4975-403a-b68c-9d50d31bf765", "value": "1536:c7P+fyh0gYbXMkRBq6beVufRNGW/KNzDKtAIgQceV/OK5Gpx8EXS5R8n42F:c7oyh0gYbHqKNGGKNzDK6LeIKEpxti4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250858, "uuid": "7a315eb2-699b-49c7-bef2-37e2519b8290", "value": 112616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250858, "uuid": "bcc73aba-135f-4ca5-a4c0-e48e78af7728", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250858, "uuid": "53a5bb4a-86a7-496e-b72f-8b859e933e00", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fd15e1-5cf7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780235326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235326, "uuid": "7c7e4ccc-e3fe-4a5e-83d4-da1e3143105f", "comment": "Malware payload (Mirai)", "value": "b7df7a84575d2c85b1c974da9278cada", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235326, "uuid": "f25d49b2-ee43-4f4e-b773-6cc8db06fbd9", "comment": "Malware payload (Mirai)", "value": "b14fa022cf8ab81a47e265d3a7c0f09ef9bec0ec39f64e7db4940fbf305b65b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235326, "uuid": "bf9e46bc-5150-4dab-a617-5995e70391ee", "comment": "Malware payload (Mirai)", "value": "e65337a8ad6fb1e51f0f516cfde2b64c2fcff5ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235326, "uuid": "85af4152-6625-448d-a2c5-d51a986e8fd5", "comment": "Malware payload (Mirai)", "value": "d57196ee167c99bf38bfa0245168a80ed05cbd6c81ecdee78ed2120741ab04c8c54f49e802251e820d5d7daef84d0298", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235326, "uuid": "001385e3-90d7-4d0f-a294-964f095cc457", "value": "T10B244A02732D0943D15B2EF026BB17F183ABED5019A3A644F21EFE845372FB16549F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235326, "uuid": "b02b79e7-4383-411a-8a33-cfd91d0bae33", "value": "6144:9zSZGLvxBrcPPLYDm+mkq4+lhlZv1H0hjtatW:4ZGWPsD7mkq4+lhlZv1H0hjtatW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780235326, "uuid": "44091e7b-729b-4c2c-a385-afece4fa3370", "value": 218364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780235326, "uuid": "be461e7e-c5d9-4d3e-a1d4-86dc0f8b0c40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235326, "uuid": "9454263b-b160-450f-a83e-b0ec76e689ab", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ce9a97-5cc2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780212733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212733, "uuid": "0a331e55-c128-416c-a54a-2226c32a1c67", "comment": "Malware payload", "value": "069840ccb5bc5607f463acfba58b505a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212733, "uuid": "81f19850-f871-486f-9f5f-f0e6c963f061", "comment": "Malware payload", "value": "b222e23e63730b787a69f3a2bba858f79cbfec33f6846f127783816c62c00c75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212733, "uuid": "a35dff86-4f28-4d64-a804-b4bed1aed721", "comment": "Malware payload", "value": "d97db359fa994a8a5c664dd019bab9677a65191f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212733, "uuid": "d2a94f3e-e5db-4baf-bb6b-da3dba533d8d", "comment": "Malware payload", "value": "6f8a17bb8a7b50bfe456b4a60affe3bee0089804420c6a7e780067a3863688361ae43677166c6a79347977ab8270206c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212733, "uuid": "3d271555-decb-4647-b447-9e59d91f58e9", "value": "T11C32D616F3ED8322E5FF0FBC59F602011374B62B9A26E72E1DD904897D627088951BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212733, "uuid": "a25a4e55-9c1f-442f-a316-b144b13a3d65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212733, "uuid": "e69f0b08-4e85-4016-be48-c07b57b63943", "value": "192:gKaa0QNumkxfR/A/7pTiERP19c5KwqXA6B79p+uQmeO8vSU:kPxGR91KIv9QXO8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212733, "uuid": "fffd7e7f-a6fc-4f2b-b0a0-c9a9c53ac66a", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212733, "uuid": "68cfbaac-806b-45a7-93b0-a1f3073c7be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212733, "uuid": "3b2b6bb6-b893-4eea-a3fe-964a9cb6932f", "value": "SecuriteInfo.com.Variant.MSILHeracles.259769.113.27787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff986837-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780271212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271212, "uuid": "f16a00d9-b937-4a30-bfac-644679e0e62b", "comment": "Malware payload", "value": "b954a184cb6640d6b22f09529aa543ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271212, "uuid": "fa9c4b1d-b676-4e7e-b6bc-7db65f3d02d0", "comment": "Malware payload", "value": "b34671bd86c825a8aaf69b0e650eba69997a98658b2a63cf7b2bef8e3eb7603c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271212, "uuid": "784581af-a6b3-4d7a-a149-ddf525bdac17", "comment": "Malware payload", "value": "2c0715cadd181a965f0fd6e606587840121193b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271212, "uuid": "82344c6e-782e-4f00-baa7-978b26f31144", "comment": "Malware payload", "value": "96a93f62d1a2ac0089d0a0297ebcaf16365b0321c2f1f8fac4bdd9274ab1e4a75203e5f0668601befc9035843c781830", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271212, "uuid": "0884df3e-5e5f-4aef-85f9-fbdd08504230", "value": "T1D3C308177982CABFC497D1F44BEB98369D32F839093572597794BEA21F49DE02E1C220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271212, "uuid": "614a7db3-137f-482f-9502-1a261d632ed0", "value": "1536:4KCcv5AcBD6+sN0nRRThYZgjsed6jF9eRppRiCV4sDrMoOv3qTUZ:vtCcBDTRuBjF9exRiCV4eVOfq4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271212, "uuid": "53ac41fc-5bca-4454-b839-41bfc1d02a30", "value": 125280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271212, "uuid": "255ee049-d59c-4f82-ab45-9261621df1b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271212, "uuid": "9b888e27-79dd-4356-8561-ae9a840e0d59", "value": "gov.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606a651a-5d1c-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780251188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251188, "uuid": "98230021-b026-4590-8198-9019c7aea135", "comment": "Malware payload (Prometei)", "value": "928cd482b5e4b80f3895f92be4aa9d49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251188, "uuid": "3301b022-e213-4249-8e0f-e4928e620525", "comment": "Malware payload (Prometei)", "value": "b368d9253427ca82e74352f9587322833c614c360082c3d179adc98ccabda3b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251188, "uuid": "cfce53c9-15e1-4dc6-918d-4e41a4a0c557", "comment": "Malware payload (Prometei)", "value": "531f689804f616217d37c8080bb1cdc8596de022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251188, "uuid": "c1d767a7-86b6-4d3b-83f7-d6cc06d198ef", "comment": "Malware payload (Prometei)", "value": "accf37fa39501e81656bc5a6844e04ab703bf002252c69e634c2934986f25fc4ad501188465ba2d5a09fe7fcfca5e4df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251188, "uuid": "3ac365e6-7993-4820-baa4-af7ef7bea5cd", "value": "T105A423B4F9229E9F6DD76DB91B24831DE181C172589D4C2313AE94A34F3D632AF2CC16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251188, "uuid": "c7e99434-e745-4ab5-853b-354c230e2278", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdQ:Fs6pyCC/Ya2hpi6T6N4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780251188, "uuid": "3939e94a-3c26-4f50-97da-28b475554361", "value": 449082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780251188, "uuid": "da994c5b-6c03-454a-a9e2-59fb6bd754dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251188, "uuid": "f3368fe1-151d-4b6e-87d4-b4e62a9865a0", "value": "b368d9253427ca82e74352f9587322833c614c360082c3d179adc98ccabda3b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e7d01f-5d15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780248348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780248348, "uuid": "d6bfe4f6-ea19-4144-a57a-46196969c92f", "comment": "Malware payload (Mirai)", "value": "e7d5eaf89643b37b34d64afb69cc5fb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780248348, "uuid": "2ac8b3c2-db6c-4a5f-aabc-d083e3671184", "comment": "Malware payload (Mirai)", "value": "b37a16cc0e2bf402c45390f890f9c97dda1825b19b419af1dd56171ebc8ea8ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780248348, "uuid": "a227887c-5434-4757-b616-d6d433a45ee2", "comment": "Malware payload (Mirai)", "value": "079932786f2f4302b84522b533d970b227671ccf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780248348, "uuid": "10821095-2765-41b2-9f55-64f395548630", "comment": "Malware payload (Mirai)", "value": "8840f00bbbe4da6b01a15b28b6a634e7a5b783b53fbaf75b7c3c918adea979a09d91b04e906e8f6b101123b5fb2290cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780248348, "uuid": "4f651c5e-d3c1-4786-9704-5c01c45923b0", "value": "T184F34A17B9D184FDC9DAC1744BBFB13AE931B05D0238B26B27C4AE222E4DE301E6D655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780248348, "uuid": "43e0f992-8878-43a3-83d1-d35d9f3f2a3c", "value": "3072:xWPA5oc+Gm1usV/tVgs5QT8c0FxPjsK9Mkgk7sQA:xWPA5ocByVdjsKCpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780248348, "uuid": "8a275ce2-ad73-40d7-8a17-790f3767d951", "value": 160728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780248348, "uuid": "9c7e3268-c115-4037-8c01-7804efbd6975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780248348, "uuid": "97da8fa3-f174-4de9-8109-2ac03fdd1bd8", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c7c636-5cf7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780235201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235201, "uuid": "f9959e0c-1c8c-4678-a315-3865fb7215c5", "comment": "Malware payload (Mirai)", "value": "1d634f3f44d5652c29fa9375fea44177", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235201, "uuid": "73515792-ee7a-4974-8cad-283ffabe0724", "comment": "Malware payload (Mirai)", "value": "b38aff4c40d5977c9e8d7452bb2622fafd8f96c09dba94a233239ed5e516c877", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235201, "uuid": "c7b63348-6118-4855-88ca-d21963d3efe6", "comment": "Malware payload (Mirai)", "value": "3bd017012590fac1c4e584562e436d24a39426c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235201, "uuid": "1aa63143-78da-4ae4-bbbc-ee51175e5ff9", "comment": "Malware payload (Mirai)", "value": "b15d1cc0375ea0c892ac947f423d64b26f0d84545fdca70b88fb2e4221d3381d4b7d689dba5a3b4b3f375f5d339fd997", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235201, "uuid": "53655777-b115-4422-a758-13d5792f64a2", "value": "T154342B83B905DEBBF40EF77604D307357272FB654A430622B21BB9B5AA3A3D42426F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235201, "uuid": "14d3973b-a3e9-4da9-97cb-fe9049b87eb6", "value": "6144:7IXHAPCfgUC5Oy4A5At1kUhcwLUuoPvm5YRqH+lhfZn1H0nAtglW:78HqCJkvuoP2YRqH+lhfZn1H0nAtglW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780235201, "uuid": "95ec0df9-64ea-4192-a06a-180b1c154adf", "value": 237264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780235201, "uuid": "db7ef49e-dc7a-4bc0-a997-1627cf9ce844", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235201, "uuid": "f8871ec5-ae4e-4665-ba6e-acd56ab9905a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73a38dc-5d29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257024, "uuid": "8d22895e-f7a7-4e3a-aa5d-b53d16cd70f2", "comment": "Malware payload (Mirai)", "value": "028707e5002490e1e05eb6bbc0bf03a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257024, "uuid": "0a5aebcf-fa52-4c40-b225-2f8f875abfa4", "comment": "Malware payload (Mirai)", "value": "b3f808cbb30cb6e07965dfa1e5ab83188ee3145bd956d01a0af6409e17f3d2ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257024, "uuid": "c521183a-6ff2-4ffd-b148-ffe690b089b8", "comment": "Malware payload (Mirai)", "value": "5608ebc47c12644ca7b2981b566bee2ccfacb465", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257024, "uuid": "c7193ee4-9df7-4da5-855b-acc4c5301011", "comment": "Malware payload (Mirai)", "value": "6cf00a33e6ba40230fa169b83b258d2a77a9e8b28d843a3bc38476c780420c4b946d47996095486f1443667883963ae0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257024, "uuid": "81ab706a-f439-4ed4-a5f9-9c45d8311a9c", "value": "T1C4141883F901EE76F40BE37644A30806B630BFA359520AB671573CAFD97A0D5152BF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257024, "uuid": "37ad8ab3-a091-4bc0-a916-262854469968", "value": "3072:6+rx7qXd1Zo3UnhZXhBibyhekzGec7StBn73xmhOKRbV9jbiVL+WMw0eL2:Fx7qXHXxwyhzzGec7sBN2OKRyL3F0eK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257024, "uuid": "7a05aabb-822e-4816-8601-1963279e3c83", "value": 202536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257024, "uuid": "37397a4a-7f14-44ae-915a-da2f5a44da00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257024, "uuid": "92d6bb9a-3ae6-4980-9203-5a7999b7609e", "value": "wife.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6c0d04-5cf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mimic)", "timestamp": 1780234432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234432, "uuid": "75e92070-309d-41ed-a11d-4320840a5cf2", "comment": "Malware payload (Mimic)", "value": "d9c0acff321c0bbfaf27cb440e6ee9be", "object_relation": "md5", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "Mimic", "colour": "#32A529", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234432, "uuid": "dcd15020-2a2f-4d62-a925-dd55689db7d7", "comment": "Malware payload (Mimic)", "value": "b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc", "object_relation": "sha256", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "Mimic", "colour": "#32A529", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234432, "uuid": "bda91d14-17b8-4720-8e5e-fdf673b36fb5", "comment": "Malware payload (Mimic)", "value": "09ef304885e654bc8ad29ce51c989d13f07e7e0b", "object_relation": "sha1", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "Mimic", "colour": "#32A529", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234432, "uuid": "c89e1f6f-0c23-4475-a423-72c165b99781", "comment": "Malware payload (Mimic)", "value": "ba0089ea8304660f83caadf763c5ceab0fa172b287359866ee5c059da2cd17258d16f187867ac9285fec8378e938b7cc", "object_relation": "sha3-384", "Tag": [ { "name": "Encoder", "colour": "#6573A6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "filecoder", "colour": "#9867AA", "exportable": true, "hide_tag": false }, { "name": "Mimic", "colour": "#32A529", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234432, "uuid": "56098897-e59f-43d8-97f6-d1e86139aa6f", "value": "T16BB5D002FBC28172E193467491B6A77F8A3ABA249734C5C797D01D7989313C36A3F3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234432, "uuid": "26a6f721-cfd3-406e-98bf-1c7917212636", "value": "5db996f530c574ab3c34e6ed3f1396a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234432, "uuid": "422590e9-e1dc-4ad7-bf8e-fa3183b2adcf", "value": "49152:5lhR5no/qrf5EQlRUhNAw6IN0ny2C7OoZGtPENNCrRH96x9k484:5lhRuiVhG/o80ny2CnZGaHCv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780234432, "uuid": "a876f6f1-2396-4c53-ab91-48e720e58ca7", "value": 2393600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780234432, "uuid": "9c50eba0-93cb-4761-9a69-05c756902de3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234432, "uuid": "26f6898d-be48-4b87-9105-ab6319b8a72a", "value": "000_PP0_100-43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cb9dd7-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "d0207148-a87e-4d4a-84ba-a8ebc5e86be1", "comment": "Malware payload (Mirai)", "value": "d5a9a4239b73247f3d606202b8d84dba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "98187721-683d-4357-9ce6-a583a38932fe", "comment": "Malware payload (Mirai)", "value": "b4de2015f663758dc395524a2f16274a2d32925e71ff05f95c98e9b9cd755d66", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "2ab1525e-2d43-4cca-8f6a-330ef26af813", "comment": "Malware payload (Mirai)", "value": "c0b5f2b7cdc8c498d88de070dc3c0deaa1ff1997", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "ec1daf78-9829-42d4-8020-061b0137123a", "comment": "Malware payload (Mirai)", "value": "1adbe90786e637b7d7a03b3ede5acb93b65751f87787590b34bba04700ce7d39ac5c6c2497cc5582fe193297c4979934", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "bfa38c0c-73c1-47a6-b9ff-cf772a88b9be", "value": "T18F633B85BCC19612C6C4237AFA6E428D372A53ECD2EF7207AD159F2137CA96B0D77640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "aef3c35d-ddf7-4eb3-8ea8-8041b36b3b2d", "value": "1536:2V65i/3UfBHcNTgH/uLGfh2QvNQskBNwLwa2YZJBAe+66:2V65AUfGN4/uLGjvNQskDwLweZbAu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213643, "uuid": "3fb7ff7b-42d3-4349-8af2-5fe34bdc5a6a", "value": 66872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213643, "uuid": "15d85dc9-cb56-46ce-9d9c-9a865ef9034a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "e9be0b58-354b-4121-a8ad-cd4088dea7b9", "value": "karm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594d3739-5cc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780212521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212521, "uuid": "5e3c8123-25e4-42d3-821f-8b8f3223a2f4", "comment": "Malware payload (Mirai)", "value": "c45c84d5131ff8d4077699e6a72eebb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212521, "uuid": "dd2dc1d0-8552-40e8-a461-02c944a9a9f6", "comment": "Malware payload (Mirai)", "value": "b6390cdb45eb24738869b60f158e54678b7d1447bdd3b035697f91c175a1a705", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212521, "uuid": "9c80c890-bf6c-4ca1-89ca-3c66a622c47d", "comment": "Malware payload (Mirai)", "value": "8170c8270cfe219885da27af1e38350901b0dcff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212521, "uuid": "f723bcdc-50a8-443a-819d-809873139076", "comment": "Malware payload (Mirai)", "value": "0271b94191c3e8b90bd876d9b0805f25c836650b87b934a11b1d4dc353ab0b4213b2bd2570df20ad2be49ac7cacd24a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212521, "uuid": "8247fc7e-849c-4115-a021-4ddc647a3f3d", "value": "T1AFD37C73D879AF58C614D878B0708EB85BA3A46581470FBA29B7C2B94047DCDF5093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212521, "uuid": "929ee0b4-0dff-42df-89aa-7e0c516a7754", "value": "3072:JEK1YTPcrphl6ty6lRTwcI5/pnuyWuRgbFU:JEK1YTPczktP3Twcg9u/uabFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212521, "uuid": "17eee691-a67a-4cc5-8c7f-abc78130d4b1", "value": 134352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212521, "uuid": "aa67ec89-61ef-4ce0-bacf-299082e338da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212521, "uuid": "233a642c-7b79-4e13-9dd9-856558dc9973", "value": "micro.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30aa40ed-5cf2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233069, "uuid": "4e7f78e2-d6b5-497b-befb-bb0d39557dbc", "comment": "Malware payload (Mirai)", "value": "c341b26ae728e24835d91dbdb502b0a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233069, "uuid": "11525c42-121f-47a6-8cff-67efef049b57", "comment": "Malware payload (Mirai)", "value": "b6b62916ece6d4b0ab4c539ab374b49150ec865dc967b94d8ae0bccc5fda4930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233069, "uuid": "29b7fc07-dcd8-4b67-8eca-65977414fbff", "comment": "Malware payload (Mirai)", "value": "6d608181cd25d6c7d7f4c19be2b070cbd06579fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233069, "uuid": "9aae2e2f-a682-415e-b3e3-81bac81cfed8", "comment": "Malware payload (Mirai)", "value": "175af91a44c77bdef802701dcf93d9294c22276a4b5b9e87751efffa457998daccdced10a48c8ef72bfe573cc6e65bba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233069, "uuid": "a6f700f8-8275-4264-ad9a-f76ea79be18c", "value": "T14373F1854A1B59E2D8E064F8E259CB82838B3C7DF34FB4965830C92915CB9CD77CDA0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233069, "uuid": "a69b606e-a998-47ae-8283-7a37a0ad7a3c", "value": "1536:PHw84o4FxuPyrwl9GTA5Pnpfetjk6cVk1GwLjAC8WR3iKG5+LHm8OW:/who4wcw55P9e9B1GwLkC7iNGm8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233069, "uuid": "37807d5c-178f-4a39-b360-8eba840c961d", "value": 77436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233069, "uuid": "2be461ed-aa6f-4bf2-948b-48fd9519a587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233069, "uuid": "010d7829-b690-4df1-8275-bf3c99f4f336", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d2d034-5cc0-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780211728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211728, "uuid": "0bf4f6c2-c245-451e-b201-51d4bb36c38a", "comment": "Malware payload (Vidar)", "value": "780e7da647caea6e73fc0536dbc063c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211728, "uuid": "44cbafe1-f25e-4c3b-b4ca-45bb10de2ffb", "comment": "Malware payload (Vidar)", "value": "b778caa4f2a8996dc78d6411b6210c9dbde2a24fb11496b0d97c41484d801684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211728, "uuid": "3d150072-4dda-432d-a30f-9cf1d27b9aef", "comment": "Malware payload (Vidar)", "value": "44f387ec3a2e7026fd34e1f8a080f49a21372a25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211728, "uuid": "174fb1dc-83f3-4036-b123-3c60ba7d75cb", "comment": "Malware payload (Vidar)", "value": "bebbb28ea7ff25af4e2a1ee3f3481eb1a330c484f820f3879a5cb015ed929daacae0bb6204c10be7468049074857ff0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211728, "uuid": "43c78bff-3f86-4a16-a4a7-094bdc28b5c4", "value": "T117C59E1B7CE148EAC05A633289B661A17B74BC090F3253DB2E90B37C2F726E55D75B48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211728, "uuid": "5c53db05-d1f6-40c4-a533-cf4890565bb1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211728, "uuid": "518f977c-e065-42f2-8af1-657cbfe8df19", "value": "49152:ZRJY1T8LVk5B6iZkzlrYOhIxo4R4rf86fJXEF:ZUcu6iKzlsOeRRV8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780211728, "uuid": "313b45ba-ac8d-4dcc-9eb3-464ce5606fd4", "value": 2552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780211728, "uuid": "33c43f57-661b-4ce7-b897-55d54aebb623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211728, "uuid": "00caf930-474a-43ef-9e0e-5806e71102b7", "value": "b778caa4f2a8996dc78d6411b6210c9dbde2a24fb11496b0d97c41484d801684.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8c77fa-5cbb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780209602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780209602, "uuid": "2be7194f-cd0d-4a6d-a148-b36336bc0679", "comment": "Malware payload", "value": "0f84697bf55cfc0a7ba358aeef7ba8fd", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780209602, "uuid": "9165161c-4782-4b96-867b-d1c357cf8f8b", "comment": "Malware payload", "value": "b998cca475ffaa2c1de38ed62f62dc0e79dccd4f8f66edead6abaf74525ca0e0", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780209602, "uuid": "85b48a0a-c135-49e6-9bbc-bc5454a63218", "comment": "Malware payload", "value": "364854d784bfd046c57675b16970a30c0c611d9e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780209602, "uuid": "b923588f-c679-441b-bd9f-2848ac4dc2c8", "comment": "Malware payload", "value": "81727c9fd729b2a827752089f73173853701dc83e0c7b8e3fe846b0a9aaf4e1793572b1042b6a302d342685673702c9f", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780209602, "uuid": "48448e5b-1f06-45d3-bf8e-1736e48d2038", "value": "T12BD3AE1593A224FDC25A913566E353B2E973B8312336ABBF0758CE751F94C807F2E621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780209602, "uuid": "6d3b3858-d7e9-478a-a06d-0dcf6c7fec5f", "value": "c1f4184fc0d8e903ea01b5e3159c8812", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780209602, "uuid": "4e09e71b-7588-42b0-b8bc-f62ccf16de9a", "value": "3072:NrzbNBR6fevur9eELS9PiQsXxhTxKfpTdpN:NfzRsevur9e9ILvtKfpT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780209602, "uuid": "19a898e4-8fb1-4969-92a3-f220db19c11b", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780209602, "uuid": "b16c3483-f8b5-4a30-b8ef-dbac511c8ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780209602, "uuid": "8f96a795-c3a1-4f37-8c1d-3369cc1078ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124858e9-5d2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257929, "uuid": "d04752f0-97fc-4b1e-a0b1-5e6baf3fd5ab", "comment": "Malware payload (Mirai)", "value": "d28bacc00d710b4c45dd68b9fb2904af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257929, "uuid": "699e6a71-2ce2-4c79-b3e0-41430bc3b1c5", "comment": "Malware payload (Mirai)", "value": "ba3d8572e455f7079019cb16040b923edcac12bfcb3550f89774d44246e347b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257929, "uuid": "388b1cee-0e6d-46df-bc0a-9211362ba764", "comment": "Malware payload (Mirai)", "value": "4b16119b0166c5697ccb77fbe54d0e0bd1ea323c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257929, "uuid": "7a25b253-76c7-4bba-8dc2-c3a5f7d4ccd9", "comment": "Malware payload (Mirai)", "value": "52c69e83e31da46b515565a2e909c9deb2e01a9c6fd09ad7d79e9513315b986ab9ceb24ae15ca68e588832189adc5dd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257929, "uuid": "2aa828c7-965d-4010-aae7-52b7d48ced94", "value": "T17E530295A243CBB2FD32B9F8CC99C7D43F40274C71A15D90D652EA16B52443CA1B17EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257929, "uuid": "920dbf71-edee-43a8-a3e6-be96bb691d62", "value": "1536:7uj72gSCVK5VmSnr7WEebiuxJ9YQt254u+qgw0t4T:7Rgs35xeb5xLYQM54u+qgwI4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257929, "uuid": "714817b1-71b6-4bcb-80ef-19e89f25e634", "value": 62556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257929, "uuid": "ce05cb85-c722-4eee-a4ff-80c1da102b5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257929, "uuid": "7fd259bf-4890-4a7b-8943-3953d288c113", "value": "wife.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7771ced4-5ca7-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780200975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780200975, "uuid": "5ece0fd8-97dc-4abe-a76f-add11bf4b05e", "comment": "Malware payload (WannaCry)", "value": "8a0e9c1a8448f7e6c9ff26bc47ad4a1e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780200975, "uuid": "cb95ec2c-084b-496f-aed9-2fc85d5ed2a1", "comment": "Malware payload (WannaCry)", "value": "ba4015669d28f5517b55998833ea2c0690caa0a23beab77119426555827be461", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780200975, "uuid": "e9a3fe8a-3bf0-4250-aa21-153b5cb8193c", "comment": "Malware payload (WannaCry)", "value": "caf54482c3dc7414cb26d0a553aac8af25a0736f", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780200975, "uuid": "24f43398-fdea-4c1d-8139-d1ca46dcaceb", "comment": "Malware payload (WannaCry)", "value": "df19f00f74d4bad131a239d4b97e35ff80a90415811a4ad7d011e173b5aa086f029e928ba7b06222961afbd24998ca5a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780200975, "uuid": "821386ef-b79f-4100-88f4-022dd79f500f", "value": "T11936239932BC81FCD106297484B78D12F3B37C6A22FE5B0F9B50457A2D53B86B760B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780200975, "uuid": "72b00357-7a18-4518-b674-55d81ef52fdb", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780200975, "uuid": "dd9e33db-8658-4131-be92-849c824da1ed", "value": "49152:jnsnHqMSPbcBVQej/hINRx+TSqTdX1HkQo6SAARdhnv:DMHqPoBhzhaRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780200975, "uuid": "50702d06-91e1-4609-b796-2997730956ff", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780200975, "uuid": "cdd072ad-80f6-457b-b99a-c525c7c8f738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780200975, "uuid": "e075adc7-7093-4952-8de5-585b19c37522", "value": "ba4015669d28f5517b55998833ea2c0690caa0a23beab77119426555827be461", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad71f2f-5d4b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780271257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271257, "uuid": "47e38eb7-242a-4cb4-8454-c7f51da495a6", "comment": "Malware payload", "value": "c8b1a41348cdefd0a2a7cb05719357af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271257, "uuid": "e98d4961-0a75-4363-9c4e-62e9b9246baf", "comment": "Malware payload", "value": "baa6dfec304a933e046e0f919b04f3d7fecd07f7e4955babc5d30286d0f810e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271257, "uuid": "e321a8bb-7f71-4dca-9a57-21e78ad1081b", "comment": "Malware payload", "value": "1bbd075cf7a3f0973dc8a6168ff7dac07dead522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271257, "uuid": "87207329-34e4-408a-b2a5-214a9e8b2df7", "comment": "Malware payload", "value": "5cfe492dc704b1a1375717a47be28a9cc9097e4b9e80353313096246b30b9e3d74f08a615e64cd3d320ead6dd7815b50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271257, "uuid": "cf8d47d4-5561-449c-9f21-f8a571018165", "value": "T11E23F135AA674363D934A57DC7E81B458BC92B1390129C4DB0E8E88BDC82241ACE7ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271257, "uuid": "64fe5c82-5a34-4621-b9b5-c90543929779", "value": "768:l038s7uQVy+hNwtRaYhZUxpmnBvI5oAsWaaQHwcSiJgq4YAQxQTfHfCJgGlzDpjN:S/hEfaYhCxpmB8oAsWaaAwcg+AQxifGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271257, "uuid": "9fe6baae-e15c-463c-8a04-90256dae2881", "value": 47716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271257, "uuid": "e7139f9b-a92f-4e17-a9b6-65d8e5291b19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271257, "uuid": "072f2100-b847-4a15-8a63-1ce3963e4225", "value": "gov.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdabf9d5-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250083, "uuid": "2e9ae05d-bb93-471e-806f-3e265d696217", "comment": "Malware payload (Mirai)", "value": "2bf2487f5602678abd66ed8baebda011", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250083, "uuid": "92094b62-55a1-4206-a7f0-ba53eaed335d", "comment": "Malware payload (Mirai)", "value": "bb2b445a438cd2091098112e40248b332da6d01378dacf5d48c97eba74e62151", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250083, "uuid": "3c603b7b-78af-4145-8dc5-51e1cbcc6ccf", "comment": "Malware payload (Mirai)", "value": "453e9e9795d1c4c9564ccd328e25c69c7c6ae376", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250083, "uuid": "26aa3d31-f6b2-447f-be09-05dd365a6360", "comment": "Malware payload (Mirai)", "value": "c81bbb6fe3626bca43e67a7661e132dca0dcfef32ca50792c221d291e9d7a53bc4d1bee04026ec78bb646be6f6832ecb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250083, "uuid": "bb3522a9-ffed-4bf6-b128-665e039ffcfc", "value": "T1DD03E07DB28115D9E9B6D079F7820F410C5C4B28CC29D49A25C0DB4BCE67AF468D6DEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250083, "uuid": "a5508fd5-ba4d-4d1f-9a08-fec7efaa7638", "value": "768:TgIzUxnbpXtsdS3/SVV86gdBK8Av4PXMkYNPQ+pi3ZhvOUnJgGlzDpbuR1Jwm:TgIzINddkVvgrKVPY+pi3ZhmuVJuqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250083, "uuid": "df72f2ac-38b5-4000-8b0f-57cfdd7c3b5c", "value": 38564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250083, "uuid": "a40fab3b-4744-4055-bd4a-6266a0e2e68b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250083, "uuid": "89e44a9b-f648-4d3c-b330-5f458768f1f8", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c0ae2a-5cec-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780230608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780230608, "uuid": "22e7d993-cdb9-4de5-949f-66d890ed69b9", "comment": "Malware payload (RemusStealer)", "value": "510396efba8761a5b062c366591f253a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780230608, "uuid": "b44946ab-fd49-4ee0-84fa-edb71622efb8", "comment": "Malware payload (RemusStealer)", "value": "bce855d1a81c079fd958f4e77e1b2cbf70ce118affc878c7abb26c8304479f86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780230608, "uuid": "ab29e31d-7266-40f5-be85-7913959412ea", "comment": "Malware payload (RemusStealer)", "value": "70efc14afb5a0047cd86222fd98938876440d7b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780230608, "uuid": "7dac8f31-3641-4a0a-915d-dae1885fd91a", "comment": "Malware payload (RemusStealer)", "value": "b8af235a370078ad7a752f70f49f721d813e90492566182107599efa04af5c333e6541928bcb5b9f3763d802d5657ea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780230608, "uuid": "07462cb3-c7cb-4df7-82e4-45fafaf6461c", "value": "T12EB749876C62A1E1C85572B764A381B07B64BC146B71A7F73ED8763A2F716C048F6F80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780230608, "uuid": "c58257dd-c4f0-45e2-940c-629b61034761", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780230608, "uuid": "133377fa-cf06-4a10-bc4e-4b7fd35aca79", "value": "24576:5LhlknAMXCkF0wSAmn2MZj4K4fwPjsF5N8BqSdoToF/MBele5ZK2hh1Eb8gPeO:5VOnAACkiwSBnLUK4oPYF5YjcpHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780230608, "uuid": "d142ac87-6306-42fd-8ef8-0c5c75e10e2b", "value": 50470536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780230608, "uuid": "160e324b-4352-4db1-bb66-30325de43882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780230608, "uuid": "4cd6b3d6-90a5-443f-b58c-56274e69f759", "value": "Unicore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6d1e95-5cd7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780221791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221791, "uuid": "d0a74f3f-5f39-4219-b534-e1e12abb75ff", "comment": "Malware payload", "value": "70ed8bf59f0e2dffa22b09dbae2a7949", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221791, "uuid": "ac7e2a79-1816-4e3a-8b2a-a2c2e41f581d", "comment": "Malware payload", "value": "bd7eda869961554ee495a936d258ae9f95723483f16fb540429226af0ff7554a", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221791, "uuid": "3e297de1-21db-4dbb-8511-be5b92a82292", "comment": "Malware payload", "value": "1db98ad5b928038ffaf12112eb630f405c866cfe", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780221791, "uuid": "cc78c201-35fc-4875-beb5-6eb53ed5d21e", "comment": "Malware payload", "value": "5fa557f584d128084d35fb0b3c67fecdaf2f197a292dcc28fbcd488936aaed51933670d3739d5fa6205229c281c2d32b", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221791, "uuid": "94a38b99-95cf-4670-81b1-74190bb83faf", "value": "T10D82A68A7E826260D69AD7BF3E3752C2D13F0D80A3959998F32C7468FD84108627D76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221791, "uuid": "173b4395-b14f-44ce-9f52-0c608faa3494", "value": "384:nl4NbkGRwyTZ5gBApRXY8pAvZREkKrg1MGNYB2xtb36P2XoupF2HqamjEdRVJWwv:n2SG6OgAp5Y8pAvZREkKrg1MGKBAb365", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780221791, "uuid": "5f0a19d5-4640-464f-bd36-067bcdf2a56a", "value": 18501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780221791, "uuid": "60d7073a-7212-4195-bb4d-a64fa490073e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780221791, "uuid": "edb1a6fc-e410-47d9-b125-e3c234846536", "value": "main.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e2fb15-5cd3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780219970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219970, "uuid": "92ab746e-af5a-4383-9b21-7f6c642713cf", "comment": "Malware payload", "value": "5bcc54193343f65d91e2b865b6498706", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219970, "uuid": "ad9ff54d-8aa8-408a-a133-e9f6347770f6", "comment": "Malware payload", "value": "bde1497065eaf5ab34cba7bd96a8e21d5b6bb53c1fa031acb283187cf208dc87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219970, "uuid": "c1b08d70-bf68-4f42-a6be-16ff28cb73d7", "comment": "Malware payload", "value": "7cbc9c06222ec9ee007ea5aa3a35bc238003d21a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780219970, "uuid": "f67c21d3-150a-4a23-9652-dd458a201c87", "comment": "Malware payload", "value": "ece7859206c8788b75a69f55461c25fc633029a2c1d82b19e83b9b00a0f4a6100b655a00176ffc40a8d1a96c28e69122", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219970, "uuid": "f2206631-7bf5-4266-ada8-bdcd86d2ebea", "value": "T12E65339322464FB1BBD2FE3D402479CBD674DEB51B3DB3A4B27482741943AA2E271835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219970, "uuid": "64e2c9ce-3330-4c0c-8ee8-c3d18a7f6d5c", "value": "24576:wKSc8CzOx8GxVvM3lQ+9Xknlat2lp8MhzUE8swuW46sJ/gWhHhbVlGttgKX:EpCKabVQ+9qlNlpjN8H8JZGtu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780219970, "uuid": "a440802e-66a6-45d4-8b4d-285682fbde2e", "value": 1474560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780219970, "uuid": "d4162eee-51e7-4a39-9fa9-9fa1b6170d23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780219970, "uuid": "339c2da5-a78c-49b3-8650-fba354748b13", "value": "20260531-005741_sftp__root_redtail_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4b5c37-5cad-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1780203455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780203455, "uuid": "72689178-acbf-4eb0-bd0e-0da5744700d7", "comment": "Malware payload (SalatStealer)", "value": "5b0000129e0a1f8359c49f283704cf9b", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780203455, "uuid": "719eb828-2075-414e-a987-3b04fe0cce0e", "comment": "Malware payload (SalatStealer)", "value": "bf40a0f7d4d10448e5cae29b32c9e55e232bf80c04500c5e8f4f82bd427a8a29", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780203455, "uuid": "1993bbb6-c964-4001-a806-bcd1cb295840", "comment": "Malware payload (SalatStealer)", "value": "adb0fe0d934885887cf4f5117dd5a97c3d10cc9b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780203455, "uuid": "867fbf19-8dbe-4412-a2b4-317f4cb670c2", "comment": "Malware payload (SalatStealer)", "value": "5ac005c1c8c1339a012683ff4f01971b97efd51fe442548459e031f21116220c83bd964973ea0809832bf3ad3232aad4", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780203455, "uuid": "804f284a-d293-4648-99b8-f23ea75fe7f5", "value": "T118162302FFDB70ADDA3757B180ADA2768621F8270C12C967FBCC1C625B6B7102D6D259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780203455, "uuid": "6119329b-d8fc-4361-8bf0-6c3b8ae8c5b7", "value": "7b474ee754a35724283e1199bc061892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780203455, "uuid": "6ed498bf-bae7-49a6-96a0-89a1790f7265", "value": "49152:nvyb1hxhfnUxiduGhAgW7H9xn2ZjvBGl77+9W4HKMBe4VrUhqmxOnX+QMkmjQwPo:W/1EGZBGE9JjeMyuuQMLtkHBFe79BEye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780203455, "uuid": "5c0da240-2f27-4c19-bd3e-7f2c2d01d7bf", "value": 4123544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780203455, "uuid": "840e96fd-3050-48bd-9d44-e5e3f58d0762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780203455, "uuid": "deb0d21a-d309-4509-bb08-debab7d89b92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fdba61-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780271139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271139, "uuid": "bd4be3cb-093c-4e6c-b94a-4c2a08571182", "comment": "Malware payload (Mirai)", "value": "5abece677ef2822bc26b46aa67449aad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271139, "uuid": "ba1d81cd-6140-4ebe-bda0-842deec22de9", "comment": "Malware payload (Mirai)", "value": "bf878ae9ed33bf0c5ecc5b70431f6119e8c0cbe49338adebb838d2f9ec2056d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271139, "uuid": "30ae9991-2647-43cd-823b-b18aa64125eb", "comment": "Malware payload (Mirai)", "value": "1378eca1444b4624d51a473efd074ea25e16acd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271139, "uuid": "df4b4248-07f6-445a-937f-b2ebffde2b67", "comment": "Malware payload (Mirai)", "value": "b95438bbdc4f1fb164a9461a65cd5858dd1a9af29f10ec2618733d5f1e26bc17d23ea26649e257eae79ec0c22117ab6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271139, "uuid": "c05da021-7618-4765-8f31-4e63e8b2faa5", "value": "T198A349B3C8256E58E624D5B1B0B08F796B93A950814B5FBE45B7C3B44443DCEFA063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271139, "uuid": "4c4e4193-cfd0-43c2-8e82-de4264105421", "value": "1536:3hMRMplOcuaC6RKZqLVBvqnOpMFUjW1MjXFgRGqilx:3h6MLOOKZXnOHjWaL2RI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271139, "uuid": "e514aa65-b134-4467-bc46-e4d4a2bfe03f", "value": 100964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271139, "uuid": "5862cee7-7d0b-4abf-b3e8-32f879ce742b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271139, "uuid": "758b5ff0-3b5e-47be-ad0d-ad3bf4dc524f", "value": "gov.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607bcf2a-5cfb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780237015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237015, "uuid": "3f503abe-18ff-48a6-8926-5d3b67830ac1", "comment": "Malware payload", "value": "7213e3c37fda02e276d68445e8cca182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237015, "uuid": "ba609ff7-c341-4a3a-a118-adb871e40f9c", "comment": "Malware payload", "value": "bfa78af89512b135997d8180639ec92b33c07de93ebe810bfb17249e69e7fc4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237015, "uuid": "e488f53e-dd0d-4475-b0e1-527b5a103efb", "comment": "Malware payload", "value": "86bf6ca1a920a2220c4bd09bcfcbdf2a9c294df2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237015, "uuid": "fbd42510-bb14-449a-bcba-6629792042b2", "comment": "Malware payload", "value": "f6312981e0cf89d1f12f25eea6b5c00e62235dc9758de1258d4f61792819ff73019d153b4ce6ae0fa10da85c9678d2ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237015, "uuid": "56cfd15b-5bfc-4107-9a29-a89836a11439", "value": "T1D45633632AEDAD73E6B48671ECA1C1060B7073E49BF364B73994D99EC002361AF38755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237015, "uuid": "4642fc9b-708f-41ad-8b7a-d75d66e12023", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237015, "uuid": "4bba19ba-3587-4005-b9e3-117335a2d3ca", "value": "98304:s9KHWSDoEQ/M9LRoMhjFNcAKsefvXyktq+x27et/A6+/K:s9+Jo0RRthh6AKsefvXyOq+xGOA6wK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780237015, "uuid": "f0ce06f3-0e4a-468a-a12b-d883884fe897", "value": 6381568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780237015, "uuid": "ffca5034-ca72-43f4-8535-c9f770b8883c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237015, "uuid": "2a307a01-297c-4b73-ab1f-f1211a32c598", "value": "stage2-W5jQz4Nh.rc4.dec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f569d074-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213642, "uuid": "d2663bec-285c-4c74-9c29-5a155594b2b6", "comment": "Malware payload (Mirai)", "value": "bea84362a0a04dd6e05bfcfb6abbd453", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213642, "uuid": "95df37a8-c0fc-4eb9-b07c-e2479330c7b0", "comment": "Malware payload (Mirai)", "value": "bfaf03b37aa7651ef2308d7c31e456e26da1f1f813fe2d3c98aec645c729d700", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213642, "uuid": "4c8b77a7-9627-4acb-ab60-30085b600c7a", "comment": "Malware payload (Mirai)", "value": "123edf22caeb514f82271b8ec91b4598c3ed86a8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213642, "uuid": "4dca23ad-94c1-4f10-85d7-bef5dd405165", "comment": "Malware payload (Mirai)", "value": "dfc5fd49f0e486c48ddfcb5c95b517ad556c897e81c1db1d86b1d83f8977d509f30be7f85bb5fec3f2fe0f83707e4969", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213642, "uuid": "7bf097b8-29f9-4935-a775-2b68bb436bd7", "value": "T1DE634A85BC818623C6C5237BFA5E028D372653A8D2EF7207DD169F2137CA96B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213642, "uuid": "fa5d96c7-d973-4448-8ed0-627f81997c48", "value": "1536:nzkX7ZMVpvm5rDjpw9NG4O0Y26gm4NNuJ:nzkX7ZUWG9NXO5gHCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213642, "uuid": "572ad445-c7ab-421f-90f8-5026339f6e21", "value": 70968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213642, "uuid": "d363ba42-e910-4c8c-99da-f82e0a24d298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213642, "uuid": "82865970-138d-4f5e-b249-235e3e94b856", "value": "karm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee00ae3-5d29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256930, "uuid": "05254fe3-955c-4c2a-ae1d-3c904e41b058", "comment": "Malware payload (Mirai)", "value": "6dc34f1377e1371671f0470c5cfb67cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256930, "uuid": "6fb219f8-9199-4afe-829b-693d88c0a363", "comment": "Malware payload (Mirai)", "value": "bfc650b5c39baee7b7a3edb6265e86e9b12747f418bfde48b500854bb8b5e631", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256930, "uuid": "001fc9e0-bd90-480a-9759-d0bc925cbda3", "comment": "Malware payload (Mirai)", "value": "b588530b79853c2e80c7f18fd8f16fbab09372e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256930, "uuid": "9f4860d2-a398-4346-a099-3203bf247c31", "comment": "Malware payload (Mirai)", "value": "9a6102d4700286b05e83c54d2ff5c4cb49fb7ffe661bd5b68a3c732023004b4bbf8481b34f08746a5429fa168e089b2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256930, "uuid": "cb14b084-9f64-40a8-b098-d7ea32a6ed7e", "value": "T15B6302877794B14DC1B51EB7CC285BCB02A685F8D2C6B1052188C64BAEC395EDBDDF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256930, "uuid": "829d9225-9374-46d9-bb56-52f86e4bdc23", "value": "1536:+gzRkse6qYIuEua0L6FRe0G1zG5IHC0n7U7DwVsGIVp/dFxTQa:PCsHlI0L6F0d1zGKHC0ykVsRn9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256930, "uuid": "2ef6d41c-02cb-425d-bc13-ebfddceecf02", "value": 69016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256930, "uuid": "d186b7b0-5f17-4362-a143-463f3c88a7d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256930, "uuid": "55db6d90-5efe-4667-a9c3-7b0b9204da4e", "value": "wife.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd8bde1-5cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780236661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236661, "uuid": "660abe96-d9f2-4d3b-ba00-f7a20ae9a481", "comment": "Malware payload (Mirai)", "value": "e36771ae076ddc453413e221632ee539", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236661, "uuid": "4af7e2d6-158e-44e5-bb59-7bdb2cbe3419", "comment": "Malware payload (Mirai)", "value": "c033b36f096237eabb3a6aab015d8c6e881cbc1921e8cba46a8aba1c5c1ae521", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236661, "uuid": "b77c50c5-c3e1-48e2-a877-50eea9f2b31c", "comment": "Malware payload (Mirai)", "value": "4477b514fc17a23c38e1e4d1975b308b00722c73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236661, "uuid": "8ab0bfc0-ef6e-46d6-846b-a6d1e3bd7591", "comment": "Malware payload (Mirai)", "value": "ade11fafd8b0eff77df03d795249c650afddc2fc0e4da9859912e931652e6bc5cc04171db0ae10018d47f201d84dfb7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236661, "uuid": "914db10a-abb6-4d84-b223-31b62381bef9", "value": "T1A4342A02A9518A53C4C21B7ABB5F42953733AB34D7DB7302DA18AFB42F47ADE0E39511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236661, "uuid": "c8b135a2-47fc-4c48-9dfd-7bc229692162", "value": "6144:0V5EMFB4KeKMfgaRSDdl/PJzg8BcUvdjlmWqhVKZqV+1pu/Nd:0V5EMFPevfgaKdRPJzuGlmWqhVK4V+1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780236661, "uuid": "5f6cd284-fe8a-4b19-9092-e68f58c60b45", "value": 245946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780236661, "uuid": "803feb0e-2e6b-4c12-8650-95aebb360cb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236661, "uuid": "6095c337-a110-45c7-9740-4148723034fa", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9682dc-5d0e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780245328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245328, "uuid": "32fe9fc8-c3f0-4fd6-a82b-10cbdf9edb98", "comment": "Malware payload", "value": "eb5999f00d36eea88cdda8a54b28b40a", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245328, "uuid": "24d6dab7-6930-447f-87ab-82fe959c41f0", "comment": "Malware payload", "value": "c3568aca0cc2712fe08725345b25bc7c58fc5129a1283e37fdf7c2efff4b1327", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245328, "uuid": "f56f698e-a58e-4db3-8b5b-539ec995fd5f", "comment": "Malware payload", "value": "be7b5a04887f53fcf0b74e46b3dc66fa73c2696b", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780245328, "uuid": "ffc7af11-93ab-499b-b23c-b9fead83ff7c", "comment": "Malware payload", "value": "4f30dec465a411e68cd7e292d063aa2e200736db56dc3a28bd4000cee06ebb244699eb485ca16efcc7cd1c2cbfbfbd89", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245328, "uuid": "04716659-bc7b-4b91-a801-4ef623fdfa5d", "value": "T15D0833097879E39AD1EBECF14A60F8E6505E73704E70918EB7E8771922D228631BD347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245328, "uuid": "865f6aaa-a7db-4468-86c6-8b22a70682b4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245328, "uuid": "e54b383b-fe0e-4869-8fe4-123fffc4b865", "value": "1572864:ct9IKPmEXloAuwIw2ko57hq5XMphF86fw7LNsKOebiJtuhctEU7G56z7AN7:cUK+EXloAuw3o5Fq5XMtf0+bebiGheJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780245328, "uuid": "577d35d2-b167-4a7f-a09c-f1c39d5abd4e", "value": 77876879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780245328, "uuid": "210395a7-6518-4035-aa3c-5f9c18114031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780245328, "uuid": "d163c6df-2d6a-41c4-a397-20509c6a0599", "value": "LCE.Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e697ccf-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213308, "uuid": "8c69e403-a159-49b6-b757-9717dc252e5b", "comment": "Malware payload (Mirai)", "value": "42c44e12aa99f26f162d9457bd61d423", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213308, "uuid": "d4d79db1-384f-439f-8945-f4be7618b8c7", "comment": "Malware payload (Mirai)", "value": "c39be869c8eed72911c232eb4f40a5e1c0212d72848a8cc63e03490d4921538f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213308, "uuid": "bbd99b89-398a-4ec0-9946-b7917ea7007c", "comment": "Malware payload (Mirai)", "value": "f52508565d78ba56f4904ea87b69c0addcc8a6c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213308, "uuid": "e8b94d67-87e0-4be1-89f4-0a133cf27684", "comment": "Malware payload (Mirai)", "value": "c56738f18d877ed3d33651c9c40f4d5f24513646afd014e03f18433f1303e4e643ccca0fdb72020937205c036e6c5658", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213308, "uuid": "0ebde464-0e69-4794-837f-d0ddd691097d", "value": "T1AC435BC4F643D8F5EC8705712077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213308, "uuid": "0f2b10b8-e861-46be-82fa-a68fde0099ce", "value": "1536:JeESt/basV2rcZhG6+KN7TqOVlSR9zWOIaEjrqMU:JeESt/basVTgW7TqOVQRVtXESj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213308, "uuid": "b6529c2b-8051-4db5-87c8-fa2c9330563f", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213308, "uuid": "0c89748d-c465-4f13-b586-127604cb7b43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213308, "uuid": "e63d1c30-9cf8-48d2-bda5-14b22fd08be7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15335d1-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780214360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214360, "uuid": "b09829d9-191f-4f7c-8e6b-82a2aa6ef979", "comment": "Malware payload (Mirai)", "value": "7436c81c667e01dad813fee65cdcfdf1", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214360, "uuid": "7bee1a17-09fb-4fe7-b8c5-c7dfc0384eb4", "comment": "Malware payload (Mirai)", "value": "c4977ac90760fe713c0791c70f111b83dc476620746f6e6f1f196b90aabbfd66", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214360, "uuid": "8f612774-f77f-4138-831e-f06b5b90c662", "comment": "Malware payload (Mirai)", "value": "47354f6542ee3d8a572b508a61fe984ac645527b", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214360, "uuid": "1101d1f1-345e-4fe5-b7d2-65e99d296815", "comment": "Malware payload (Mirai)", "value": "0cf9d209bd8ac85c07bb33ff6133325d96b069e951dcfff7bd27a507eb3024286a9e009557527f262b1ebe5289dcc5b5", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214360, "uuid": "05264bd6-a3a9-4306-8750-cf9cfbfbc4b3", "value": "T17D7423C90AA646FFF909337130634E500DACB4234F3F9ABADE5A5B476B7F1A40560E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214360, "uuid": "ac45027a-869c-46d4-934e-bba7c95653d8", "value": "6144:J4hESmZAckecYtmx1WlD7XHQuZEFCAjnSqlvwp44M9+PkZnkFX9E6Is2Ovqx:J4mSmfkecAmx1W5pUDjXlvm4d9Ek1m9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214360, "uuid": "af9cf08e-dbe7-43bf-9ab6-32997d272ade", "value": 348532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214360, "uuid": "53d64728-9ab8-4e0d-9777-2716ff1851f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214360, "uuid": "7b60b0d2-0cda-4328-9e8d-6c0e5e2004a2", "value": "blue.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7994872-5cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780212277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212277, "uuid": "5b9450f7-4335-4238-820f-4f79846684f8", "comment": "Malware payload (Vidar)", "value": "0bf24c96b0a66facb5ca534abccaea10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212277, "uuid": "10c531dc-60d6-4ab2-a365-810e7a94a230", "comment": "Malware payload (Vidar)", "value": "c4a23568dbd705245642ebfbef600be767853d1c3e0451154895c6adcd8e9690", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212277, "uuid": "506df283-a260-459b-8765-a773bf7a214f", "comment": "Malware payload (Vidar)", "value": "6f5ad50f27d1af1843e69be110afdee0d3f54299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212277, "uuid": "50e69871-953c-4493-88e8-9d85f68c0cb1", "comment": "Malware payload (Vidar)", "value": "707cc340419cab6d605636a565dcb454875dd050bb0706e537cfd6ede474491d03f3aeeee674171dc9e9cd0f4ff04aa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212277, "uuid": "b9848f99-5cd3-4d69-8b70-bcd7faa63c33", "value": "T1D6C57A876C62E1E1C85576B364A341707B24BC146FB6A7F72D8872382F366C449FAF84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212277, "uuid": "08ac9d55-4d2b-4fc3-847c-e94cc2ec71d9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212277, "uuid": "b52cab6b-24cc-42df-b8f7-4061e5054cad", "value": "49152:Uql0xpGrhYKijDTy9uPcBB09Mvm9gjYs3O/J+4UlfTOaHw:UVQ2OuI09gjWlZaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212277, "uuid": "2534ea07-db41-42f4-93d0-107557b375a4", "value": 2650760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212277, "uuid": "868e5ef6-ee5f-4076-94fd-ba5e7c2860b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212277, "uuid": "fbe11918-5d26-42b1-9324-2922f03cd5bd", "value": "__zst____r_64-v.9.955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893323e3-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780213461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "a350ea14-aae6-4bc9-904e-956031945181", "comment": "Malware payload", "value": "e4cc793fec56837bb4a7a75fa0c3d585", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "37da06d5-914a-4760-a9b7-7525cc778923", "comment": "Malware payload", "value": "c4c5a1cf60c198ecc1cb904b0f43353a1e8f37580081fe64be4fab3aeae6aa55", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "96f36108-85ff-4967-b895-daefe26c299d", "comment": "Malware payload", "value": "c01547b4175ea9ffade426f74d18b6d5345a2116", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "920f34f5-e940-4c8a-9abc-d2fd7b602a3d", "comment": "Malware payload", "value": "ed9b75a21c4d5401a09c3c3a403e1630e32861f5cfe42fa2d4cfb458f6ec60721c2c2ad36543994dae42e58db6d6e41b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "aca18c24-2988-4285-9ddf-6b2b3ab17f3a", "value": "T12A762957B8924942C4E43A37B9BE81C432634EB98B8712576D04FE3C7EBE5DA0E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "03f016d0-41b2-4570-a03a-580333c1b247", "value": "49152:SD0wZairHltqFZYh9v6oYDMvKTv/FDF1TF3x5ED:S24HltqFZYh9MOsr1TF3HED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213461, "uuid": "62a293a9-b53c-45c4-9090-ba23c93c3bd4", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213461, "uuid": "16530018-fb29-4422-9efb-aa3667a4af82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "a93c0d58-f78b-4ab2-97f6-5e6cca8c1599", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab6b596-5d25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780254990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254990, "uuid": "e8f0e921-94a7-4842-81aa-69897ea5d80a", "comment": "Malware payload (Mirai)", "value": "c0de3b3c5d0a904acbe0c04b8b54cfaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254990, "uuid": "6b70ef78-6e9a-43dc-9f3e-d32b25ccfdcf", "comment": "Malware payload (Mirai)", "value": "c4d593c001fbddd55cc3b6fbabe9e81942c2716a16d0944d7e2337b9822bedd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254990, "uuid": "de5717f7-a163-483c-9a75-6588ac24b49c", "comment": "Malware payload (Mirai)", "value": "e75c91fba709c5c26f8d1d7f3e133973d3824fe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254990, "uuid": "7054cb93-11f5-45ef-a6bc-82f09a5933b0", "comment": "Malware payload (Mirai)", "value": "fd479fc04ecb92123fbb6e8d84210ca285d72ce48c1958d733b1fd1cba8acc36120b55e1e1eaa779033dc7421e6c3405", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254990, "uuid": "f0bfd283-f0ed-4057-94c5-fb7b9e5d8afc", "value": "T10E34B50AAB519FF7D45FDE3305F9870124CCB85321642B3A7270EB5DB95A68B09E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254990, "uuid": "7f30883a-699a-4eb2-80ef-adf3c5dab6aa", "value": "3072:yUtMHw5H1/mOpqNLXZ6lJzq8aQr9TkJRzj/ZOAFi:thmOMbmq8aCTkzj/4AF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780254990, "uuid": "65972ed2-6a9a-4d60-9140-01b71fc9838d", "value": 253060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780254990, "uuid": "68cbb804-1103-4e95-a422-bd6f4ff2ba6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254990, "uuid": "4632d5e2-2ab4-48bc-922d-062250cea47c", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09b9404-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780214359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214359, "uuid": "21351a44-9f72-45f5-99de-46d1f745a57e", "comment": "Malware payload", "value": "cebed0cbe087e1906f270547482fc43a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214359, "uuid": "6ea4d374-65e2-48d5-bdfa-b5ae5244f88c", "comment": "Malware payload", "value": "c57029d62da1dcf09ad4a0f6aafaf2992f6d2103972dd7efd3fb4b110475f347", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214359, "uuid": "10bf1147-f6da-42bc-bb39-a981a280aa83", "comment": "Malware payload", "value": "75c142711490a9eb589558d4faac9e9fad5e9ef7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214359, "uuid": "47855aea-3036-4791-a363-c83cdb9d2d0f", "comment": "Malware payload", "value": "b6226f77d31c305fbd996d85a102a027b3c8f291389d0e149f65adefec81d7a906243701117335ad8af995effb18a013", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214359, "uuid": "70c92f18-cf6f-428f-86c2-c5c310d703d3", "value": "T1C611CC59066054EF5E54F0179208FA0D788E40FF2FD8C92D388C2A9F67D4A08710A79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214359, "uuid": "942d2839-64b1-40b1-8489-d21e2d078a73", "value": "24:qR/q4O7oXZLGQiT1eXZF1cUg3sQMYFn2QT4PvjKmN:qw4SmiTgXX1c9seF7T4PvjzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214359, "uuid": "b5057206-c67d-437e-b8bb-8f351bbf95ee", "value": 1035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214359, "uuid": "ab445718-bc47-4841-8814-652a9519bc2f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214359, "uuid": "e6c501d3-6798-414e-af1f-49f3c2d00ad4", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0719d05-5d2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257389, "uuid": "40a1a75a-e3e1-4b08-9b66-469b2d4f2b19", "comment": "Malware payload (Mirai)", "value": "ed423e1fc2eca17b64170ede40bd08da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257389, "uuid": "9837ff6b-5f87-4299-a0bb-58e1ddac197e", "comment": "Malware payload (Mirai)", "value": "c5de080cb8f9a65cad77d5d24b5eea0944d6f150f975e975eb97b58a07171d76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257389, "uuid": "69a73939-cbdc-4434-817d-dc52159bd8ef", "comment": "Malware payload (Mirai)", "value": "0c4b8596f048e7ef5c3511a7cd5eec2c28763f78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257389, "uuid": "f9de10b3-6087-4eb1-a4b2-cb889210ed30", "comment": "Malware payload (Mirai)", "value": "02a787dec0238b8480a1b62d702c15000efc16f3a79e2aa9609e18cd1b86dfc712e55c54081cd5f1285917a9ba491590", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257389, "uuid": "c85ae409-cca5-4f59-a202-0bb3252de6a3", "value": "T10753019B416BA53DD1A015F34AA9DEF8BBE7B4225E5D8E270CF1137DC860029BD002F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257389, "uuid": "0333bf79-860f-427b-ab72-0aec2d09897b", "value": "1536:HtGTpI/Ywh1qqXTGYQYb7FffJ1kfP/oztq:ETpkYU1qqXCoF51c/opq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257389, "uuid": "8166e48b-663f-487f-a08a-79f002f45983", "value": 64804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257389, "uuid": "f10a81c3-0f93-4fe1-95bc-78085d16ea81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257389, "uuid": "4ef341de-f1bd-40e1-8595-71703d1a45e2", "value": "wife.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c814d9fd-5d26-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780255657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255657, "uuid": "381bb668-f29e-4b35-9e71-0260eb2ff2e9", "comment": "Malware payload (Mirai)", "value": "7a7404ca7628dbcba8d4acecbcb2cf22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255657, "uuid": "9df3ab5e-1a6d-4350-82dd-66182c156ac1", "comment": "Malware payload (Mirai)", "value": "c962603715982648543988b297dd8d0d446e2e0192eca6932243f88f72047bcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255657, "uuid": "44f190b9-b805-48c0-a301-e5966044894a", "comment": "Malware payload (Mirai)", "value": "9a8386e70038f4756fbd753e38051a15e8e25ba7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255657, "uuid": "7bfda01d-d252-4b85-80b4-54196ae7bd3d", "comment": "Malware payload (Mirai)", "value": "3e88eccecf7e0ebf0188b57fa4da75ac09ee25718caf81573772180ad2c236b02f87bffb0313025e5ccfeb13f84be6e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255657, "uuid": "c650514b-81ea-4176-9aae-3506acf0d291", "value": "T1D1E33A86B8818A11C6D512BAFA1D218D331357B8E3EF3213DE145F3527CA9AF0E7B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255657, "uuid": "920fbb67-7f31-45c0-acf3-34fba8b48418", "value": "3072:0EsQowQxzgHb7NrS1+Rb5B8iaS+GrOon2iPmRn16:AQowaS5BTa0Z2iA16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780255657, "uuid": "3190102b-967d-4c23-93f0-cb42d6413250", "value": 144852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780255657, "uuid": "f2164ad4-0eb6-475c-92d5-a0afa201892a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255657, "uuid": "6fe7fc7e-8e3a-4cff-ac39-706673c0b443", "value": "023782pler.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96484c9-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250075, "uuid": "3eda2358-c97b-4fa4-9216-295a726bd985", "comment": "Malware payload (Mirai)", "value": "d05055645b13086cb3ccc50977e961b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250075, "uuid": "41f4b7d7-687c-41f6-8fa5-279c10d01935", "comment": "Malware payload (Mirai)", "value": "ca44a666b44067ac905c03d39fe0b893619a4fb3ad625cb53b1618ac94c50eb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250075, "uuid": "c23a2303-07d1-471b-8599-cb09ca430c7e", "comment": "Malware payload (Mirai)", "value": "1ea41e7f107139bfbbac9bf76401833daff63624", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250075, "uuid": "7b11d355-0e35-4545-9f40-00430fdfb6aa", "comment": "Malware payload (Mirai)", "value": "bbc3d5dd935a69913fcd0ecd0b0477e5eec607bf3effdd022bad70b73b7b2898d2054c4ae94b60dd6278394fed252917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250075, "uuid": "c257d884-645f-474b-a300-8c2f20f181fd", "value": "T16CB2D011D64561B0C599413FFE6A410536E22BF5E2E6322B1E485FB8824A89C92F6FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250075, "uuid": "460a5196-1485-4ecf-a701-db9e1a2bdcac", "value": "384:i/v2xOtCrv5iMlYxSJeTbcZNmA5nTosVhb4hxZxVGAQGmtX42aOtQE/iMhymdGUT:i/exOEd8x+e3Ewwsibofb+GmF42NaMsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250075, "uuid": "53adb751-d852-477d-a92a-b2e54d3a98c7", "value": 24360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250075, "uuid": "d4424983-5066-46a6-aaf3-6be764cf676c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250075, "uuid": "892855a2-13e0-45ce-9312-127794686085", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5949ff8b-5cfd-11f1-a769-42010a9c0008", "comment": "Malware payload (CyberGate)", "timestamp": 1780237861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237861, "uuid": "e1e04b52-2d6f-4ca4-807a-a9e127576e69", "comment": "Malware payload (CyberGate)", "value": "3f951e80d7862e9e9fb5fc6903640411", "object_relation": "md5", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "auto-startup", "colour": "#174F6B", "exportable": true, "hide_tag": false }, { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237861, "uuid": "47b917e0-bfe2-4736-be78-c157dfbfeca7", "comment": "Malware payload (CyberGate)", "value": "cae0d61e59c7d596cf1ca86f1a564b379d8cd9c5a1177b7fe2d516ca4bf896e3", "object_relation": "sha256", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "auto-startup", "colour": "#174F6B", "exportable": true, "hide_tag": false }, { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237861, "uuid": "6c32ad16-fcd0-46f1-8eac-ca3f06a6d467", "comment": "Malware payload (CyberGate)", "value": "fa08603d18dd0de286c84aae7fef9c2aa31b468c", "object_relation": "sha1", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "auto-startup", "colour": "#174F6B", "exportable": true, "hide_tag": false }, { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237861, "uuid": "c811d990-6112-438d-9524-45a0e8cbfc3d", "comment": "Malware payload (CyberGate)", "value": "d403cd22a28fcece8c7923e1f956b09ad79725add721bcf8afbd1e86126a949e7380b51f07ab347261d3d8f15d3565b1", "object_relation": "sha3-384", "Tag": [ { "name": "auto-reg", "colour": "#132C3E", "exportable": true, "hide_tag": false }, { "name": "auto-startup", "colour": "#174F6B", "exportable": true, "hide_tag": false }, { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237861, "uuid": "753efb9d-9c8d-48f7-a3ef-c634c1249ae0", "value": "T184541255A556D8B6C3B84EFC6D28F6DEF30A36259D2F60E386FC0ECC8518287161C267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237861, "uuid": "5b1af784-049b-4ba9-a1c2-ae21344ee5f8", "value": "7570f969f5fbf39893024b667c3a0ef5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237861, "uuid": "c4ecd9fa-83ca-4cde-9342-39659d7c79c9", "value": "6144:+y+phrTwlTLfkixFUQKf3D7TnBAZ5qhbxj:7+pp0lYixsfvDBAzK9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780237861, "uuid": "7c62f252-29f7-46fa-bea5-4adfe2a0c06a", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780237861, "uuid": "7870be83-8a24-4b20-9c56-4caa9a36e534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237861, "uuid": "d42370b9-18d0-42f5-b37a-d016100fe50a", "value": "eastvillage.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b158d43b-5d0a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780243593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780243593, "uuid": "7d1facd5-8886-4500-b01e-5a875183dac7", "comment": "Malware payload (RemusStealer)", "value": "f58daa4389911dd88b042d39aad7b56c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780243593, "uuid": "25637a9e-2214-423c-b0d1-3111a393d3e6", "comment": "Malware payload (RemusStealer)", "value": "cae167643955f237bdc958d43b610b76c6091239253e7eaaeea01e582986f882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780243593, "uuid": "59f4c84b-388b-4c7a-ae65-f12dec1f006b", "comment": "Malware payload (RemusStealer)", "value": "01c3590fa571438c54f3cf9c50ab6e20672f69e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780243593, "uuid": "888063de-f560-486c-be1b-34d622ff1a0e", "comment": "Malware payload (RemusStealer)", "value": "2d4bb67ce1a435e3687d1b5425ecae9607f6c2650ff521505a6af990812b46e5a5139173893abc1e925edbd26a592c8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780243593, "uuid": "0bae6269-59a0-4d29-88f9-a856a79e4385", "value": "T1CA956C46BD8009B6D5AA93318CE612517738F8580B3367C72F60B2BA2F777E85E39354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780243593, "uuid": "f2856668-be3b-4fd9-8559-f2df0d4b2a02", "value": "7ecc3b9e18c31c23f5275a91f6c533d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780243593, "uuid": "28541089-e4d4-4415-a757-272db1cb7abb", "value": "24576:qz7AuVDdM4HKsQ4IUeIlHD1DglE88cHqf8ad2JheSgkwH6YFqiG4gsRT:G7VVDdM4qdUHlHD1jK68DOSgkwjGeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780243593, "uuid": "5b62ca76-7740-4fe4-9882-492d7e493b3c", "value": 1969480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780243593, "uuid": "48a790ca-4eae-43a5-bf9c-2a9d1a3b5bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780243593, "uuid": "8f857f3a-d874-4af0-9f35-3982b385d227", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fa4128-5d29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256759, "uuid": "72aa0eaa-0fa2-44c8-ba32-d5326bc76364", "comment": "Malware payload (Mirai)", "value": "c398966a9ba2fc7b69425ad76fffc7fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256759, "uuid": "eebef86f-c187-4d43-ad59-b6941aac93ca", "comment": "Malware payload (Mirai)", "value": "cb468930fa2bc775fb38a516b415e01d27620e4e8ad9e1036cdc037528c42cc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256759, "uuid": "64d35df4-fc9d-4b0b-9920-41b84440bb0e", "comment": "Malware payload (Mirai)", "value": "f6a2c74a059ed9267e6593b8c912d0c11aaa5f46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256759, "uuid": "7af250ac-4a35-4f8a-bc7a-d7bfe25aec72", "comment": "Malware payload (Mirai)", "value": "969fecb1fc909e0199d3c0bc9154333710fbe6a6d210d89ab42496ac25183d2d258985a9dd50726001ad6134a156416c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256759, "uuid": "e4818558-fcc5-438f-b55f-93342cc7f734", "value": "T1EF14B81E2E229F7DF6A8C73447B75E25976823D617E1D685E1ACC2101E2038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256759, "uuid": "987d8a27-6741-4538-b0d4-a2e3773d4e9c", "value": "3072:wRk/1CuLdIN/4m4F3BqQDljHKCH7AuXe9uBP:n/1zIN/4/3BvJN7ResBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256759, "uuid": "0b2fd895-c440-4848-8d7f-9b0e9b244316", "value": 205192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256759, "uuid": "cd5cfa4f-15a5-4167-b518-7fc935e288ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256759, "uuid": "b6819949-16ba-46af-ac46-866bbc31d00f", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea5710c-5cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780212235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212235, "uuid": "0313bd21-8962-4d10-936d-29b61aa482f0", "comment": "Malware payload (Vidar)", "value": "59668b51292a8b420b26319302edf72a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212235, "uuid": "4b81fe82-08ff-4015-9410-29825d3c0a47", "comment": "Malware payload (Vidar)", "value": "cb5643de7866af86df6c0a059648c4c7700e69dc1bc8295d8a4ec469ae2d0b74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212235, "uuid": "5fc3d80d-423f-46eb-85ac-102ab655a4fc", "comment": "Malware payload (Vidar)", "value": "00fbd0af0f88e946653fced89317f3725e116f3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212235, "uuid": "57554a52-0be1-4af1-b855-fb462511c190", "comment": "Malware payload (Vidar)", "value": "1ddaae563af94eb33858dcd2e15396d2014bd6dd7a2afa6fa21b432407741062539a083ad1964eb1c97d3a375c028415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212235, "uuid": "7719f696-d82e-4b73-9afd-2f64d1ebf098", "value": "T1F4C57B876CA2A5E5CC5173B768B341A07B24BC147B71A7F32E9862742F316C44DFAB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212235, "uuid": "54222b68-119d-4c94-bd5b-3252eae775ae", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212235, "uuid": "bb64f21b-d1ff-46a5-a10a-8ce0089487ac", "value": "49152:P9lg4raObiCkMm1oQkOkgcb8Lg+DHCVVom7DN1D4Ux5H1+:PpLixGykgcb8Lg+z2sK5V+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212235, "uuid": "af89d358-4fe5-4568-9c38-6396aac69b85", "value": 2609800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212235, "uuid": "841c972c-ae0d-42b8-914a-511ac744e4fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212235, "uuid": "552d8c7d-63ec-4ef6-9e19-f7be8a304b09", "value": "cb5643de7866af86df6c0a059648c4c7700e69dc1bc8295d8a4ec469ae2d0b74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ea7628-5cf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780234422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234422, "uuid": "2d69a759-8c62-40ed-9200-1463040fa90a", "comment": "Malware payload (Mirai)", "value": "cb3528970d712d62945702a95cfb0b36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234422, "uuid": "bfb70a50-1e1d-4324-8669-c0493e43ccb8", "comment": "Malware payload (Mirai)", "value": "cb9e6b00136b4b7018b20d2e82889abf1d605c1d1aa2e8e3491c01164b25bf60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234422, "uuid": "aa5a94c4-0094-4cd3-94b6-fce2993c9825", "comment": "Malware payload (Mirai)", "value": "bf154bd6f01dcc33b13100b6e572bec742bb7348", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234422, "uuid": "c70e0927-424d-4755-a613-08b8e805030e", "comment": "Malware payload (Mirai)", "value": "6bc520681b2d13a3e4fcd9c6c983bab01cc4bf85c06b0520f0df96da5cd713aa40286b621497180ac265e067ba93feaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234422, "uuid": "6cc59cfa-fa15-4f28-ae3e-b0cbf2d489d7", "value": "T1A5E32B45FC918F13C5D612BBFB5E428D372A57A8D2EE32039D255F24378A96B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234422, "uuid": "8a4c2b99-d9b3-4bfb-acdc-6ebfb663236a", "value": "1536:9iyxj4+1cdMhKkAL1aw4Cdcoy7SOdni1rm4VLKb7Tj0Y/jmRZBMq/Wlkuwywiwcx:9iyxSM4taw4CuP7SOdN4Unj+/tmK9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780234422, "uuid": "0bfa40b9-2466-424d-8aa4-7b56ae4f6c5a", "value": 149900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780234422, "uuid": "4a877204-64a0-4c86-b2ac-abfa7955ffb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234422, "uuid": "ac7f63d5-b42c-40ae-aadc-b1adaac8345b", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990f872d-5d47-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780269751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780269751, "uuid": "25980473-a262-49d6-b817-0469142aab81", "comment": "Malware payload (Mirai)", "value": "c9351fa054717172b86e1274f6465bbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780269751, "uuid": "799d00d4-0e43-43f5-ada7-fa0e624cae79", "comment": "Malware payload (Mirai)", "value": "cc653189103bd14e46958bae5f37f94852b7d54ced5662bf7858801c138645a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780269751, "uuid": "52bf642d-adf3-455a-ae55-6334dbf73716", "comment": "Malware payload (Mirai)", "value": "b6036c5519ebb49d061e7387df1664d21c0f82ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780269751, "uuid": "694f6c93-889f-48df-ab2b-38343cde5bbc", "comment": "Malware payload (Mirai)", "value": "3cc8ef065dcac691bd3d33ec55a4d889bb2880a21491de21997dd6e2bac1a4e318f4a59b2261314bb16ceead01206dff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780269751, "uuid": "1d839cdf-cff2-4aa7-9a28-dec3263950e2", "value": "T18604D80A9F920FFBDC6FDD3701A90A4235CD955B22A43B363674D528F54A90F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780269751, "uuid": "171f1bda-4bcb-41c1-8ccf-34cd1da50428", "value": "3072:JCJnHRf/giL0vAmkysuj0QCdafxFVsfVq:JUHRn0vJkSg9a5FVsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780269751, "uuid": "8cc581cf-f9b6-4505-baa4-b3103f4a82a4", "value": 185652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780269751, "uuid": "fe84e914-cac1-4aa2-b3e9-436685b178c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780269751, "uuid": "4d1680b5-65d4-4e30-a1e1-48641e34ea58", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325880b9-5d27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780255835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255835, "uuid": "4dc72afd-6abd-40eb-a9d2-8a395061f32f", "comment": "Malware payload (Mirai)", "value": "ecf89d77fc39a658c616ff79924d8763", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255835, "uuid": "f4ec6860-a48d-4270-a861-315793d7c9bb", "comment": "Malware payload (Mirai)", "value": "cd75fa4064b08ffd74de941dcb00ecca97952d86ad7e5a9d3ad16425fc6338bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255835, "uuid": "984db7e2-4157-4121-8104-ad7583aa5d3a", "comment": "Malware payload (Mirai)", "value": "c672424baa8f50164e1a2899753ee0d9942bb8b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255835, "uuid": "78b427d3-f379-4e01-8af7-0d0076b4a9f4", "comment": "Malware payload (Mirai)", "value": "6a69da891d73a75da5596554023a2eebf1e2597b14d45661278001d2ce5916cd9bab017953faec990aab548317e481bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255835, "uuid": "725ffe41-e84f-4a8d-9d82-1545a87756ae", "value": "T1380428C7F900DEFAF41AE7374813080AB130B7A144925A777257356BED3A295187BF8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255835, "uuid": "4b49ede9-fe0d-4777-8330-e9db773c7b34", "value": "3072:G4KrRqEIdenDruQRHHZXtrEsqyXaWUg3Egx9HpLs4i3/3KrBVTjbi1LrsUNKd+c:GDPk4ZpYyXBUg3EgRL0vKr+Lrr0d+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780255835, "uuid": "8ea92d8a-2ff0-4303-aece-5c6f2d29db0b", "value": 183716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780255835, "uuid": "34c93cac-4f20-4409-8fc9-50c734b786df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255835, "uuid": "ecb2b112-dc67-4b6f-8c40-9e24c4f9b4d3", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ab920c-5cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233745, "uuid": "7cfff1e2-8d57-485a-ae1d-be84234c3d27", "comment": "Malware payload (Mirai)", "value": "2d3e1f4fe83f0a9ce93c0b39c99b1f81", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233745, "uuid": "28312534-a888-470c-a51d-3c3f70868fc7", "comment": "Malware payload (Mirai)", "value": "ce050e46c2fbbb80a152f333cbb00d00d1b6396a91249e4466d575113f8a0480", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233745, "uuid": "ef47f68e-457e-4ec3-8cee-2e11f04af039", "comment": "Malware payload (Mirai)", "value": "4a0519ff8f0e5d1d2d0920585c320edaf5113655", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233745, "uuid": "d1523d9b-5946-4f78-a4ee-ebce961eab7d", "comment": "Malware payload (Mirai)", "value": "379737c81b27f936640f136141a75f7b32945389a3665e651ccbc0b36517e8ec1119ecb5de980cf6100984694ee6e696", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233745, "uuid": "18c7c166-a8b3-496f-abb7-125ac2c92a1f", "value": "T1FD330994BD819A17C9C456B7FF0E43897B26639CE2DE33039E25AF24378B92B0D67101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233745, "uuid": "50947ed9-2d1b-44c8-a630-63b7caa9c7b2", "value": "768:CaRyLx+249sY2pt+GrMsG+Lk8qMYMTKAHcgm4e32deJa71/vbwpJKI:rRasr9hUrh9L3bTKA8MQ2de47xOJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233745, "uuid": "2111bbf1-b652-4c5a-a796-76b00f4cc459", "value": 50524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233745, "uuid": "c31be3c3-292e-48c0-b6da-0cd08d2b3e03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233745, "uuid": "40f90c8e-ccc3-4629-b38f-2f723b62046f", "value": "5.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648fe8e7-5d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780254631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254631, "uuid": "6a308617-d470-4d29-bf7d-2c766f36bc2b", "comment": "Malware payload (Mirai)", "value": "c61da35686a79c49947e844af18a5e7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254631, "uuid": "37dfb032-52e1-48f8-bb79-ab8d70cc6d43", "comment": "Malware payload (Mirai)", "value": "ce92f6ed1356c76097193d439b70110aaed80f15f3d2c8efa95d06e81c05b0ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254631, "uuid": "9be0a51a-9afd-4654-b825-3e3d8d938aab", "comment": "Malware payload (Mirai)", "value": "5af62b880e4c260963ef474c2aaf397ae4d1c808", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254631, "uuid": "04f7fcbc-d753-4f3c-9dd7-175c6a044686", "comment": "Malware payload (Mirai)", "value": "bb61326a10b6f1e03ca73c9da32a48bab887863ec4747da4ae75cfac72630d2d7e6ef63d359a1b7c5a07e48c01bf999f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254631, "uuid": "d8387aa8-73a0-4a1d-8433-9f3269253917", "value": "T1545302A7A92A1453E954BA73D8128153A6C4037C843123B7DFC61DD2BFEA0CB8A709D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254631, "uuid": "43ae49a8-6cee-416e-a86c-970aa16cf53f", "value": "1536:TNP29r2y/Jqyep77gistdbs6/8X0OeMQSqLxLj:T52EQJLep77XfXSfLxLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780254631, "uuid": "404cd515-4295-487e-9ade-8e63e1c523e8", "value": 62972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780254631, "uuid": "a62e7df2-9982-4b76-84e4-bbe8f638b7d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254631, "uuid": "e0647c72-91f2-415d-8184-acabb3dc789e", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72831fc-5c8d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780190023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780190023, "uuid": "fae5a8ae-10e3-4cc5-9d09-33f8a66df709", "comment": "Malware payload (Mirai)", "value": "052f9e3f95fa34b6f838d5f35146b71b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780190023, "uuid": "5d4134af-a57d-4a9e-89e6-498204a3a176", "comment": "Malware payload (Mirai)", "value": "cfecb8e1cebf4bdf795d6c273f3c675aab0db87e7966deb24ee76b585a0359e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780190023, "uuid": "c549a5cc-4c44-4fdb-bfb5-47c3016b8a0d", "comment": "Malware payload (Mirai)", "value": "c12e074f678ccc4d33cd93fd32d18c5d77f7c574", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780190023, "uuid": "8677f8d7-7393-4ce0-b04f-e38a348c2c62", "comment": "Malware payload (Mirai)", "value": "16f962844cfb00e8c410ac3f26aeeac558aea02104f3c2e3ab1a1aa9b46dfd95d73950968d825a0ee0ebbb73ad3cbe98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780190023, "uuid": "7f7e4899-d0e5-4801-b3d0-c1292c06ddb6", "value": "T1D1B31B42BD419F13C5C321F6BBAE41483B136B78D6EA3103ED257FA1278B8DA0E67611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780190023, "uuid": "9219fd20-c625-4eff-8c44-c604662b7486", "value": "1536:O0Xr27mkYuRVoO2eSTRXfjXIxDV55dpzA83e9b4Qqkha2OsEv54Re/8YVl+7gfKF:nr2VYAoO2BmDlbcX9b4Qnk6Rq5aIgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780190023, "uuid": "70507659-b335-43cb-a1b8-c9e760ae051f", "value": 112688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780190023, "uuid": "2a89139d-3293-481e-b9e3-e55cbc581a97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780190023, "uuid": "3a4abe0c-314e-4c27-812c-b1b88b6fa221", "value": "data.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6602068-5d28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256486, "uuid": "d0654ff9-51ac-4304-8e0a-fa5aa2a933dc", "comment": "Malware payload (Mirai)", "value": "98090fc4c36b2f9fbf004f4f7d810bfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256486, "uuid": "e913370c-e828-4678-9862-1bb1ade8f054", "comment": "Malware payload (Mirai)", "value": "cffcb4ec86c2237ccae90f6cc17fecb02e6193f63162e391f64157a359d6feb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256486, "uuid": "ffab030c-119b-4934-8801-65c807daf6f5", "comment": "Malware payload (Mirai)", "value": "f65b67cd4cc8cf1e74c652862002a05b8139128c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256486, "uuid": "48b05ccf-e190-4a48-90a5-444727c73367", "comment": "Malware payload (Mirai)", "value": "d2942103e29bb87cf12ec983c10b6c348db403a6208c653099f81cce0c4fbb82f2141c37c997db7cad7dc41d053b292b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256486, "uuid": "3b5cc90b-ad68-4a8e-8aca-f5c29323e1e2", "value": "T1E9E3F649FD429B01D5D626FAFE0E428973535B78E3FE71029E245B3163CAA6B0F7A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256486, "uuid": "25097505-9b0e-4488-b465-71eb89f320b5", "value": "3072:4fqwxZfzYaVpKYZoGp50F0U680J5mfRG7PwdaBf0Kfrbv3fEACsgwZ/d44DBqv:4fqwxZfzYqNZppqF0U68SmfsbmaBfRfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256486, "uuid": "ca799a81-78fe-49ce-b134-bfdbff342225", "value": 153580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256486, "uuid": "73fbb259-7eab-4c5c-bf7e-7b84ab1c8c40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256486, "uuid": "fef76dc8-9663-43ec-ba2e-c3578eec2b93", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ba2590-5d2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257832, "uuid": "fa78a46d-aefc-442c-a5e4-107fe0f103ef", "comment": "Malware payload (Mirai)", "value": "6688da4fe721b07d813895b2b69bf3dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257832, "uuid": "f91dbf32-bd39-4444-afee-634e1d121e82", "comment": "Malware payload (Mirai)", "value": "d0573cccfd42e0fcce21657e9e4ff98d4bbd2770edd8bbba08563b026ba9f4fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257832, "uuid": "ae864b39-eb2c-44cb-98cb-21e2d77641fc", "comment": "Malware payload (Mirai)", "value": "e314432290320207ab3c2d7ed58e996cfd393b41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257832, "uuid": "b63636f8-5245-4e15-bb3b-0fd1197460df", "comment": "Malware payload (Mirai)", "value": "91866287c13aeb7b8c021fac0592303b127e2a0389c54ad639d5313d81c3e07232ebef7fb4699f195e075044d43ceaca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257832, "uuid": "523190c2-ca75-4835-9f4b-07bdd5db9ff3", "value": "T13B156C5BB2B374FDC057C43443ABCA72A935B42902226E7B65C8D6303E17E701B5AB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257832, "uuid": "7d65faac-b8db-4bc4-963a-9b1cd5bf20ea", "value": "24576:DzRRl4s4kvtpyUcPNlSOStUQL4ASHFtG6q:XRr4s4kVsYjt2V7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257832, "uuid": "34778a73-a77a-4cdc-9243-5e4589a1ac51", "value": 894152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257832, "uuid": "3f09b646-ef5b-476a-88d7-7995e306f067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257832, "uuid": "e732ceb3-0391-4eb3-b3d6-ae2a5754a552", "value": "data.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6e5748-5d15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780248279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780248279, "uuid": "9e318768-f2ca-493f-8f02-cae30f27297f", "comment": "Malware payload (Mirai)", "value": "2338cebc4f31737cf68b22a8acdf90d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780248279, "uuid": "e87a8cf0-8ea8-4413-a7b0-f3335fe2d239", "comment": "Malware payload (Mirai)", "value": "d0667cc345a45dbcffd133dbcee3b2b41548df5850239284e71f4bddccf86be4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780248279, "uuid": "33b9257a-42ea-45a9-aa8d-c3208b0f9acb", "comment": "Malware payload (Mirai)", "value": "428cd5ba191a4d3908b9722bfee4d15fea9cf07b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780248279, "uuid": "862a0665-a34b-412b-abba-ef88aba5525e", "comment": "Malware payload (Mirai)", "value": "5abaa8f6192b0e6f5a9a17dfdd76f0db772ec98dbf7067a0a057b906d3124c0e218a0f5c2a568d068c679f7a3a4ee309", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780248279, "uuid": "ce207baa-abe4-4e62-9c2d-5052f2b456bb", "value": "T1FD53F1A673A9B1BEC462643B18020750BEE12C84360F677D9DB5B3FDD863C596B83B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780248279, "uuid": "2fcf3742-fd38-43e9-930c-b976ed67c980", "value": "1536:P6eDjoNVyyGeHWpbjMEB2gzOs6kcm1ckNt9ZlQ:P6eDjo+yGe2bj8gzWkcmJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780248279, "uuid": "d57268e4-210b-438a-b821-c4a61263e1e8", "value": 61056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780248279, "uuid": "d494093f-a979-44d2-904a-b01f52c444fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780248279, "uuid": "396fa455-d177-424d-8521-af117582d9aa", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04170b3b-5d27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780255757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255757, "uuid": "5cae2758-9fe4-482b-a795-f3f610cead0c", "comment": "Malware payload (Mirai)", "value": "68c9c0bd56ee62d3d5e4405f02b488d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255757, "uuid": "b6b76e7a-7569-4494-8e3c-16b01e7addc9", "comment": "Malware payload (Mirai)", "value": "d2011f83fa243f6c45de15c5f63f3304e794fec839210135c0dd465909b52901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255757, "uuid": "640687cc-163c-4aa0-a885-a48fcfa4a20c", "comment": "Malware payload (Mirai)", "value": "d78ee0fae8ea31a9ffb9d1a9ba09e188b8c9a32f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255757, "uuid": "2149880f-41d4-401d-a6fe-9c93e5ca27b0", "comment": "Malware payload (Mirai)", "value": "56b942d52e358c054c2d463cf302d068bc79a1bdfdfd72f57ea774d40d7528cb768a03ee36f51e4426cb0605bc9e1717", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255757, "uuid": "5e1dd6af-e2cd-4277-a9dd-6982be3305ea", "value": "T1A3F33ACBF900DDFDF80AE37B48134D09B130B76610824A377257796BED7A1990967E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255757, "uuid": "601337ad-3e8c-45c2-8e04-93f271ca58ca", "value": "3072:q3CeJTZHtIeK2Aivc0FQPem1l1zhJElVfjbiML+zT/iy9/JO0:rehZHtI2pFQPeslHJE/LRy9RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780255757, "uuid": "0069afa1-d950-4fc0-a1a8-f5c0b71f4df4", "value": 169740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780255757, "uuid": "e1046f54-d1b6-4048-af69-bb10310aad0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255757, "uuid": "5e318a65-10c3-412d-9aa8-5b471e385974", "value": "micro.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d28f22d-5cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233627, "uuid": "20011641-e148-4b01-b505-512de69a29e9", "comment": "Malware payload (Mirai)", "value": "4b2b12bcb4f6567fdd51c014a20d39f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233627, "uuid": "7dc0f5f0-a9c7-470c-8cd5-4cca03f8702d", "comment": "Malware payload (Mirai)", "value": "d20a9dfecb10dfd87ca629fa0ef5c481606ed0e4d6af2c5fcb0fd67b56bc56fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233627, "uuid": "de4e7d39-e38f-4875-9205-10f6adfc9748", "comment": "Malware payload (Mirai)", "value": "1f01525aa408182006bf53fafec2fa776ce1f265", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233627, "uuid": "0e1c6698-1535-4ec9-b5a5-3bd207f93c86", "comment": "Malware payload (Mirai)", "value": "62292bab3bce4cf83a7a332cf74db24af293c665b38f0172917f56eefcb2f683ed7e7637f57223973254dc1657d94871", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233627, "uuid": "cc043e56-d626-42cc-bf92-a5e284dedd53", "value": "T1EEF3E91E7E215F7CFBE8823457B39E60A34823D72AE1D585D16CD6105E6028E386FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233627, "uuid": "5fdd590f-40c0-4f7c-a333-1ffc644268e8", "value": "3072:edmCCBNHvOb7w0FKXwpxjgUzKUPD9JjLxOPxalmL85qGyjfAbmdhz:eE9i75FKXwXjgUz/PnjcQlmLijzydp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233627, "uuid": "73565bd4-57e0-442f-a3d8-5faaf3aaba97", "value": 168152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233627, "uuid": "a68fe30c-d40e-4ca6-ad51-67a0ae5de799", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233627, "uuid": "f63b2ceb-b156-4273-a233-88592e11ff98", "value": "023782pler.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5aa6f3-5cf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780234622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234622, "uuid": "7d12a574-97c5-4d46-ae1a-f992d76c4ada", "comment": "Malware payload (Mirai)", "value": "5e7fb827bcfc67b8da8ca6e2da32f9e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234622, "uuid": "f0177283-e00c-4832-9098-38e087d61018", "comment": "Malware payload (Mirai)", "value": "d3b35febaaa3842282e923a8bb9dc954ca172cf0f8ffd9a6b85761175913d6ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234622, "uuid": "0fbee52c-4584-42b7-ab20-24662da47b07", "comment": "Malware payload (Mirai)", "value": "24556233a0b2f824dd0e5537bd7bbd9274dcaf46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234622, "uuid": "14c48b03-bc84-4cee-855b-165b55921c9a", "comment": "Malware payload (Mirai)", "value": "3165fd9c27e648b1da1a3beeda491deda45b237cf1d07124769b7106262241b6670eef774dcc3a491ba8302659ad140b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234622, "uuid": "63f542c6-c4e6-4b79-985f-b2d3f7f76412", "value": "T11FC30649ED416F11D9D635FEFE4E028933530B6CE3FE7112AA245B2123CAA6B0F76506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234622, "uuid": "1c645e3c-f6d1-47a2-9c67-e03dbd0677ab", "value": "3072:M1x3guVDMl7nkAKyjaQbOQtiyJ4+pWpeS9pOIvddDT6tk:M7NpS7nR/jaQbtiyJ4JpnOkdDT6tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780234622, "uuid": "b6b98ab8-e12a-41a4-b5bb-355509c4292f", "value": 124640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780234622, "uuid": "04df3261-7f63-441c-b8c2-5f53845964ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234622, "uuid": "e39d5a0e-cc91-4000-8c82-7daee5f0181c", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e330e1-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1780214232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214232, "uuid": "26c205f5-334d-4e8c-b9c5-155824ead637", "comment": "Malware payload (Prometei)", "value": "d38ca536050b41c7942b078e5990e112", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214232, "uuid": "507a44f0-f106-4f50-b1ba-e649c5df019c", "comment": "Malware payload (Prometei)", "value": "d60f07966072cc1bcf8bb07023301233a9e8024cb30d40d167d78ecb6e731e0e", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214232, "uuid": "6e1339dd-c356-4b87-9fdd-859e057ab717", "comment": "Malware payload (Prometei)", "value": "8abed0d5818c690241f8145f625ef7271ac1e067", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214232, "uuid": "8e82cdf8-31bb-4d7f-8228-01eacfc25901", "comment": "Malware payload (Prometei)", "value": "e81d5a8070a4ee42213c462e5e80712c558183cf1cd444f788d98eced9b722a6b4271fc73ab445cf4ef5095fe008e393", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214232, "uuid": "8bbae4f2-4a62-42f0-8337-049eec91f500", "value": "T1EC31A0CA79A3D871978BC4381FD6E101E35664430995DDD8B05EBC303F5D560FCA1E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214232, "uuid": "1a919836-64e5-4989-8ca9-7c9475403d7d", "value": "48:vMVdxtzGG1eCFeZdzVKN5Q1f/neHuDmmlBFInKIYgQAul4N7vGxk:vGdXIu2mQlGaL2nKI3QaTGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214232, "uuid": "5e002550-f3ea-4376-934b-0f22d3e6b058", "value": 1846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214232, "uuid": "ae07bbcf-1515-4b3b-a7eb-2747cc595ec5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214232, "uuid": "f11f9955-970c-44f9-829b-4f7614d17a00", "value": "d60f07966072cc1bcf8bb07023301233a9e8024cb30d40d167d78ecb6e731e0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ba0060-5d2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780258248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258248, "uuid": "d4cd80d8-4c20-44b0-8a40-d954a37fc69a", "comment": "Malware payload (Mirai)", "value": "72531978b42c38930c6ee8136bd59479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258248, "uuid": "c0812945-e329-4ddf-b496-c5bcd5702ff7", "comment": "Malware payload (Mirai)", "value": "d7065a3d06d929e933ac389cca4d0a1c3b66716201ed5d5d6e24089851c690df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258248, "uuid": "b6faaa41-72cc-4c05-bb87-b3f3754472ff", "comment": "Malware payload (Mirai)", "value": "b3ad0de91be5b3697ae2338f029f6be21e840bca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780258248, "uuid": "2c813895-50ba-44c7-9736-436a20890a1c", "comment": "Malware payload (Mirai)", "value": "b3a7bece8a903da4f8ea54c5360489c64a67973ee3b8039baf8840c99814d36973e1a4d0727b0d243d963fdc985cf1da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258248, "uuid": "b46608c8-cf56-487a-96bd-038dd5f7644c", "value": "T18FF34B83BF83DAF7E55300F141F79B221A31ED3A0422DA5AD7B47DB5A8516D0E60A36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258248, "uuid": "f081f262-cc97-4a7a-ac13-7a80d2b0f08c", "value": "3072:79gyPA+a9mf1tRaBqZxv3i7XE4FcBGTR:7JPA+a94lZ34UYcuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780258248, "uuid": "8a4c5109-5faf-4542-b594-cd0abc55d27d", "value": 159432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780258248, "uuid": "4daf675f-4fea-4293-b2c7-ad7181146955", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780258248, "uuid": "594767a3-a954-443b-a61f-93e831a31487", "value": "wife.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4391868-5d1d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780251812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251812, "uuid": "df125a7f-8c6a-4b10-a9d3-68f3d01c2f15", "comment": "Malware payload (Mirai)", "value": "2f2008a4bcd40b337f1b717242de0cfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251812, "uuid": "ef143384-d696-4884-bac6-4f6a47338636", "comment": "Malware payload (Mirai)", "value": "d7a1b3e8151f3ec69d8f3fbbbe43f7800192c3f3dfa43fb48a853c1fd978e4db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251812, "uuid": "728bf654-2ec4-4f06-8dd0-b68ac68de9dc", "comment": "Malware payload (Mirai)", "value": "e34aa0ce760e75331877008cb4f8fe8da23441c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780251812, "uuid": "a914cd62-7a7b-4096-831d-7992878b61e3", "comment": "Malware payload (Mirai)", "value": "9d6ec0d19198c03135bdc2f24d0e4a7b5a35b9490e1fccb8d22ec1b009288fb7b37bf862473a30f21daf171505a99a96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251812, "uuid": "a18af119-853e-4c51-8780-3cd09401063c", "value": "T1D1041946FA518F13C5C755F7FBAE02883B266B6AD3EB3003D9256F6437864DA0E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251812, "uuid": "e0930572-fbb6-4ec7-85c2-541e9ad69739", "value": "3072:s7IMPTODsF8f6VBwPAQN4uBkqneIypBksgCRUqy:IVPTODWBopN4Okqn5ypHgCRUqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780251812, "uuid": "b5d595a9-6127-4f50-97bf-008e59540320", "value": 175996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780251812, "uuid": "06a1bf76-90f7-42ec-9a3f-5f437a65f0b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780251812, "uuid": "ed1d8be8-c541-4a59-a952-1dca9d7e4479", "value": "wife.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b4066e-5cb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780206529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780206529, "uuid": "1462bf91-2a59-42a6-8789-3c96ddcb9f00", "comment": "Malware payload", "value": "04018db6358638e0d92ffc5428345b7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780206529, "uuid": "5688f307-7f0f-4736-be44-639ac3922b1c", "comment": "Malware payload", "value": "d8a6f6dfb5eb99796a43af7742bf76caa7f1c1164f814f16f88bf41426db60b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780206529, "uuid": "0302d418-f963-4ee4-af93-9f69b7a7f3f6", "comment": "Malware payload", "value": "3dec6c884c2901fede459fb36e734357341122ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780206529, "uuid": "dfec8fbe-fab6-4668-81f0-902f089607f7", "comment": "Malware payload", "value": "9b9634bd06f5cd45bde431ff89d5317c45823148ca236c4fe55a819b3804a4e862a60f986e27a4b0c6616c6577c4dac8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780206529, "uuid": "85e716db-a361-4e68-acce-66e15bcf7ac7", "value": "T1EE135CA3CE3A2D18D2A98575B0211B799773D465C1571FAA447AC33AC003EEDF44A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780206529, "uuid": "d737ac75-8a95-444a-aa28-b7f2fc01c0af", "value": "768:dkwIJaHedxarmTX5iq5OnKCrCVZ7ca9N/o15H7nUCD0VpdfXmSKI:dtI8HedDTJp5cKCrC77/9NQ1BnUCDM9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780206529, "uuid": "e91584d9-da87-4820-8bfe-0786a0fa5a35", "value": 43584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780206529, "uuid": "46a2c1f1-5dcd-4786-af19-ceea15df3adb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780206529, "uuid": "76404579-f2da-47e1-93de-b2c316a14bbf", "value": "11.tok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319cc229-5c8a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780188403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188403, "uuid": "79eea0a1-5f33-4722-8cf0-7630d9cb8d4b", "comment": "Malware payload (Mirai)", "value": "9c2921da7bf3847d7d93af48d4d288f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188403, "uuid": "5271eb3e-a450-4c87-9c0c-0059c3f1ec06", "comment": "Malware payload (Mirai)", "value": "d950ca9aec3a8866be649e70e59535e2187a64db4bc02a8a1f9eecfff7d241a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188403, "uuid": "84f6ae82-a8dd-4355-ab4d-2fbad797865d", "comment": "Malware payload (Mirai)", "value": "a859bfa2ba94233e6bb3f79246d77894c76e2586", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188403, "uuid": "69d70535-8f5a-418d-9782-97e4584ad90c", "comment": "Malware payload (Mirai)", "value": "215df1e36364fa4939e2f3b200bd0cc73da645af64d0c813c7e4b2ebdac9cb1db2e60c3bca186c72edc3e8809bc373c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188403, "uuid": "c5f494a8-af50-47a7-a2bf-dea8f5869875", "value": "T100E39248EE64AB2DC3E332FEFB5902CE336A1BD8B7E670218D354A5537C8B55A535120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188403, "uuid": "6c88b053-90ae-45e9-8f77-518ed79849b5", "value": "3072:87TVt9dEYVQUNuEuJ2qVqyD7NkvTjtMOI7mohM5BiN9SXf63:w2kPiVmohM5BiHSy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780188403, "uuid": "ed4769fa-7ddf-4377-b95f-c0455d73e3be", "value": 144540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780188403, "uuid": "980439ee-54dd-4429-8524-5e59145b7d24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188403, "uuid": "33efb4a1-622b-4748-bf48-cbe89863f40b", "value": "d950ca9aec3a8866be649e70e59535e2187a64db4bc02a8a1f9eecfff7d241a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741636cd-5d14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780247785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780247785, "uuid": "7d1417fb-0ecc-4cec-b812-7b1a2006913d", "comment": "Malware payload", "value": "5b4b8769e1bfa31ce3ae30ea0d8a3f81", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780247785, "uuid": "76e836f9-7931-40ac-b608-28eab29a982b", "comment": "Malware payload", "value": "d974f530df16e9b9ea2bb2852b1aa6aa88895f9ea328abae86c8218d725e61e3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780247785, "uuid": "724962db-ec4b-4b56-886e-2cda230f5674", "comment": "Malware payload", "value": "5197d20a3fca94c70f665a00aec608a1bd0f9235", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780247785, "uuid": "8d04b123-f6f7-45fa-8a31-9b01d7209e65", "comment": "Malware payload", "value": "ed4e8bf6fad1e8136260d7a16c642e61f05c798e4ff25da0ae9c7e657e84fff457028ade72d49351150d55fad27ffbb0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780247785, "uuid": "774c6b12-fae8-4bd6-8939-78da71a47d7d", "value": "T1E5E312B4BC87CF3EF89B1838B0569841C86D970E771CAD669C7804B12B7A5070762EED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780247785, "uuid": "a05fefb3-3755-4551-9c17-e042d34ce7f1", "value": "3072:zSkISZt0Tsc4cHNAOoXOboBNr4EYvLYTy5b8/oezjyidl:+9c6PZmBxYCy18/BzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780247785, "uuid": "beb3a8ed-4949-43e5-b6db-53f5915024e5", "value": 143192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780247785, "uuid": "15f17a85-30dd-4d1e-b31b-4ecf199b3a44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780247785, "uuid": "e54179e3-02d0-4f1c-9254-62dd8f7b1cbf", "value": "KryptonCracked-1.21.4 (2).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bab0ff-5d29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256664, "uuid": "0c7ccf8e-f15f-449e-912e-21e4a1fb0b5f", "comment": "Malware payload (Mirai)", "value": "b1c7c91cbdcbd7aa1c9a79806185976a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256664, "uuid": "bbbfadc4-43cd-46bd-816a-05f656e18225", "comment": "Malware payload (Mirai)", "value": "d9ca12806c0a239c6b4395222a473c1fc7a5a77b95cd6789484906c70e8a599f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256664, "uuid": "738afa5c-c55e-4be2-901a-36d3350cee73", "comment": "Malware payload (Mirai)", "value": "423cdd81e108a0c9d37235fdd7166e8a0e0f2080", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256664, "uuid": "527c4182-19ca-410e-b391-246f0b7377c0", "comment": "Malware payload (Mirai)", "value": "6d4af83b887dcda4bcc9ac36a639ba0bcc49d9291753d613bec9b594b61c0d09b7552c2070fcd566f954dcbabd0feac0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256664, "uuid": "f3db0251-b2be-4155-b410-1171be248cfe", "value": "T1AA7302024E4736B3E89962B9D64C1A8D8CC04322D1FD99378361E2D9B7D734197F9B8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256664, "uuid": "d2d1401d-4837-4535-9956-9942f1d229d9", "value": "1536:hMWCTiu413eJd20WuOwWBO2Bdr6TckapOiCL5js+LmC0u+CjDsR0:Xyiu9JdhWusPHOTx+AL9+C0uEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256664, "uuid": "2e127645-a28a-40ff-b7e1-8fd677c53b8b", "value": 80228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256664, "uuid": "923711c7-a4fb-449c-b24c-705c9f64abc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256664, "uuid": "2591923f-12f1-4b96-b9db-b8e2debc8b35", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2caf707-5d28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256453, "uuid": "2de93681-f11f-4a29-82fb-5dafd8acc481", "comment": "Malware payload (Mirai)", "value": "c9697f0fbf2af0962f67a702b353477d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256453, "uuid": "3d3cef7b-e32b-4474-9c71-3c2582389bfc", "comment": "Malware payload (Mirai)", "value": "da53de2557968ba91de993217d625deaf7425e95e5c9877954c3b8bff0e6c1f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256453, "uuid": "93741143-9d5f-43d6-ab5d-c4c601aa7c9d", "comment": "Malware payload (Mirai)", "value": "c828c4003c27f87e41ab8d1fa48319855881b57d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256453, "uuid": "65d86656-0b86-4774-ad4d-6c56033c9e1a", "comment": "Malware payload (Mirai)", "value": "056d89eb8019a4d6e2db5f494a79a7b3d4d6198b9010774351dfbc58d77315c81b51580a6b7d2a835a4946335a22f1d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256453, "uuid": "bca69ddb-fa1e-4601-948b-8e6b43ac4704", "value": "T14B34751A6E22DF7FF668863047B78A30579877D63AD1C585F19CD70C1E2028E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256453, "uuid": "acb9ea66-95d5-4af7-a674-a92a83c75462", "value": "3072:aXrH/7x7q7li54o26l/+4mWgHYKNpgylr7V8sr:aRe7cF2HYKYQr7Osr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256453, "uuid": "44745920-4046-4c36-8aff-e88db5558e7a", "value": 249444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256453, "uuid": "aa52afe5-5c37-4cc1-a5e0-010c16be9c86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256453, "uuid": "9e9c7298-1e92-4661-8d11-8539d1b6fcf9", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1be4039-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780214441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214441, "uuid": "e8d6a98f-b919-4323-8744-dde7c95cb28a", "comment": "Malware payload (Mirai)", "value": "32ed99a6852c6f810da3bf757823725d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214441, "uuid": "49e573cc-ec5a-4023-9e2a-5c914e8a2220", "comment": "Malware payload (Mirai)", "value": "da8e7a79c5eecb78d47372412b9979df174e1ac384d55c70b68221dad6fd575a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214441, "uuid": "a538f20e-bc71-4aaf-879a-14a7544b2003", "comment": "Malware payload (Mirai)", "value": "b4a4f58165d9f40ae9aeaf553ce935374922a8d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214441, "uuid": "1ff5905d-87f0-41ed-a931-64a31db4e5bc", "comment": "Malware payload (Mirai)", "value": "64f1420fa40b5cd23d48c317f77f5665b8f76e327ced14588f6f14223f763d3ea3029519cbe544c4bdd1d7f8700fc266", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214441, "uuid": "976ffbc2-19ea-45da-86b4-c879adb1497d", "value": "T118F33BCBF801DEFDF81AE73748134909B130BB9150824A377257796BFD3A1A90967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214441, "uuid": "48cda7eb-75b0-46ac-9f63-9c143ae930ae", "value": "3072:b/aVFBPrCN9TQU8kdtLdav+yvLcAs7oNVOjbiwLrc0YhlkyygpeY:GVFBPkxQKLBav+yLs7o0LkkyygMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214441, "uuid": "4d3fc9c8-462e-4e06-825a-e7f1a3be05c3", "value": 163532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214441, "uuid": "831b782b-0dc4-4c39-8892-bd6a319dac89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214441, "uuid": "e415c420-7efc-4941-a787-bee426fd272d", "value": "micro.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee7c698-5d4b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780271318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271318, "uuid": "cd4b241c-557a-45e6-bdcd-5d98dc87745a", "comment": "Malware payload", "value": "9b65d781f94725fd3255a33241ed6b72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271318, "uuid": "81d1b3a3-3442-43a0-ac93-97a30c03f312", "comment": "Malware payload", "value": "dadb97c1d30295ea476b37461ee7988300ae8483b0c2372effd980a607cebaf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271318, "uuid": "50200ec6-e48c-417a-ad54-bff2d0522317", "comment": "Malware payload", "value": "b6e176e4105242467aa1ad01924cd6c7fa5654e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271318, "uuid": "84732b7f-94a1-4121-913e-390214c13892", "comment": "Malware payload", "value": "4c275e4d90fd73ffee06da482c07c1b0834505dbd2d4006e6e0e86e028814dbb34c8d59f05a0e93eab74b1c362cdedb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271318, "uuid": "dd11d3b7-6c8a-4c48-88f9-f6636c24021f", "value": "T15FE3765E2E328FADF66C833547B74D24976923DA22E1D684D2ACC1146F2039E541FBEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271318, "uuid": "48f4aa96-278f-4608-bb42-6081b79a2079", "value": "1536:6KwhiqIkOVi1qa2acVM158n0kjAgaje95VnJiTCT23+BIzztmrwZi:rUidkoi1yznBjADG5Vk7mIzzsrwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271318, "uuid": "9a612b59-affa-4ad6-b68f-94c33adf37cd", "value": 149572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271318, "uuid": "a7414f64-d432-4aa7-a813-7fda18d89f3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271318, "uuid": "c3b16aa6-84db-4b21-91b1-d916d9cc3104", "value": "gov.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ac7866-5cf9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780236188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236188, "uuid": "dab9da57-356c-4491-89a1-ba7df425618f", "comment": "Malware payload (Mirai)", "value": "bf3af0c3bfcd2d4a5a3f15181f6933d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236188, "uuid": "e2eea40f-2152-42fc-97ea-1b5972a5299a", "comment": "Malware payload (Mirai)", "value": "db438a070bf17891aae00a7fc9ce6abe7d799dbbf8320de74e0ba807ed54db24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236188, "uuid": "7e17f4c3-997f-4ece-ad8a-af07c0c63dfc", "comment": "Malware payload (Mirai)", "value": "af0660ebbc8e9d7f46fa7d9743afebe34b693ea7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780236188, "uuid": "afe7d699-4822-4f8f-8cf2-14f0cd60bbd5", "comment": "Malware payload (Mirai)", "value": "c0a41eee74d0d0ab929e192d65f6e92c62fe0183e6e40dc2499f04271291fd337439df823974afe516cadb3604224efa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236188, "uuid": "512a7735-f105-400d-a7d1-6f8a811c3cdf", "value": "T14BD30945FC459F16C6C265BBFF4E428D7B2A0768D3EE720399256F20379B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236188, "uuid": "eedbf6ad-1638-4154-86df-b6235ffd0974", "value": "3072:dSKanS0OTYycUuB5wQFlt/w18I7BvmQjNX:da1m/ctjwylt/w2+BvmeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780236188, "uuid": "8495fa59-2933-4e54-8dcd-d29a1a2c7814", "value": 131928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780236188, "uuid": "2b27b7f8-0696-4f9c-80f0-ace3d503d5d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780236188, "uuid": "0288797f-179b-4558-8bd4-71600826fb70", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167c0fa4-5cf8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780235602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235602, "uuid": "a7987ae3-11d2-4a4f-b00c-625a8db781c1", "comment": "Malware payload", "value": "8b84cfbecfa46a443a30b81089ddccbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235602, "uuid": "1cb23ed8-2369-4045-83ad-2908cdfd5b38", "comment": "Malware payload", "value": "dbdf27935e88886e5e787a2dfbdac1530723c29cfedd52ed40f7005e77c0623f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235602, "uuid": "e27eedc9-ec7d-4e99-ab28-a9506d79e57a", "comment": "Malware payload", "value": "3fcaa72f0616ab8ce4bf66cf5944d050b2ff6687", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235602, "uuid": "3fe804db-34ba-498b-938f-f143fdeba306", "comment": "Malware payload", "value": "21999e22a696efad3ce88fdce4ad01b04e01edfe6f859826a03fd6705c1aded01142795bec190f19bd4cc8aea7f9ff93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235602, "uuid": "3e4b4158-3498-46b0-8d55-bb0b8c425fa6", "value": "T1FFD35B17B5D0D0FDC8E9C1B84BEAF126DA72B0295238B21E27C46E672E5DE205F6D710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235602, "uuid": "c2845044-6e41-488c-8a97-3ca09e35981d", "value": "3072:4yE75oxStAzq+cA+n1PxbSaAyezqZnfhIPXhuPd1eM:l/0pb+mZnjveM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780235602, "uuid": "d002dbb3-880e-4531-af30-20d3a77abb51", "value": 140648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780235602, "uuid": "35fa3839-0f91-48e2-bbce-0a066c6289a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235602, "uuid": "920b24e6-6e3a-4d7a-af2e-a8413887802d", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ccd167-5ce7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780228481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780228481, "uuid": "796ed7a1-d7f4-4736-a256-e8f6d3446cc9", "comment": "Malware payload", "value": "e80d47d3dc3fbe3f628b5acf8d2c6e3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780228481, "uuid": "d042c7c7-f54b-448e-9565-601b320aec99", "comment": "Malware payload", "value": "dc877c28832b063451919c3d6dc89b3cd7b6de43161e98ea80d9d9cbde4b6e71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780228481, "uuid": "745e7e57-b92d-46fe-956e-c7b387e3bcda", "comment": "Malware payload", "value": "e3498ad5367a0f0a97fd462725095708454e82b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780228481, "uuid": "6b2ee82d-d58e-403b-af70-166f3ad9f198", "comment": "Malware payload", "value": "c6e65d647af74e28a96054041c99b855ac7b1577dca69407d8f46c48886bed982aa3f8fe1c3def1b75aa687dff0207a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780228481, "uuid": "21de54c9-6d3c-43cd-90ac-f450b5ca1f4c", "value": "T1C253F857B8D0EE73C6D43579BA5E42AC33134BB8D6DA7203CD247E2536BA45A0F3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780228481, "uuid": "dc4d21f1-dbec-4b4f-8310-0247a24f4bac", "value": "1536:om3yABNFTAqHcibFrxq3/TlOUrcfeuLSQj:om3yG1bFrW0UrHiFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780228481, "uuid": "b0b8b801-db02-4201-92d3-8ad1c9bfec34", "value": 63024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780228481, "uuid": "3bec3d28-9e77-474f-bbad-9ee219d005c1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780228481, "uuid": "3800d224-5545-40b4-b2d8-1049988b78ce", "value": "slO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273871ed-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213296, "uuid": "048417b1-fdd0-455f-b0df-630fd97143fc", "comment": "Malware payload (Mirai)", "value": "6837ecbbc15de1e119e14ec7b8c41409", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213296, "uuid": "42b32cfd-c4a9-4db2-a863-1e22891cbf69", "comment": "Malware payload (Mirai)", "value": "dcccc2abd0686ff1a08c9f8505a36c14717140434c7f79f686447ccc17c4a043", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213296, "uuid": "adeb2ac1-9955-4c2d-aeaf-c7f294dae171", "comment": "Malware payload (Mirai)", "value": "ed66eaee119a43ce6248ef6eef2a84d21185d6a6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213296, "uuid": "dfd4e685-4d3f-41d2-9ae3-ce343d8986ff", "comment": "Malware payload (Mirai)", "value": "50e5964f4e61eb06cb2ebb1bed7a3c7f51d66a01657806f55ffef99c5d834f8f654f3dc7fe6f84bf76c28c5819155e6b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213296, "uuid": "1e5af9eb-95b9-4ed6-a102-10f3c6c0868f", "value": "T17E030751BC829A37C2E1137ABA6E5A8D336163E8C2CF7217DD214B20BAD511F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213296, "uuid": "a4215433-e0da-4198-9f40-333cd1736f26", "value": "768:MglA4CbIsG5f0OhnlUl0O9FRA1wArb9/3W5uv+bhLZAZXoTJ/NbwWY:MyabXG5fDlUlXjwVe4v+cZCqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213296, "uuid": "b96569dd-23b2-4fe2-9eb0-75b416b00940", "value": 40744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213296, "uuid": "2e0bce21-38ef-4e84-a6c4-a936f937b3ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213296, "uuid": "f8c95dd6-e9f3-407b-a5c2-f7ab1126b92e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e7ad78-5d2b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257475, "uuid": "7358aa26-808d-4a55-8f4c-3dc607e6371b", "comment": "Malware payload (Mirai)", "value": "469dcad76e72a2adeb7ecebb1c378373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257475, "uuid": "48ef920e-1be8-434e-93de-a6175e0e75c3", "comment": "Malware payload (Mirai)", "value": "dcf3195b8ded894c14dd5f3602e7728cd202024447f2b4b5e85d06cfb77557ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257475, "uuid": "3a522664-9cd9-4e98-890c-e81eefb00ac3", "comment": "Malware payload (Mirai)", "value": "e2f8b06c526af3253230dcc684d7de2e3cb302d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257475, "uuid": "075bd3d0-e458-4f57-92fb-0a213d81f2af", "comment": "Malware payload (Mirai)", "value": "570156fdcb567ecc0ab157dd68b7374932fe2f1489aa9f0e105acb43480c910403ba84820ae6ca0f6109126200bd4a49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257475, "uuid": "2fc98fa1-2d10-48a0-b143-aed84457b614", "value": "T148C2E1703140AA91CB34613CE73DC5536319E6FCD6FF35B669191328678344B62B9EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257475, "uuid": "797120c7-297a-4801-ae91-0357bd84d8a0", "value": "384:h39ODZ27QasDSanHC/fDQfmWQ9Dgkzmkw64WyC5t5zEDZt4Ex1VhymdGUop5hIP:V4Zpabi8sfnCDgk3wwuz4EVs3UozaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257475, "uuid": "903a16cb-7cea-45e2-b066-77e631e36532", "value": 27692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257475, "uuid": "d3b1e871-5cf4-4c25-9c8f-deee94df3f03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257475, "uuid": "b9596ecf-1dfb-4794-9ac4-791ef3591093", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73315288-5cf4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780234039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234039, "uuid": "21fb5892-9a6b-40be-9305-213b6c128b56", "comment": "Malware payload (Mirai)", "value": "31d56cb7e3b53a0b46a318f1399d8fe8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234039, "uuid": "7d34a4bd-72e8-4d7b-845d-c813c725cfd2", "comment": "Malware payload (Mirai)", "value": "dd3f5f85e074ed69356606190ce90d66ff2875c7645cb4fdb3dfbcc7515d671b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234039, "uuid": "9cbc9b4a-2ec6-46ec-a48f-986ef092ce42", "comment": "Malware payload (Mirai)", "value": "85a1a32932c527b1b1cfd4fd4b350b46ff901080", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234039, "uuid": "17516c0b-7a5f-40df-a055-bada8a6366b3", "comment": "Malware payload (Mirai)", "value": "b632342a1eafbb3909e482bfa6aaaeb9b37cd1c188c9084e1b76f8330e06d5542feb1a0e71535a8ac262845b388997e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234039, "uuid": "57545513-badc-4bfe-b955-1f0410d4aece", "value": "T161F3F709AB600FFBE89FCD3B45F92705158C591622A97F76B530D818F64B28F26E3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234039, "uuid": "36ad54e9-7223-44e1-9908-72e963598303", "value": "3072:zaCZvp+U7dmfvV+BB7IXJ36mnhjD/DjgpDClcAO2fV5WeEI:OCaU7dmf9+BB7YV6shjbDMpDClcAO2YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780234039, "uuid": "c64f91b4-82cf-4ee2-b7eb-e4e86da0f7d9", "value": 172808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780234039, "uuid": "fc45fcd7-a124-46d3-9f65-a6a6cfe2ec2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234039, "uuid": "eba6ea15-3646-42f0-8b42-6634251ac8a3", "value": "023782pler.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadf6938-5d0a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780243662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780243662, "uuid": "3fabed7e-3ed0-4217-816e-cc46e1db19da", "comment": "Malware payload", "value": "552582c6e2dcffde06cc0e1814ee83bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780243662, "uuid": "5381cef8-ad1f-4eb4-b0b9-e9e8cbf0996e", "comment": "Malware payload", "value": "de35595371d5ea945da9d23d1a85276a52bc96b7f8218e0ec406fef4c53926da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780243662, "uuid": "146e2866-fe34-4aab-a9c1-c749c99ec392", "comment": "Malware payload", "value": "90e16f203c224e294ddc69866666983dc40bbf6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780243662, "uuid": "54973163-49a2-49b3-ae5a-cf9c5c22f1c8", "comment": "Malware payload", "value": "016e7c4e9220b9fdc8bda706846cf0b13aa814e0a47ca7d20591b7d6bda1dcb49a0636a5c8a32a1e68801d8e538ac107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780243662, "uuid": "be8b5513-f607-4c07-9526-5139588265ce", "value": "T1DFD56A8B6C62E1E1C819B2B7649381717B28FC247B72A7F73A9861351F312C449F6F94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780243662, "uuid": "975003f5-c1b8-429c-8c14-77cfbe720342", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780243662, "uuid": "f5b573da-d2d0-44b4-83a7-28db8d90ac55", "value": "49152:jmWQDUU8EbtCPDixe4pSyyT1vrBV29uuKRMXq7Y:jQxPwb142r69pvaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780243662, "uuid": "dc304439-c392-4f04-b9b8-59e76252c226", "value": 2792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780243662, "uuid": "3bd48aff-1f98-466b-983f-b1e68632d4fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780243662, "uuid": "a5c9089d-9d88-4d34-95a9-627b385ba895", "value": "SoftWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f1cd4f-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250145, "uuid": "5579ca01-2d82-4fe9-a4b4-92340abffe89", "comment": "Malware payload (Mirai)", "value": "d0db4dde1be918fbcc17a7f783f7d59f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250145, "uuid": "f480a08d-3694-4eb4-bbd3-2e40e789c91a", "comment": "Malware payload (Mirai)", "value": "e0386ce4e313602e0b5603a3f250a3a18a2969a6d6f8057c4bb840204d31d2ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250145, "uuid": "c10be54a-f1ac-4d98-a970-77b074146abf", "comment": "Malware payload (Mirai)", "value": "694800bc7717a602171738221a3c84070566cf5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250145, "uuid": "efb156e8-2fdf-4cee-8fa7-5f0c35dfee10", "comment": "Malware payload (Mirai)", "value": "4a462bff1d0ab0cc858fcddb94020a78331e34f514a449c140c6e08bf134844f3dbf7886995f9d9ba3140ac98bcf4c50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250145, "uuid": "a5f6a149-831d-4b6a-b0bd-1066ab049394", "value": "T1F9A33A45BC819A13C6D5137AFA6E428D372623E8D2DF3217DE215F2037C682F0D6BA95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250145, "uuid": "e2dedb00-22b2-48c7-8796-81af5f31daf5", "value": "1536:IfmvRsNLS9WpzrXnooQPPhxihbjWFEMqNIonO4eTwX13nv3H:Smv9MjWOHar+53H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250145, "uuid": "35ecf56b-a1cb-4bc6-88ff-5adacfcd0c99", "value": 104848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250145, "uuid": "baaad03c-a94d-45e0-9e00-12bece824da4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250145, "uuid": "3c113946-f791-4695-a987-e30df0195ee1", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711dc5fe-5d27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780255940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255940, "uuid": "f5679b80-ff5f-49d8-8f94-9547136e813a", "comment": "Malware payload (Mirai)", "value": "93034bd1d1d9e800a3d17c71da8c6040", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255940, "uuid": "8c380275-3fe8-499b-be9b-e85cc593a846", "comment": "Malware payload (Mirai)", "value": "e0b6966dd719c9ae79ec96cc000ba8e26862cc8f1d330751f017454a07bf6cdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255940, "uuid": "72ecf98f-96b3-4e37-ab28-06e9a25a17e4", "comment": "Malware payload (Mirai)", "value": "f3dbb8559c93e56e4900bf5d14551ba2064c69aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780255940, "uuid": "5ee51edd-f5f6-4b21-ad5a-40516462959b", "comment": "Malware payload (Mirai)", "value": "29437568599381d6d96ff184d2772efb6bfcc4d43a54c3b8eb29646cf9f180e861052b37d196e72012d2eb17de88ebd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255940, "uuid": "1da103e8-2a6b-4b7b-9216-96142fac3930", "value": "T18853F213C5574815EF322E72B785C364ABC1CE8EB662F9C15FA04BFD608265A31748ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255940, "uuid": "57272b33-71d0-4e9d-bf05-65075b217764", "value": "1536:BMBf0bGUAWGAnH7mXJl8BDVTT3XdXhqJ3HVxNB8U4u+qgw0t45:BMByuLAbm5uTT3WJ3TNyU4u+qgwI45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780255940, "uuid": "ac3ce046-91b8-4157-8dad-a256f2d8d836", "value": 62396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780255940, "uuid": "804537ca-53fb-4f8d-9a09-cf6b72fb088a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780255940, "uuid": "f059d41b-49e2-41b1-a034-b8d6ca18ffcd", "value": "wife.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f76067-5d2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780259302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780259302, "uuid": "dd7507be-4d78-4637-89cd-e7bbdb1c7bc6", "comment": "Malware payload", "value": "fe92fda398fc6b55e3ef7d869fc7faf5", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780259302, "uuid": "02d4000e-5e85-4fd4-ad6d-c656c556922e", "comment": "Malware payload", "value": "e0e18088fca1a28d12d71afe1c505ebc7cb0191216dea0a8e5b3ebe88b48b29f", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780259302, "uuid": "eb8dd152-41b9-45c6-b87b-699c02f4bd94", "comment": "Malware payload", "value": "4b6f1538ad042cf50a5e2f1d5e7a6f75a143790e", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780259302, "uuid": "2c1aa422-58c2-4fd5-b354-12993bd4a9b1", "comment": "Malware payload", "value": "5ddd8bf6803bbe5dcdbf9f2eaa7ea20c861077b74b91b318d05f4636db1fdbbc856a20d2ef61cd0afb9f490cd4ab01f3", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780259302, "uuid": "c808abf9-bc75-4b1e-9dda-3214742f3079", "value": "T17732C07F5E79F030DCF3C3B27902ABC7CD8150645828077AAA7C8B71DA6C7A57280444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780259302, "uuid": "1557fdd1-dcbf-41ab-9e5c-2b8499bf2a89", "value": "192:NgMso7yCvC3OpslZDUVVnMNa6pAF0KlIDQsahk1l9QSbC+/4LkSf6:NR+C81lbRuF0gsBl2SbN/41f6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780259302, "uuid": "bb1bb423-d93e-4928-84e0-67dd235e99c8", "value": 11937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780259302, "uuid": "b5eb966e-a18c-4643-ade8-638993ac5a4a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780259302, "uuid": "6d044d51-9c0f-49f2-b69e-0c3200838688", "value": "photo-118281213.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd533a6-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250086, "uuid": "b579b2cc-dc37-4cac-9b4c-fb36ddaa04cc", "comment": "Malware payload (Mirai)", "value": "89e10f4667d3b9b00dbaff3e64cc01ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250086, "uuid": "e30e91d7-00e5-4ff6-a216-fc34adc23cf0", "comment": "Malware payload (Mirai)", "value": "e1965ba5f3bbe992a87377396373f264bfe6958e28c192a6b394308c2f327327", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250086, "uuid": "a932e805-25b1-4dc7-b35c-f9fd1c5a4ae5", "comment": "Malware payload (Mirai)", "value": "fd1da79c3241baaabcd158ef66304718d93a1059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250086, "uuid": "3ec05892-9bc3-46c2-b1c5-f0609d944a70", "comment": "Malware payload (Mirai)", "value": "95a88532925c7d54dd8ee00b104603224173bc1cc59980ea0e1d179e95b4a9bdfcb470192441cd38a37913c69632adf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250086, "uuid": "6141839c-ec75-4563-9611-5aed0d7473ca", "value": "T18BA34B21B9391A17C0D5647E21FB8B15B6F257CE2598C64E7E720E8FBF216403943EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250086, "uuid": "bad72f7a-9c8a-4812-8eef-c04c1496c5d7", "value": "1536:Djej6LciSSezdYwxWu/oxCOfcJYPbn5sRqnMbnaOA51w3tRSi:XcUciReIlbnqRNaPinSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250086, "uuid": "32fd43af-9022-43a7-9dac-b6f5818bcf91", "value": 105576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250086, "uuid": "8f9c49dd-d086-4616-ab11-1717949109f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250086, "uuid": "fe0e907d-2df8-421d-8771-c77c5577e185", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fddd8ff4-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780271209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271209, "uuid": "1cfade9d-affc-4506-a742-b3a889d0ada1", "comment": "Malware payload (Mirai)", "value": "07307faf24462645a9243b670a29530c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271209, "uuid": "5f655e44-37b4-4090-9aed-01bce883ea18", "comment": "Malware payload (Mirai)", "value": "e1d8e10749cc195c561241b7789d8fc90e5522949faac94b2e7df6c8f23425e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271209, "uuid": "5dee9ff8-2c55-46b6-ae10-3a89e950aac6", "comment": "Malware payload (Mirai)", "value": "c1695c5d0029b1719a5c8cb18cab5deeb5fcfca1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271209, "uuid": "5649eeb4-9611-468a-b502-ac0a5e085a9b", "comment": "Malware payload (Mirai)", "value": "0adf42ed2ac353215ab2faa8912f8e027f4f71270510bf75a5da8f0ae993556a5c2a668eeb23fa908e810779b53059a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271209, "uuid": "9e8256ff-7dc0-4311-a1e9-4ada21e1c439", "value": "T16914C81A3A228FEFF16D867107F34D31976976D617E29684E26CD5102F203CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271209, "uuid": "ca2eaa26-20f4-4a13-bae1-1fb8c694112d", "value": "3072:y0zh/diAKQ2aHn5jQ0rOFiwu4DkiluMmUlKOy+LYdBOMxx2uch:y0zh52aZ4FQ4RoMmUlKOy+LYdBOMxx25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271209, "uuid": "41c94730-2db1-4198-9d29-2d34e248618c", "value": 194040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271209, "uuid": "c10bc6b9-0234-4387-8dbf-d3134e4d6215", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271209, "uuid": "181de961-9948-4483-b557-26a3f8a473bf", "value": "gov.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8990fcb4-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "76fb47ea-1d77-4493-bae2-c47f6cdb07df", "comment": "Malware payload (Mirai)", "value": "1f2e00fa989efeb2bebeee5e51e08c88", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "06b0bd1c-57ad-40a5-a64b-8cab84c15c5c", "comment": "Malware payload (Mirai)", "value": "e22c9160ea9c18a548f40e57702c1f179fb80290813233ebe9808fb0b8eb0f4e", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "d3e4f786-c087-41c7-a3a1-ce3299e2eb21", "comment": "Malware payload (Mirai)", "value": "2d75934e560075e1db26b0af7e2c2d3b97ee9678", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213461, "uuid": "4cd742a0-a41d-4798-80d2-f9868c8f4062", "comment": "Malware payload (Mirai)", "value": "3b1c22aeabb2d6e683e252884e6293688e63e865c12a35f885032e40c084791f792ef4d95c824fa771381d37850b7d7e", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "87c16ded-e2b2-4bf7-9fc8-6732d2872a54", "value": "T12D762711FE8B04F2E9031D3115ABB22F23325D064F65EBE7EA407F29F97B9A11936149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "8cc6f6d7-f677-47c1-b8b6-ed407cfa1e29", "value": "49152:KfXKA0yoxzY1ayD+HVz8/+55UGaPOSfVC7LGHiGTrDPZ5W0DD+SOVbrM5En:G6A0yoO1aS+1zbUlPO8VC7LGCYrVhEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213461, "uuid": "3d64260a-9a4c-448f-8e5f-b6183ccba2ac", "value": 7233720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213461, "uuid": "76a00416-f45f-4ab9-b540-906b360bbff1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213461, "uuid": "1def2bf8-bf85-4140-9597-308d73d35729", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448fae73-5cf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780234391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234391, "uuid": "4db23beb-5927-4bd5-aa9f-e8aaee6d0038", "comment": "Malware payload (Mirai)", "value": "c436d3349a58019984e5076f77e308b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234391, "uuid": "a316bfb8-ee7f-466f-a547-5066d5b32ed4", "comment": "Malware payload (Mirai)", "value": "e366e8bb280bd5926a01c18921fbcfa1978562b9d4028bd75f878d51ae9cc7fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234391, "uuid": "2cee065b-42d7-447d-8e97-9c99aceecbae", "comment": "Malware payload (Mirai)", "value": "a0a027237a023310cfae9092ac762ff977b2815b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234391, "uuid": "f981671c-dd61-474e-938c-38ade776abee", "comment": "Malware payload (Mirai)", "value": "5b2f8141858a25b46a2f380f49a2531f53e00694f706c712927a666b40f2306cff0c7bb51c443c75e70abbae609d4750", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234391, "uuid": "59f518f7-8b4b-4836-83ef-a2628e208f78", "value": "T1CC340A01B9518F53C5C32BB7B79F42993733672497EB3302EA19BE742F4669D0E2A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234391, "uuid": "e7c9b0fa-77fc-48dd-91fd-2aec1b473cc4", "value": "6144:10qjE48aSf8J9AWcKBrf6W6Q31aGyZKqHL0tZM2x1fMyje5HW:10qo5ap9AqRfwTGyZKqHL0ta2x1fMyjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780234391, "uuid": "5f01db56-3b19-46ea-915e-c6d5f1aa5018", "value": 234287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780234391, "uuid": "57dcef87-84d1-4fcb-9266-b701f3b4de11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234391, "uuid": "03baaea8-aedf-4410-985c-74caab5f1e0f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5a8581-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250158, "uuid": "4badc7b7-e613-44e4-b320-5e387fe64ed2", "comment": "Malware payload (Mirai)", "value": "ca6b54874f3a8a97c62514bc79b4abd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250158, "uuid": "41db4689-b4db-4f65-a7b4-a24ea8439124", "comment": "Malware payload (Mirai)", "value": "e3879f564a24ed7831943183dbbe6f3acef602309dc473f47b222839a7fe1ed0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250158, "uuid": "ae763b20-5a3e-42de-b752-5e91c5cdedc2", "comment": "Malware payload (Mirai)", "value": "6632a378e876f2e402481c50fe7766c14654c227", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250158, "uuid": "574470fa-afc6-45eb-825a-a3c4b0eb7624", "comment": "Malware payload (Mirai)", "value": "d169a96e21737185c9193edf8889c6bbc88f7e1dbda6dfe174031455890da1836d05d8d4988a2cec03eabe092353da0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250158, "uuid": "013318d9-4ae9-42d4-9d33-82b935ae8d18", "value": "T125B31956FC818F22C5D602BAFA2D118E331227B9E3DE72129E205F2437C655B0E7BD56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250158, "uuid": "3041eae7-493b-4444-ab56-30ebfd873adf", "value": "1536:P4n44PUJaNvHLhO8z96EXQKM7+MLWhW8bkf41Q6aUjXKzcgI8iP7yS7gHmZS51Yn:ouad1Om95QHqiWV+6ae7yS7gHmZS3xC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250158, "uuid": "eb93265d-0de2-4768-98f5-e96f69860544", "value": 113100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250158, "uuid": "7ee0a237-b4a0-4de1-b76b-dea0e307b153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250158, "uuid": "811dccc9-426b-4319-a049-8c4848ea19dd", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c58a805-5ccb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780216419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780216419, "uuid": "dc02a9fc-1783-4aaa-894b-f8c681ffb09d", "comment": "Malware payload", "value": "099b8dd8570cad91ecb57cc4283bd71d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780216419, "uuid": "643d8153-22d1-45b5-8ae5-206700d719d9", "comment": "Malware payload", "value": "e436cf200719dae93d7a090beafd943590ec5c610f05a0ad40110aba1f444ebf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780216419, "uuid": "aad5f94a-36f9-42d2-bda2-ff8fc819f803", "comment": "Malware payload", "value": "b51734f1e3cbd87d9ba03c4428c10d2f106484ad", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780216419, "uuid": "f63ed552-e6d9-40d2-a3a5-b525a663049b", "comment": "Malware payload", "value": "27a2758d2618e04bd3a583654c9f1f62142d0a99ae9b785ca4ccdbe222251f3ad3720ce2a294c7018441f470068714ed", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780216419, "uuid": "8b0f7acc-ed18-4df6-907f-cb25d329549c", "value": "T1C8553387C17C18C84F3E06D7AFAF995C72288EFC100204766A6658AB253E75F87395DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780216419, "uuid": "e6ada616-17fa-4371-ae5c-4cc60ebb1b9e", "value": "24576:FMZCoZjxbq9j8XJlqrGAuImQIMESQ+hcqMXHC0Clwi6/CttWaRd:FMZCoZ9bq+MmMEL+hcjXHC/wnwdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780216419, "uuid": "b5531032-62e2-479a-982b-fbaa84895a73", "value": 1394468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780216419, "uuid": "39206b44-d9ae-4d17-9ea5-a9151ce76092", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780216419, "uuid": "b379a9c9-6111-4f0b-88a3-326377e7943d", "value": "in-vless-one-all-1.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada511fd-5cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780237144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237144, "uuid": "6ea6c5c8-4fad-47ef-9ef7-41c84443e75b", "comment": "Malware payload (Mirai)", "value": "dc78d114c8af3c87a13227c07421745e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237144, "uuid": "fcd4ee70-7256-4311-b37f-97de256ec62f", "comment": "Malware payload (Mirai)", "value": "e4446d13112ab356cb857ccd6b844690539fe1dd8739857e64ef67dfba6d96ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237144, "uuid": "3add4c2a-057e-457e-8096-c9be6753aee8", "comment": "Malware payload (Mirai)", "value": "58f5a74b52baa8ae5de8623882514f3771c2dea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780237144, "uuid": "d5d9f22d-b240-487f-9903-17d758917a23", "comment": "Malware payload (Mirai)", "value": "89bc5585cc19acf2722998104d0e3765a9608c3681361cfbd329c24c5b5a28105ca0f495535257c0f49f5476f109dc0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237144, "uuid": "f19ab822-62f8-4f0b-bbc5-e518c2cb83e0", "value": "T123D35CCAF400DD7DF88BCABA40635909B171D36165831B27B36BBD63BC322E5191AF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237144, "uuid": "30f93bc7-1240-4e61-82b6-fde4807ed382", "value": "3072:oVzQJLWxoaC1Tho3aEhekKr26qxwLI///+LCxRz5FlJlfSTvP8:oVyacThWaE0kKr2pxwEeURNFRSTP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780237144, "uuid": "b315e6ac-8030-4b49-b066-8ee84aa42c90", "value": 137792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780237144, "uuid": "a6a163db-dd18-401c-a1f9-ad5cc52a137d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780237144, "uuid": "30a729cb-5f75-45d8-9d75-3dbfbfcc5cc3", "value": "023782pler.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add622c1-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780214381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214381, "uuid": "e5257f4b-4de1-4246-a1e3-b547d46b29d6", "comment": "Malware payload (Mirai)", "value": "a22b1fc38d8354c4f1dc8182e38ca648", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214381, "uuid": "3f760230-085d-432a-8804-858f536e52a1", "comment": "Malware payload (Mirai)", "value": "e49decb559618a2a26b85d2c06875fce1ceca1999d922d528a5435dbed68b4e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214381, "uuid": "5a554a65-3424-483e-ae63-51235e4e9c0d", "comment": "Malware payload (Mirai)", "value": "cfa9ad7c2369fbecfdfe8a6f70f4f851fecc6abd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214381, "uuid": "050d783c-2fc7-4134-b696-fa9571d4a1a7", "comment": "Malware payload (Mirai)", "value": "ce64a976d6bd5e606f074d21db97a43f6b9e8f997be882318000e0ae828490bc90e03bd59075320cbacfac58bd6936f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214381, "uuid": "1f12b2fc-7e2c-4fdc-8b00-f8d48802f6ae", "value": "T15D158D2EB2B3F5BCE007C03447DBCAA24535B47526212DBB26C4DA353D66DE12369B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214381, "uuid": "b1f8d663-0875-4500-9409-e25b5c38d1ff", "value": "12288:Ssi0pvNgzoMaJvfgHvnPdMH1KIp9p2VNQHVBAwf5xoR2Ud1iEy2RCmaydqjHHX:SsxpvNgK3gvI28rDB02Udk2Rej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214381, "uuid": "76779b49-73b7-47a6-bdad-4d8fa0e67ea6", "value": 961680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214381, "uuid": "fa833772-faf9-4047-a663-aa63daec2b4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214381, "uuid": "0aff070e-dfd9-4174-bdfc-253105f7aa59", "value": "blue.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f6fec2-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "abc6ddde-dc45-41db-b353-4fdd157bc917", "comment": "Malware payload (Mirai)", "value": "d6f2ec2b1c3fd1a1330a80649d87e8f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "7682a02a-3dd0-45bc-9e5f-d1fe64e13e6e", "comment": "Malware payload (Mirai)", "value": "e4f793f4af2d4273081eb40db616ec4aaee211872f9ca1f3d6c6a24e1025c1da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "2ffc498b-3ce5-42b5-a41d-0fc6c517af77", "comment": "Malware payload (Mirai)", "value": "4feb256e96c574ac237ddea562173b16fe4f425e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213643, "uuid": "8b7b6d8b-71ac-40c9-82d4-712e85a1f98d", "comment": "Malware payload (Mirai)", "value": "bb830ce587bbaf4d04b63c82a3328b5c84ffb5abe9679c8aa831124aab7ab453952d30e632b1bf582c167a9ffb95a757", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "1081f56f-9d5f-4e3d-88ba-24c2abfcc0b0", "value": "T11693D606BFA10FF7FC6FCD3746E91B05248C950A12A87B3AB574D929B64B24B05E3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "f8bf2eb8-7715-43ec-868b-720f10e3e4e3", "value": "1536:FH1cRQtIoxGYizrX+TRCPfTItEu1ZMOG0CMPgQuw4:FUp/ItEu1FPVuw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213643, "uuid": "453ad39e-7e17-4b72-a30e-865c43dfc036", "value": 89032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213643, "uuid": "ea511f44-0f7c-48ac-8e70-cc9394f5f8ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213643, "uuid": "3d8fe037-7169-415b-9a05-15dd7000ac41", "value": "kmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1782e0-5d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780250077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250077, "uuid": "6db7653a-8e6e-48c0-ab7d-f6d4838a4e52", "comment": "Malware payload (Mirai)", "value": "23d086826d38cfe2468b32cc48e8745c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250077, "uuid": "f4969b78-3edd-4107-a275-6940d2262a4e", "comment": "Malware payload (Mirai)", "value": "e60cd20035abf992fdc949dd8304e7aa0dd088c93b770a417e0bc47fa125bce4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250077, "uuid": "440c3138-5e0c-4c91-bbeb-a21778e19cf6", "comment": "Malware payload (Mirai)", "value": "abf5eb58235b735d0dee51cb82d9618fe72d3c60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780250077, "uuid": "c99a1a35-08b0-45de-a98b-61b7b18e8d9b", "comment": "Malware payload (Mirai)", "value": "589f02f999b1cf67f20bd2bcc5311221e2c49a35e102a584cea126610f2a162493bf41bcc3edab3a54471d5f297969b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250077, "uuid": "b78d5d23-786d-49c3-a119-8c3547f14c8c", "value": "T132530102CDF258E2CD300C7FCD652D65BFEB0BB8E96B60453559C9E8E9A10A315BC5A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250077, "uuid": "62787046-5b09-4f38-818a-8aa22a8141a3", "value": "1536:XqakjTSkKhsLqNPhtVkFrf2FMGnL2VLE5oPm+D1RNAYH:X1kjzKCL+PhyDOSVLXPm+BRzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780250077, "uuid": "2b73f341-33ed-4d18-86d5-73aabffc9a41", "value": 62944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780250077, "uuid": "4c26318d-7d64-4e34-877c-c4a0a829f96a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780250077, "uuid": "d56ab48c-7d8e-4571-a1cd-7a86b7ca7b20", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55df93bf-5cc1-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780212086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212086, "uuid": "576038a5-716b-4f7d-94aa-dbf6da2a1a9b", "comment": "Malware payload (Vidar)", "value": "b3751ed861ec8ff488eaa55af5587e7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212086, "uuid": "60e65fc4-e89c-4ee8-9ace-1c9189c692c8", "comment": "Malware payload (Vidar)", "value": "e613b9a2f12e2fb758a99835f5d3b0e43f6dcc1e34b13e73ae201691a5da9151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212086, "uuid": "9d96d20d-9526-47a2-a0fd-0fc5d4e66241", "comment": "Malware payload (Vidar)", "value": "f48493f1a83e730d8ee2e74e64be606719292992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212086, "uuid": "b5de01ed-8d35-4b05-989d-6c9e40409742", "comment": "Malware payload (Vidar)", "value": "2eb4c8656873835d91c32bef68c00f509b3dc33ccc7d06ea11616cb8923b492ddfdc869b91b6fb22919432934fe686c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212086, "uuid": "258f0c3d-ebe7-44b7-9742-794c6b458f6c", "value": "T14CB57D177CE048FAC06A933288B25292BB75BC150F3223DB2E90B67D2F76AE45D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212086, "uuid": "fdda7a6c-bf72-45c6-aa04-71972249c98e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212086, "uuid": "cad2601d-ede2-45d0-a701-22e0f3e4fb7f", "value": "49152:afeKr3DqpAfUHZK9erQk6ZAeRCmhvXo7f:at8THSe0nN0ml4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212086, "uuid": "6cd5413c-dd45-4579-9683-9009661899bb", "value": 2396808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212086, "uuid": "605910a9-6ba7-47c5-9dfe-8185be6adb78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212086, "uuid": "6b29f6f7-8624-4df1-bd89-a5a3b50a32f7", "value": "Bootsrappper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be95935-5c99-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780194997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194997, "uuid": "6c1d896f-367a-4e2a-ad55-db754a6f34a5", "comment": "Malware payload (Mirai)", "value": "543e3941e54e22aeb2ff6dd175e2a410", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194997, "uuid": "3aedcd82-55b8-43b2-bab4-46699a3baea3", "comment": "Malware payload (Mirai)", "value": "e84dc6f5b496e4124cbc03374317a4bc77d5d865ac5accbb95b75066780b5200", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194997, "uuid": "b535278a-83f6-405f-88a2-88e3873fc488", "comment": "Malware payload (Mirai)", "value": "34d3765b09d22623655faa12168b439e250741e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780194997, "uuid": "e76058f7-8df5-4797-b395-bb83154f8cd5", "comment": "Malware payload (Mirai)", "value": "5955e7dcb2e2feb5e8e9a94f1955de92115e3780b18cffa041c05e776c2ff9f7cce6b7e2d1a7fb05ae43b2c3ca4048b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194997, "uuid": "cfda45da-9fb1-4f13-90b6-8ff12b347b0d", "value": "T12B240B41B8518F53C5C32BBBF79F42993732671997DB7302EA24AEB42F4769D0E26201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194997, "uuid": "f88bf238-e524-41e2-ab9d-5b8d9098bca4", "value": "6144:WhK049I4AcrdGlDz0/MVyQKJKHtEqZ06L18Hts1QS1:WhKXa4AaCDY/MtKJKHtEqC6L18Hts1Q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780194997, "uuid": "e56ccf85-2762-4a7c-ad0b-b6b0e893791f", "value": 218600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780194997, "uuid": "2b89ccef-ebda-4a0c-8ef4-11b35bb6bfbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780194997, "uuid": "f7b0397e-9968-4202-a115-db2856d4db09", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5fdf53d-5cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780233749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233749, "uuid": "a90729f7-8752-4501-9881-c8b3775fbf6e", "comment": "Malware payload (Mirai)", "value": "522bffb86c7cc5824a006422a504edf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233749, "uuid": "b4bca3fe-6e93-4270-b07c-6fdddb8e506c", "comment": "Malware payload (Mirai)", "value": "e8f4dcfc6d743f298337558869e005a59aaab391d887be29b2e87da29dc413b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233749, "uuid": "a5de5ec4-3456-4992-93c4-8084469699c3", "comment": "Malware payload (Mirai)", "value": "e3bfeff8ec87b04465f6ea511b747093ed96c664", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780233749, "uuid": "bae7821e-4ea6-4225-8d67-33d1947c3022", "comment": "Malware payload (Mirai)", "value": "a5e4a39390e7cb46a9ba901bd597cd88ac4a4bb1a056051960e6a7df52601c97d0103b3f97df71c9b0c1c25a29ce6853", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233749, "uuid": "09d14e2a-76cc-4048-8e6e-225f82179557", "value": "T1874302D70E4E5970CC7FC7B124422968E516B893D6960BF70899F27E8E63584FA34ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233749, "uuid": "70f01cca-b9fe-47a7-b555-96c87ced29ab", "value": "1536:/i8TQabUM0FZwdGdgZowYxGCjiQaXF5rlv:q8TPbz0F+dGdgZouCcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780233749, "uuid": "bedbb3c7-5496-4ead-b93d-da0a6dd5710a", "value": 58336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780233749, "uuid": "677bf06c-62c8-43cf-9e96-fb5f5ded1d4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780233749, "uuid": "93990225-4888-47b7-99f9-629150e9eee7", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b7fa2f-5cba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780209111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780209111, "uuid": "331bc2df-433b-460c-952e-05c47d2596f9", "comment": "Malware payload", "value": "d3d03e9f81416cc0c89e519f6747cbf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ironchain", "colour": "#EC5AC9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780209111, "uuid": "1d7ea0c2-461c-4db9-868a-a473c281a98a", "comment": "Malware payload", "value": "e95f39cae2c98b46f5f4d5e6587047273610ebde44755eae78d3f416200f8d72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ironchain", "colour": "#EC5AC9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780209111, "uuid": "e4db1b1c-e7f8-412a-88ff-3aa47e009b81", "comment": "Malware payload", "value": "61848b1ed43f38d939c66ef17ad9fdd8044940d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ironchain", "colour": "#EC5AC9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780209111, "uuid": "d2919c4b-9c74-4c55-95d7-b637c1ab427e", "comment": "Malware payload", "value": "b3d7054bf307801d38590a7b883110a0fcd62185cf5f2cfd06b0341d44bac780b8b20cf467c3949e36947181916cd277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ironchain", "colour": "#EC5AC9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780209111, "uuid": "e31ae195-9fd9-4145-8e74-f0c75e64a826", "value": "T167C6335943F30462ECD2D23A5AA285A6D2B27F511F22D79F0B64435A3E2B2F34D37790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780209111, "uuid": "b5a9601d-4cca-4d0c-9e9b-55bf79339258", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780209111, "uuid": "a517f805-b37b-4579-af45-b982f3e73f6f", "value": "196608:khsqlGN6mccrtbW897GDr/x7eovq5XMP6PzFcXLz+HskAS2r4ZRjMFZAnib:nq2r1yNdq1B7cn+HsnS2cZpi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780209111, "uuid": "498e1bb1-d9ca-4e3a-9b89-95ce16ac24db", "value": 12361850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780209111, "uuid": "49cc0bf9-8aeb-4b1d-95dd-675cbb726e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780209111, "uuid": "b4cbe75a-b50c-461b-9997-546c4ba81859", "value": "IronChain.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bf88f6-5c8a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780188405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188405, "uuid": "cdde0661-cf39-4768-87a6-f6ae8ea6ca2b", "comment": "Malware payload (Mirai)", "value": "f998f483f1096841ce33f62b889cf545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188405, "uuid": "8874c583-226b-4760-ac6d-9962b3cac6e9", "comment": "Malware payload (Mirai)", "value": "e9a2cd7b40ad6f15ce25cfba4f40f710d705f2bea0b36954411c2b02b7bc64a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188405, "uuid": "bed36072-1d2b-45cb-b91f-0b1fc869b05b", "comment": "Malware payload (Mirai)", "value": "2a2cea402458a51d7105d20a93c7eb028eea4198", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188405, "uuid": "741fbd46-4178-460d-8137-de505a8af911", "comment": "Malware payload (Mirai)", "value": "d16d2b71cada8fb716d848e90f26ced7c22a4ec7ae99dd32d5c4d3e52deea1c10169feb6190b3bc86d8a93cf80c7c0a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188405, "uuid": "a6bb664c-3e36-46cb-b1be-aa735e1a2797", "value": "T14BA3810EBFA01EF7EC6BCD3B45E41B05248C651A21A97F75B930D818FA5A50F0AE3C65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188405, "uuid": "7981ecea-66f5-4837-ab98-53d74050a2da", "value": "1536:VmHc8CWGWQY/9WqyURgd2lbUBxnBAj0m+Ax+RdZUTb1097kxgK:V0WWGWQeWqyUREIbUXn8GdUMYgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780188405, "uuid": "95233250-2072-433e-863c-70765614f9a2", "value": 102540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780188405, "uuid": "5bb29d4b-e7d4-424d-bf11-a31098ea1a49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188405, "uuid": "36f00725-efa8-40a7-a35e-426e8495a1cb", "value": "e9a2cd7b40ad6f15ce25cfba4f40f710d705f2bea0b36954411c2b02b7bc64a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42dd16fc-5cf5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780234388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234388, "uuid": "0430a7f7-c9ac-4a11-b0ff-ae7f5f9d5a24", "comment": "Malware payload (Mirai)", "value": "c456807ab34817ba5920fffd1980e69b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234388, "uuid": "ec4e3964-16d6-4e64-87d2-4a5919b39626", "comment": "Malware payload (Mirai)", "value": "e9cb31232dcdca33d6108a58f0522322a5930de4a09903f5df521122acbdb5e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234388, "uuid": "26c124ce-e0b9-4058-8d43-0615d46b6d28", "comment": "Malware payload (Mirai)", "value": "fb2ce3f042f42a6e7e8a5b1bd516aa45cad3f776", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780234388, "uuid": "f59e79a7-e0e3-4a85-a34e-db94e4f30be2", "comment": "Malware payload (Mirai)", "value": "a5813042a1c9221c4bd0a040c68fa9cce1f2292043f160cdec1f6a738f7af9779581e2e84069fb04b4800edac4ffae01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234388, "uuid": "75ceeb97-9d61-451f-b310-50a72e215985", "value": "T172D37D22A9391A27C5E4947741F35331F0F3438A24B89A1EBDB50E8DBF1979026677B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234388, "uuid": "ff9695c1-989e-472c-a80a-a884aa206031", "value": "1536:5cSf5MjU1hJLDakjGu2k4RR+hW5/YYlvRCFha67aMEi7TtLWYm5TRgoFGtS64X6r:tOaIk15MMiiPBWYO9pSMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780234388, "uuid": "b9ae762a-34d2-4ebe-93b6-c5d7b0402af9", "value": 135552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780234388, "uuid": "1219a46b-7316-4936-b1af-2ef0693de21a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780234388, "uuid": "6c8586cc-0d13-4004-80c3-81537d608636", "value": "023782pler.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677783ea-5cc6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780214263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214263, "uuid": "b6aeb615-a355-4c07-a01f-479dbc6acb82", "comment": "Malware payload (Mirai)", "value": "f49b1533f7a0b812a3e004a151edc94a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214263, "uuid": "ba2c3721-9d07-4e22-bf5f-2ca24c35a97e", "comment": "Malware payload (Mirai)", "value": "eca7fa4164f7cde3d6752018426a6eb69cab5ae3875b9b7f0c91e87328a790e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214263, "uuid": "1b034e5b-924c-4097-b034-7a56aa8a67c5", "comment": "Malware payload (Mirai)", "value": "e50a2ec9c9ef31c9099019b5ff58b9fad5cc046d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780214263, "uuid": "ae0df740-8e3a-4ffb-a5c7-81ed0ee0ca07", "comment": "Malware payload (Mirai)", "value": "1da972f2573f8d3bcd0df92bc1be8cdbee6f663af9f3753c236ee945d620651d0c78cbc48807632be56656dc2cd00ec0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214263, "uuid": "054a234f-fc27-414a-b84e-695aed005b6e", "value": "T1DCA37CC5F643E4F6ED4301B11137E7769772F23A6039EE86C3A89D329CA1951C61A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214263, "uuid": "0b6d2fe3-fe74-4c73-8808-e0e49cdecfc5", "value": "3072:s0O67hIUBIeh3sa9Jjp/sUxtG+lWYKLhLXk/kXSfWRXwxyZZ4:0UxtG+9KLqAxhn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780214263, "uuid": "cb891da9-42d1-436d-8c36-3d0544e0f522", "value": 106504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780214263, "uuid": "8d009724-48cb-4ee6-a659-fedeb2713ca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780214263, "uuid": "9cc29313-a23c-47ee-863b-4a0481da2d29", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea7990e-5cdb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780223268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223268, "uuid": "a046761b-f35d-44b9-819a-cea82899eb9d", "comment": "Malware payload (Mirai)", "value": "cf92ad21f12940d88e197e09ebc833d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223268, "uuid": "f76efff1-315a-44db-a11d-02aefe644a0d", "comment": "Malware payload (Mirai)", "value": "ecf22b8ee51b5723a4721fbdd5c6171c5f862f91fdc0ed3cd77fff0d64859ded", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223268, "uuid": "d77bb618-99b5-45d3-8def-ef8f40ef559b", "comment": "Malware payload (Mirai)", "value": "45ae452fb355e8760f8c9d993983605ea22b5c92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780223268, "uuid": "df4eb162-7a64-4f82-a464-9f45e47950a0", "comment": "Malware payload (Mirai)", "value": "0c7423c2d9e95fa9730ad3b5d7398e5a9413d4f96a0eec4610c405e8a9c53b17af1860362e1fda7f7efec35755ed9466", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223268, "uuid": "75ad4e3f-fec3-46d9-9325-fb41e6a4a03b", "value": "T14D44DB1A3E228F7EF26C877047F38A31975976D617E2D645E26CD6101F2038D681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223268, "uuid": "a2266067-0191-46bb-8fed-e469f47a67b7", "value": "6144:gGolLyyFY0brQgu+6LSqiGz4k91VjCTXCtn93WmzD1uW9NNvotVnkenH44Ad:gJFyTer8d9PBnEm31uW9NNvotVnkenHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780223268, "uuid": "caa67272-74bb-44bf-a190-84f1cd606e17", "value": 271247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780223268, "uuid": "e1baec36-0d68-4965-9e70-7d2ac2899f3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780223268, "uuid": "a29db6bb-422e-4b62-b8c4-2129a1ec9a64", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030bf2e8-5cf8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780235569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235569, "uuid": "41842e32-a6dd-400e-af97-1652d4446285", "comment": "Malware payload (Mirai)", "value": "dabc883e5a9256f367e186a0696d41df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235569, "uuid": "c9dca443-d75c-4d03-a21f-11ed1b6c8e5a", "comment": "Malware payload (Mirai)", "value": "eda32690d58912c7af348e5bb86b5c512a92df36c6a25940462c51aef165d8e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235569, "uuid": "8b0953b4-5095-415b-b4fd-350e91ee980e", "comment": "Malware payload (Mirai)", "value": "c53bc49176a49da037835c646f9076e1c4567b7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235569, "uuid": "a73066aa-2ecb-437d-a370-5d3758fd36f9", "comment": "Malware payload (Mirai)", "value": "0143f9a8ed6168d8ef1f56ae1077345d06aa946ed446c7e64d45e8b1ef46ac8076f1e0f5afe679e1f9bd8b6818af3970", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235569, "uuid": "f8777d68-0840-4fff-ab7d-13cc8c2ddd6f", "value": "T1FBD3AEA7B24F2450C82506F41BC75BAD2E2325015E6B96E63C6E373F5A339DF58063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235569, "uuid": "b3f8bbeb-cc9b-4307-b90c-c5802ebb83d0", "value": "3072:pHM+EBczDGpp/KdU4RtO3IxuaL94FgJC1TSRaYeJ7q:9M+iO2/h4RAja54SC1TbYMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780235569, "uuid": "6d968860-03cb-4367-bc92-f446b29a3888", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780235569, "uuid": "a1d83547-43fb-48ce-9f81-a9249f8dc78f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235569, "uuid": "6db0615a-e253-4d5c-a2ea-62e4e612c55b", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d21636-5d37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780262632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780262632, "uuid": "502702af-9267-4edd-905c-702b9eccde06", "comment": "Malware payload", "value": "aa255b7a97fcd475d7c8e4a69c93ef8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780262632, "uuid": "9bc59d23-c361-4236-8364-f860d1100f81", "comment": "Malware payload", "value": "edbe951f2c653cb0f9c08cb54e6958d9cc96b5744ba65c6920f9871b57aec6d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780262632, "uuid": "c7fe9c27-215d-4204-bff0-c8990f4cf842", "comment": "Malware payload", "value": "46d06d525cdd2e293703e2825c0bbd9d6304658c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780262632, "uuid": "155e3916-91f9-4ee8-af55-28cc299c18dd", "comment": "Malware payload", "value": "ea4fa7e63ccb0db759535dae24c380076d0ad67cab26a755c7a939148ece41ab63fbc038968c2dc0a1683cfa14ff7390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780262632, "uuid": "b83052ba-2779-48dd-9276-5baea4602a90", "value": "T10208331F06F4C028F67CAEBD1B21DCA2A6557B467C1361E6FFA85148706228186FDB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780262632, "uuid": "784adb0e-9b1a-4ca5-819e-a007bff93107", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780262632, "uuid": "3cf5c321-ee74-467a-9d54-780c6c49e20d", "value": "1572864:jt9IKPzvAliYpM60wgb1GddvINXeapvUJz7z4ksDG9xPo+IKZYTp9L7Ai7:jUKroliYRyyINXeakDoG9xw8ZYFxAi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780262632, "uuid": "6da85bd5-d4fb-4028-ac96-ed28073a3ef7", "value": 77167550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780262632, "uuid": "44daa9de-d20f-4a96-bf0b-2f63b51e306f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780262632, "uuid": "1a3f05a2-9085-4aa8-be35-5abc62ac8f38", "value": "Setup_3_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57fff05-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780271141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271141, "uuid": "9608ed91-6f4a-4495-9280-886e9c2ee9b3", "comment": "Malware payload (Mirai)", "value": "f1e42a55a554276d2fbaf304b8b25280", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271141, "uuid": "6419358a-db3c-4b12-9db1-90de678771a2", "comment": "Malware payload (Mirai)", "value": "eecff1bc7fd5237231d6ce7fe45818e0d794f2646879890a46d7d31b387b2b34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271141, "uuid": "b1a9d503-b41c-4505-b5b0-2d268b79ba38", "comment": "Malware payload (Mirai)", "value": "3bd33244a614ddc82f2c3a03b011c0549110f8da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271141, "uuid": "8553b569-0ba3-4753-8547-a1bd81578b18", "comment": "Malware payload (Mirai)", "value": "a4f1e70f1b8bdd054fba867a048e2dab0b76a309d9e7f1f52eb37f67f7309e95f2e267a5f49836c3d5723b601da98187", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271141, "uuid": "4a3e8fa3-00ae-4a7b-a805-25d399049838", "value": "T1F743F1AE214C0C9DEC177BB863D8071D1A62DFE33903CD4561F2F5EA8A660663183F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271141, "uuid": "16042358-93e8-4895-bb56-eb301343af3e", "value": "1536:5u53ihtdT0qJiOPIOgOKVV1cDNyvBm67iY9/:5u5YMq8GzgO0V1yNgwm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271141, "uuid": "11211737-1a72-49de-b48a-ae456854fb81", "value": 59236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271141, "uuid": "87724b37-0b70-4d54-a4fe-3f81fc8570c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271141, "uuid": "d0a99d8c-1595-43d6-af3c-683d99485713", "value": "gov.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118e7244-5d2c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780257927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257927, "uuid": "1fd573b7-a0a3-45ec-a2df-e772f7f5527b", "comment": "Malware payload (Mirai)", "value": "4b861c3fa6492d3314bd5c8ddc256fca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257927, "uuid": "133d6ec2-23bb-47c4-b8fa-0d502f11845a", "comment": "Malware payload (Mirai)", "value": "ef0f2ce8b75d53febd6fcd837d2c300f38add7ce9e447530dd0ee29e77ecfc57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257927, "uuid": "2043960c-284a-44e2-8bb1-d6ff88ab0499", "comment": "Malware payload (Mirai)", "value": "d6df2cb101101d8c53c46981b704b78dfbbd1c73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780257927, "uuid": "220728e2-83c9-4933-90ea-0f42b51f0d24", "comment": "Malware payload (Mirai)", "value": "272c4bc19da5d2257f3c23de72999c86d7a0d64053643abe9e7141da012bc251637f073deb115879162c96f8a7384b00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257927, "uuid": "66d53715-e583-43ff-8f3a-4b0bd57b5caf", "value": "T1E1F33A63DA26AF56C122A0F4A1F18F751B22AD6A09530EFEA477DAF44183CCDB205774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257927, "uuid": "99cbce92-af96-4de1-8adc-04c0d9b6fbcd", "value": "3072:ZXMaZ5Hvx1VV68fu1A7g1K52sGWhuhjeT1:ZH1VV68fuWOuThuhy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780257927, "uuid": "53976a38-30da-4aff-81cb-166a1e269899", "value": 159644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780257927, "uuid": "11ab0406-a4a8-435e-a61d-d8b55d443734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780257927, "uuid": "bcf6883a-6571-471f-91d2-bf2b3bf63348", "value": "wife.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223f2ff7-5d25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780254949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254949, "uuid": "a492c82a-e956-4c85-b588-17b0f67b9bb3", "comment": "Malware payload (Mirai)", "value": "13f412c28c4c60afcf54a3254bc41ab6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254949, "uuid": "c3592a57-7c2b-4d6a-a758-1805630d8d68", "comment": "Malware payload (Mirai)", "value": "f0592c64bac6d080db862c796838c28b872ec8fcbfcf5f01fa783387d0366d02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254949, "uuid": "b08331f8-94d5-4855-8556-c4b55fb0abcc", "comment": "Malware payload (Mirai)", "value": "22dc483c077862c95b7fcce1119f4c6a319704c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780254949, "uuid": "9186ebd8-9b18-467a-9322-c2f6b3deed74", "comment": "Malware payload (Mirai)", "value": "4daa244d3f04c4f7244c1c3b8c7006f3e93fed1d60b8b49582bebb1545dfbf6ec980d20e5a1307d5d9b4b759b578ff0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254949, "uuid": "46bf2e47-8352-4e4d-9f7d-3dfcbde9063c", "value": "T1E463015EC745028AC68D7EB8C1E022F766F060D1AEB66F2D972C2D40C9969373C5F426", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254949, "uuid": "3a7a9098-aa42-4729-be21-064ab6fce19a", "value": "1536:1QHKYQqRi48S5UeZebnYWgB/ItWL6cTDw8NjgEW:1fYQS3Jue+eBx6co8NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780254949, "uuid": "3bc899dd-9571-4172-94a7-6f4a8da6aae7", "value": 71064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780254949, "uuid": "1cfd575e-4f3b-4d31-ba4c-c767c214443e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780254949, "uuid": "6a6d00bd-79da-443e-977c-6b864b76844c", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023ed7e6-5cf8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780235568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235568, "uuid": "b8ff0bc8-18df-4bed-8121-a70795b7eeb7", "comment": "Malware payload (Mirai)", "value": "368a888a60cb4b5d415f47b58571a124", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235568, "uuid": "c2ad6f1b-c923-486a-9ad0-ce40b5783d66", "comment": "Malware payload (Mirai)", "value": "f193db11dceb855f8b50a6dc966164199282a0a9eff24fa1d859913370205443", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235568, "uuid": "f58976f3-0854-4c27-beab-7cd457f0d817", "comment": "Malware payload (Mirai)", "value": "2570fd44d1b8ec6ee960ad0f4c7ad93f75ae4a38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780235568, "uuid": "07cf1905-f348-4c56-a065-7003a8229e4f", "comment": "Malware payload (Mirai)", "value": "1aa5a65a23bc7ed6ada1bfc43fe0fe82e67c849603698b76ee0e649e1995d036f5abeb344573730bd42df550713cd29d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235568, "uuid": "fa025388-921a-4c2f-a4e2-253b3d219546", "value": "T10C43E1F34DAF83FEC7AAB9B05926A0E8DAD525155E0B8A0F135570FF842A5C91D10F07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235568, "uuid": "d6115e05-6715-4a3e-a52a-f240e797ae22", "value": "1536:t29JsDtvxeV/ffs/OLl19XGgB7gaZCNizcGQD:t/VkV3sI192gB7rZCNAcGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780235568, "uuid": "4ad62302-b71d-4086-b675-cea435474127", "value": 55964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780235568, "uuid": "a63fbe87-47b4-4ca1-914c-da6aa8d56059", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780235568, "uuid": "5cecd5fd-e48f-4728-a2a3-980d18d787af", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de52a370-5d27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256124, "uuid": "4e8de3c9-1db6-465a-a9e6-2ccf8d43ca27", "comment": "Malware payload (Mirai)", "value": "320a3132b4a4ab4a9a29f35e1be22f3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256124, "uuid": "48e6880a-9d77-4976-8767-9c8a85f76dca", "comment": "Malware payload (Mirai)", "value": "f206ff965d298ad8f8112882fb700deb4614b40e4c02b2f1d280af2b000ef1fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256124, "uuid": "b8e8e877-daa0-4f81-9aee-fd48a2eb34e8", "comment": "Malware payload (Mirai)", "value": "97a82c3977e9aee23eb6b16fb1ede94abd688ede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256124, "uuid": "343ea50b-4c1a-4fd8-abba-2bd34fa3a3d8", "comment": "Malware payload (Mirai)", "value": "5a494f1174843db5705af214c7036ffb2bb953ddea4173db7905bacc1b8e85dd7790675bf216af1d332b1a130dd87693", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256124, "uuid": "279e2b76-065a-4aa3-a45c-38576c4c462b", "value": "T11FF36B17B5D0A0FDC8D9C2749BDFA236DA32F4191234721F27C4AE662E5DF202B6D690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256124, "uuid": "b20c73c1-2785-4281-822f-e9755b6df562", "value": "3072:1LW3Q2n4NQ4t9sSLdC1e16Xc4VLgVDMZhI8e86CuPGlnE:1C3BWYgeaEMHPunE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256124, "uuid": "5621d971-2d2c-48b2-9ce8-8a24105c5edc", "value": 165360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256124, "uuid": "b6b0abca-5fe0-462f-8a8d-2ce7afb97935", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256124, "uuid": "249945d5-c746-4a8b-b4e4-c2e61a3e4558", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100362a5-5cc2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780212398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212398, "uuid": "9d6d76d8-e8e9-47fe-ae10-52a103805f78", "comment": "Malware payload (Mirai)", "value": "c7043faaff52ff6ccad68b3bfd45dc38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212398, "uuid": "2e0e80f6-4a2a-4deb-afdd-84d7ab3a9dae", "comment": "Malware payload (Mirai)", "value": "f274f7594b8e3b9db4c87da881c78a588369bef16f325d658bab27ed9e9003a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212398, "uuid": "1bbe19f4-0760-4b83-9840-bb1f91c3a6c4", "comment": "Malware payload (Mirai)", "value": "99428ffba65f00c0e5e5595fc40f96faa720b992", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780212398, "uuid": "23341cee-a3d7-4454-985e-85672934afd8", "comment": "Malware payload (Mirai)", "value": "731a259d9db6475227c59f3f9ec181edb28a388a51b320a5df1aac241075d6b5065510c527d83b0599c90d0c16711fff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212398, "uuid": "3a18c281-3768-46c6-800a-5a2722e32ce4", "value": "T1B1B2E02C99F586A1F634BC3CF178CB4628A382F4F1F4B92A764489649E8377512783C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212398, "uuid": "d12badf3-898a-42c3-80ae-318c5a23f559", "value": "768:kvQ5+4nxkfcAC103Ga9ggwGXe3qIs3UozaM:IypxkfcAc03GAwGAAzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780212398, "uuid": "28613425-4468-48f6-9774-425f1df31714", "value": 25116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780212398, "uuid": "2b83f479-bfb3-4ca8-aede-8d59ec35bdab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780212398, "uuid": "c5789cdf-e0f2-4aff-9ada-147af5fd45c6", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89dfcb8d-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780213462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213462, "uuid": "f60f85a5-c1a4-4891-b47e-3dbded5a1c3c", "comment": "Malware payload", "value": "99f3711e7698b0d5f83efd1c16a6dcf7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213462, "uuid": "3dcdf4f4-c58d-4a5a-a70b-260d26a7787e", "comment": "Malware payload", "value": "f29f960878e8dcf72d02f9a7e3e7b5de4fc20b00a079f2571a70e6d63edae050", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213462, "uuid": "415ee7d4-39f8-405d-963a-d03e2c5d066e", "comment": "Malware payload", "value": "6cf06d65a5ec0c536a7726b7376e10996ec6d896", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213462, "uuid": "9380132e-03e8-4c99-b3f2-54b88cd09c05", "comment": "Malware payload", "value": "50099e7062153013b337294ebfc306ac483dc122cabe521dc476460403aef9e1edd6b3099189cf7f4efb0ba19c2cb566", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213462, "uuid": "eb5cc798-69a7-43a9-9485-d6316cf492c6", "value": "T10201999B61B0AC3068758A3CFD9786A0104714176804190D709F6E04EF2CA4CF6A1656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213462, "uuid": "552116e1-1fda-4a20-ae47-4c993e9300af", "value": "12:Izzfsx80+asLeHt4LZ/uPfFFHsFQzBct7j3FAVkVFhx:o5TaVHt4LUnF1GQzqt7phx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213462, "uuid": "433c265d-22b3-473f-bd6f-05c21cf7abdf", "value": 748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213462, "uuid": "6dd210c2-3d92-41ad-9f65-50f549e98574", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213462, "uuid": "d44e19fb-d4bb-4755-979d-34492169c4aa", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5019dd4f-5cbf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780211217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211217, "uuid": "1e458dbe-0865-4009-b053-ceb9b8b30b94", "comment": "Malware payload", "value": "b65f952238947b7f51b8b69a59108720", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211217, "uuid": "adf34ff8-d57b-4aa2-8ed2-5b8438bc6d7c", "comment": "Malware payload", "value": "f331488194248411f69cab0b8b512780dfde565f3220f8b1ee8d442077b15ea7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211217, "uuid": "b94f62e8-a8d5-40d2-9dbf-a512cc2fd51f", "comment": "Malware payload", "value": "80be4f975ce3d9838da7a87de19548cf0cf046f4", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780211217, "uuid": "f0375492-2ecd-4d55-b48a-87116437dd03", "comment": "Malware payload", "value": "b97bf3e0e41e6d3a37c438e230c6e28ef3896bd1bd93e9a53dccf079b83cc2f2569353184b3a754e813f8c2e4b64bd18", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211217, "uuid": "2f6a2110-0fe1-4876-a0b2-b79f56a6e5e4", "value": "T193F00E0ABC1106CCF9E3036572FA896828A28AD17109E3323681AC846D5DAD5039DFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211217, "uuid": "f9a65e55-cd30-47de-8592-cf89b663420b", "value": "12:fF2x2RJqYQ0/sEC1YFyQVZ9J6ruZY/z+i7nhNWb9kBH2p1FIaL:fAx2/5x7C1YYraZYCijhEbaBHMxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780211217, "uuid": "63d7c68d-4215-448d-a6e3-9bcbc8553063", "value": 510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780211217, "uuid": "d098fe72-4b59-4d31-96fc-e70217154d37", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780211217, "uuid": "c4d2faca-cf94-438f-8800-1f6a1359052d", "value": "Tai-macOSx.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8a9ea1-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213307, "uuid": "94ce2c04-6704-4ebd-a6d2-bdc07ae4c579", "comment": "Malware payload (Mirai)", "value": "64491fd01ea07da8db951ac8d3c72cd0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213307, "uuid": "af2641c4-ee1d-4ae5-bb45-9a53832fe6dd", "comment": "Malware payload (Mirai)", "value": "f4823d8c325a74e7c02452cf16fedf79cb013b984f8d0f4b67667744380cf1a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213307, "uuid": "f9f5736d-5dc4-454e-a8a9-25509a11c7b7", "comment": "Malware payload (Mirai)", "value": "37009295cac291fe8da12fbce714f01d05b17dda", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213307, "uuid": "e79f42f4-ef14-42ba-8e9f-5363b2bf8813", "comment": "Malware payload (Mirai)", "value": "26940bcdecd5759f492a4a5eea0214136f59771a22e5d981d2800bd64e253eff8d66d685e0ee86acbf842fbc3c5d28ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213307, "uuid": "53e0f1e9-3e73-48e2-8b97-afdddcf8268d", "value": "T1BE83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213307, "uuid": "4a0a3d50-61ff-4e12-97a5-7893dcbf8b3d", "value": "1536:iVLymx1KZJkj752dCexuV/8UZlDwfkJ4MYfWm:iVLyIUOFezxu5VD1eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213307, "uuid": "ef22121c-cbfa-4627-954d-e427f234e100", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213307, "uuid": "279c4619-2cc0-43ca-8c48-ba401d43863e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213307, "uuid": "39e30414-9c1f-4998-b135-9f476708d3fe", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dccf76c-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780213307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213307, "uuid": "1a6f808a-8dbd-4164-9cc7-c99c617a1c0f", "comment": "Malware payload (Mirai)", "value": "075bcfc787bfcaca320655c6c0e78bb4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213307, "uuid": "57ef7d8e-5400-4307-86e6-6b6ef13f67ef", "comment": "Malware payload (Mirai)", "value": "f6c8cd63960e89a7dcefa392ecd5c772485c681e16bf858c0d02db05f59cad58", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213307, "uuid": "a5867f32-12f0-4b09-a0a8-da867e7756f3", "comment": "Malware payload (Mirai)", "value": "64cf1d428390528b28e1aec042b6858114e898bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213307, "uuid": "75f88610-0351-4703-8e03-61affd6f756f", "comment": "Malware payload (Mirai)", "value": "0f8758643119249c07f60f8356953699161038bdfc9a301e08894206bcd6f302eca0cc9f00bd7e43ac2ba073ce491505", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213307, "uuid": "9bef01f7-792d-45a9-81c8-f1c7838f8e1b", "value": "T10B935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213307, "uuid": "f21b60a7-a872-4d45-aea4-da7db6d828f6", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK33yPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKnifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213307, "uuid": "a4e80960-0789-4d8e-882f-50a67d9ff3d3", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213307, "uuid": "8324946b-d27c-4f82-84b2-40909bd8bb61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213307, "uuid": "703f0976-5bc5-4cbd-8e62-0e7a57960c14", "value": "lol", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3aa895d-5cf1-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1780232913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232913, "uuid": "ded107a0-1026-4596-a421-b121a2389d3f", "comment": "Malware payload (WallStealer)", "value": "d248a815e0be4851422699824014a894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232913, "uuid": "78d5cc1d-f157-4485-b821-d51f7f5336c5", "comment": "Malware payload (WallStealer)", "value": "f6fede4766c0a20a2d0d95b2d642d574c1d003bb8dc9fff448b24c7e3ee198f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232913, "uuid": "9bff9095-c314-4d34-aefc-e11a49e313a7", "comment": "Malware payload (WallStealer)", "value": "aa413e47d1e68e6ec0d549c97af7d8c0d72f4f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780232913, "uuid": "1846feb9-dd0c-49de-adb8-0ab40bf93ad6", "comment": "Malware payload (WallStealer)", "value": "e1c781e69a27bca9a18981d4b9545b14f233014dfac9ea4caea02dc5f9a3454df3b5c9594c733411fa9df19166e3b182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232913, "uuid": "e0a3e52b-e466-4d55-9501-85931df8b460", "value": "T12E16CE877CA2A5E5D85172F768A701B07B64BC546FB1A3F32DA862382F315C458F6F80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232913, "uuid": "2fd32a23-4654-43b5-a2ba-82f0acd41681", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232913, "uuid": "4f958b16-a79c-41ae-a52b-65ec18af4bb2", "value": "98304:4iMnUZ5znOy8znDND7Gy8UD5eIqzsF8jfx51HAT:4vUZ5zO/3GoV1qzMYb1HM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780232913, "uuid": "11d6991e-db70-47cd-ac84-6b8c165e44c7", "value": 4310152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780232913, "uuid": "9f4b1948-8263-480b-bf9a-0691657286b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780232913, "uuid": "62be41d9-6ed4-4827-add0-ba8d160d9e2b", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3695d174-5c8a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780188411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188411, "uuid": "4fd43424-1cfe-4609-967f-8a99b3d82c8c", "comment": "Malware payload (Mirai)", "value": "d18f53c723f597f48b4fd45e6f26d5c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188411, "uuid": "ecd1b482-4ca4-4edc-890c-5fcdbe4d6561", "comment": "Malware payload (Mirai)", "value": "f786900b75649189de3fff6077fb97e8949883d136fab84bc77cf07e162d4232", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188411, "uuid": "3909ad6f-cf1e-45cb-b9d1-7e2ac2ec4663", "comment": "Malware payload (Mirai)", "value": "ba5464607e2197a7812b31ba121deb7ae5cc6db7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780188411, "uuid": "55572c49-dbb0-4f4a-881c-dcda15b789ff", "comment": "Malware payload (Mirai)", "value": "c41c244cb162cc8411ce07dac1be7183526321c606620299be57e2d993c0a3eb74eb4fdb9a16813ccbef97e3336139a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188411, "uuid": "15979095-f807-4c2d-83c1-607fc4b5d2a8", "value": "T161A3850F3E554FBDFB6E873847B75E369245239626E2C140D15CE9002F6424EB81FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188411, "uuid": "b1365341-a446-40b9-baf6-2de3e69cc4d1", "value": "1536:uoZm1d9O9hdZIzHcUhFt7yrBOevws8dR+DHxJFc5RNNM9byVmmYvClDomisV:uoH9h07EOevw91mmYvClDdim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780188411, "uuid": "d2703bb2-e20b-4c36-bd90-31b0976ee94f", "value": 99228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780188411, "uuid": "72db6430-e63b-48bb-8bd9-4f30efcc8083", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780188411, "uuid": "cd390286-a0e9-4f22-bd7a-3c691d593da8", "value": "f786900b75649189de3fff6077fb97e8949883d136fab84bc77cf07e162d4232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721c9ec8-5d3f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780266250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780266250, "uuid": "a5059dbc-babc-4f56-a4f5-5de125dcb753", "comment": "Malware payload (RemcosRAT)", "value": "ab37edfd1afe8134f9c08b4b8fa936f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780266250, "uuid": "87e43ca4-4875-476e-8d3b-7da418790f76", "comment": "Malware payload (RemcosRAT)", "value": "f95d799399a156215867e534d0b600a3851b255d697c54e5ad4bcc47a41ac842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780266250, "uuid": "deaad631-2e07-4e99-a081-315b8b34862f", "comment": "Malware payload (RemcosRAT)", "value": "d7857a83174c7e03180a8985fe77c7a0d7909684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780266250, "uuid": "1b4f897e-56ea-4930-9e44-88f344794890", "comment": "Malware payload (RemcosRAT)", "value": "c6a671cd9cf5262164107383189682fb52963087ff3fa05d156ea0bbeb7fe3d984a0915056ef588f1a8fa5ef2f4daaf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780266250, "uuid": "41a322f2-32a8-4652-bdba-2e23da1344e0", "value": "T1D2B4BF82F6C2C0B3E67610700836A765CFB8BD210C36DD6F63CA1D6ADE75151D63A7A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780266250, "uuid": "2cac3f56-b6b0-4fa3-8f87-aa3e0c571892", "value": "12288:PxMF7oFCucg7QVdQrnBGnIU9AQXLvsPZq:OkFCxqQVdiBnQXLSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780266250, "uuid": "c62b99d0-4533-4126-bb77-9663c5473bc7", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780266250, "uuid": "3048d702-647f-4683-865a-93675e6246e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780266250, "uuid": "9a57cc2e-cc11-4d9c-b8b5-4cfa894593de", "value": "remcos_clean.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84df36c4-5c8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780190260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780190260, "uuid": "5f60e2aa-702f-4bb0-811c-b862cc0e972b", "comment": "Malware payload", "value": "5604e450e03f06fb74d9368afcf7751d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780190260, "uuid": "3a1238e9-45ac-47a4-b34b-f414a523a793", "comment": "Malware payload", "value": "fc05f3d67d42376c732be5fb967a80eaf235995a45cd508354306b57f080697d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780190260, "uuid": "ecc544e7-a741-4a10-b6a8-21dbb028eb1d", "comment": "Malware payload", "value": "62aeb2ea43594f81887411eebc7d8082a5d2afbe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780190260, "uuid": "40bfb5e5-182d-4b5f-9fed-7ca74a5a6c33", "comment": "Malware payload", "value": "3e1748a23041cc5d3060ef44ab6837ba89c2d6b7c27f28882bddd1a0613f31edf7ea67248fe817db7918999b47324665", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780190260, "uuid": "ddc915f7-b964-4ac8-9127-78caf83b7d1c", "value": "T17BD097A25473023294A24916F2EAA401B0408B3E7E80C10EBA1B20B02F98307F2C12E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780190260, "uuid": "c227e3b2-032a-4487-a067-9f8f66d2d379", "value": "6:hTA22IFiF/HFHtE2aupAulNXYq9DG+NjVsNXYrkJ:VT54pEPQPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780190260, "uuid": "f5a595f9-4a32-4b1a-a155-f4be04387551", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780190260, "uuid": "259dde1b-a69f-40b8-b45b-913e1b1c3948", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780190260, "uuid": "511155ff-84fe-47cf-9d06-5a2208b60029", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aae0ca9-5cc4-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1780213463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213463, "uuid": "6da4399c-bcdf-4038-bb41-990f774bf900", "comment": "Malware payload (DDoSAgent)", "value": "67623ed7cf10fde7c9bc75e42869b659", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213463, "uuid": "2900bb8b-aaee-43fd-9c36-5b0b25c20b4d", "comment": "Malware payload (DDoSAgent)", "value": "fce37a41e1d139b1614f285d8aa61c51f50d2ed739fe5c461a6b38afca10ff75", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213463, "uuid": "0169332a-50f9-40a0-b8bb-3385bb03a6b9", "comment": "Malware payload (DDoSAgent)", "value": "7d03156e858812b73b1cb516f5d6d88aa5bcd552", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780213463, "uuid": "7d0b8d63-d734-4602-b060-1f3f673e596e", "comment": "Malware payload (DDoSAgent)", "value": "823266101f3e22c03fe7073e59ecfff70d7ffa9b70bbd1629bb0c47f75cf3a9b60a23e0bf24c92dd5780fcf5c9ef8075", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213463, "uuid": "250ba01c-7542-4643-afca-55f74d3a3e19", "value": "T12E768D91F748A235E9560A3248630B70B3915E82C1F8C96F970AF72F19B26F7594FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213463, "uuid": "002cdb90-a091-44c4-a0c7-6c2d27507fa8", "value": "49152:A1OBt0q6GLZFK00pfBqSlC9KaH/ko0fKQQy6H6IyHyH55HH5dHuAnN5yRvRv1jHo:iq6QjKppfISA9fcYDTyRvt1jnUjEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780213463, "uuid": "17e4fd1f-79e6-44ee-8982-0224f8119e6e", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780213463, "uuid": "5a079324-123f-4161-a772-50e594b8fd67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780213463, "uuid": "fa152fb4-62af-4d4f-9c83-9c1259f0094c", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f02b7a-5d4a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780271133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271133, "uuid": "bbeb2d84-1dd8-4397-b9f7-9aad1a12235b", "comment": "Malware payload (Gafgyt)", "value": "b32c17e41e95c3863a95ee5961f3b5a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271133, "uuid": "ae37e547-5087-46f2-be2e-0a6d9cc5ef0f", "comment": "Malware payload (Gafgyt)", "value": "fdecc3228522eadfc42f6ddbe6fa3ef51cdd83b6ce45b786a744a3776ae39ab5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271133, "uuid": "f93e1d32-91ef-4daf-9c2d-532e68a0aa0a", "comment": "Malware payload (Gafgyt)", "value": "2495096f668599f8a630605d214eb099d28c42d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780271133, "uuid": "40960ed8-9290-426e-8328-3691bb3fc739", "comment": "Malware payload (Gafgyt)", "value": "9ebc2cec32942187e583b24c13eaff5006e38799b577451dcb0759b07cc4cb5563ed14e6d0c660c6142c65a2d65999e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271133, "uuid": "8c5af465-a390-4578-b229-14b9aace07f6", "value": "T1C382F71BE7B76E0BD0C0A77200E3132AF6A6AF984118AB5F7D151D5E7E483102C5B79D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271133, "uuid": "7f655d48-e5a3-416d-ac24-347b70970827", "value": "192:NVkTlVRgKa5P2aJDaf9DTG2PYGmRvhwn6AJs59AkDYs8Z0fB2PTjJRw0rWxuyAaf:NVkU5+KaXGS1qvGc9AkDY62bTPrWx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780271133, "uuid": "9c242615-92b6-476c-a45f-f6d656c813dd", "value": 18380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780271133, "uuid": "35a696a5-f95d-4c71-a256-cd22116d64e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780271133, "uuid": "d7ea00b1-7f0c-49ab-bfab-bd45f6c9b618", "value": "gov.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5a05a6-5d28-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780256305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256305, "uuid": "2b8ba1ec-bb84-4f1a-805f-d35784777c59", "comment": "Malware payload (Mirai)", "value": "0ae8cf4c09251fbe8e2e66b83d024285", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256305, "uuid": "5e458bf0-c0f3-4c14-ad4f-068fe3c18012", "comment": "Malware payload (Mirai)", "value": "ff84293989668700bca8aed7335f31bf6a24add294ed550437f89eebe3cfe69a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256305, "uuid": "405b434b-ef83-4a8d-bb96-b10e815def43", "comment": "Malware payload (Mirai)", "value": "36525204e9b71c04b3ff60d13b227486eaa359ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780256305, "uuid": "ecbb9fe9-7421-4f1d-b26e-ebb953ac67e6", "comment": "Malware payload (Mirai)", "value": "41d569a9b5a099e0799e65b80c9f5d63ffce74a87b7c535f3a9ac5aeaa8d2208dd9157da9ac74b8948c4d738006dec68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256305, "uuid": "07343958-50cf-41de-aaa8-a9b813170dbc", "value": "T134B30A427D419F13D5C322F7FBAE42983B136B78D7EA3102E9247FA127478DA0E66611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256305, "uuid": "f85f64a0-35a5-48c4-9677-e35ae02a93e4", "value": "3072:yA4QjDVXRQOcVi+rS0oI+9NFudhs16va97Y2Vu+:+0VXaOeiaS0w9NFuzs16vaBVu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780256305, "uuid": "b17f0a17-9445-49ab-afca-7c0e5fe04598", "value": 116764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780256305, "uuid": "82ae72ad-f450-4170-90e4-4607a47646f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780256305, "uuid": "313bf3ee-281b-4dd3-94ee-6cea676cf887", "value": "data.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }