{ "Event": { "published": true, "date": "2026-04-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-07", "timestamp": 1775606581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2cfbf277-f5d5-4daa-aeaa-c2ca3a78645a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3635715f-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554141, "uuid": "19436a43-3c08-421b-8d5a-13cd59b7a757", "comment": "Malware payload (Mirai)", "value": "9bffc3e0deb9cfbe55fb5594ee05d730", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554141, "uuid": "5ae4eae0-ba80-4260-9348-7c6ee95b07b1", "comment": "Malware payload (Mirai)", "value": "00ed9322003adc1cc907bd507d6df5bcf46506f3f9bc9dccf703870bc2b92d76", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554141, "uuid": "997361c8-44c7-4a04-807e-dcc2e3f76674", "comment": "Malware payload (Mirai)", "value": "02b25ba6f51c513fe5c24baaa701351d614a89e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554141, "uuid": "7e721158-ea8f-47c5-940d-2746ec1d090c", "comment": "Malware payload (Mirai)", "value": "b69088a0da7effa38e291a7d7225590856bd655777862aaf9bcfc4d7cfa065ea75cd8e70193f5d05ac611a4e3b5b7568", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554141, "uuid": "fb38ec01-1e06-4884-98eb-e9888657f499", "value": "T1C0531262D80368BAE7237D77B3F00EC3FA0D4B72749C687821993158FAE55612C61397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554141, "uuid": "3bb1fc88-f6c2-4037-bb79-d7c9441e468b", "value": "1536:Y7XduYshWhq/HIEy6Og3Nwz9hAyXELOLSM5Tfv83KJGTb6R4a:qdpssMPR9w4yDLXTX83K0Tb6RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554141, "uuid": "38359a3d-835d-426b-9f8e-65f64b7730e1", "value": 61840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554141, "uuid": "53ba3a42-e9a0-4b82-a1aa-07ac22ac7a4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554141, "uuid": "068ceb62-2b4f-4136-94b4-d255494d87a3", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041ccb24-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539883, "uuid": "e7184d5f-7edc-436b-ade2-e1448c74506a", "comment": "Malware payload (Mirai)", "value": "37efacbcd6eb8fc1aea87ad2bfc66ea7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539883, "uuid": "29fc60c1-33b0-4197-88c2-0e9d62d21f59", "comment": "Malware payload (Mirai)", "value": "016fdd1497c7ede367e3f004ca8bdc379e4542c0cdd808fa4555aedf2cb18106", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539883, "uuid": "1325a365-06ad-48db-8742-c7e17492703e", "comment": "Malware payload (Mirai)", "value": "f9c0aa7294712bd87f7fd480e75f868da3c6e3ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539883, "uuid": "6a089800-8881-4831-83a9-14d4478a5b59", "comment": "Malware payload (Mirai)", "value": "e52007701114c164b98a717f219224fd753f2dce6430005f3c9a319c7c8bae406f218cd4b5be0359d1ce80025d3542e8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539883, "uuid": "a0e68717-53e9-4b01-a9d8-de73bed08484", "value": "T12D23F136F775751AD5BACF3913581A38920212AEC860D34E196531B78FDB08CAADFCB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539883, "uuid": "48280519-27db-4bd3-bcd4-ffd0e81973f6", "value": "768:WnnivyWEw88iE3MMvWSfoc3uV+avnInAWML3UxngfYWJRN7QNJL8EnJm2m4LSZ/c:WnndNw8LqMmWSQdV+aJWMLesYMR+JL5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539883, "uuid": "8f6be043-809a-4d95-b98e-085c2b56a656", "value": 46764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539883, "uuid": "a9ae6a55-2275-4dfd-ac80-50068fdd3be2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539883, "uuid": "48025f90-734b-40e4-94a8-a0fef6495d53", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e765570a-323d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775537688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537688, "uuid": "e75776e9-9a2e-4b18-9f88-6fb8b753a4e0", "comment": "Malware payload", "value": "a7f96b85a333b03857df1dedeaebfada", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537688, "uuid": "b767a8f6-f3c6-494f-85a8-7c81e140a473", "comment": "Malware payload", "value": "0178614657bc1d8fc32f230d3459f38cd329db35a267040f1f0285e6491408e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537688, "uuid": "1ecc551e-5f0c-43f1-b4c9-f82e220e92d1", "comment": "Malware payload", "value": "ddeb990d03e16d27df18bcb48dc1cbcf0e409b92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537688, "uuid": "b798ffa1-268c-4adc-843e-c870d62b61a5", "comment": "Malware payload", "value": "2c4da5883b9d9a3715c3c0e170a8e83eea0b3dc95b9b460b3d37224f0990dd582c2561fac45d08a24bfcea0ace2e09d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537688, "uuid": "d3d39ccd-84ab-4cca-bcef-c263c5445aee", "value": "T13D463911FECB14F6E5031D3144BBA26F23315D068B24EBC7EB547E29F97B6A61932209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537688, "uuid": "87e97a47-fc91-4cef-9ae6-137e5d27a609", "value": "49152:wNgLQ3fLC+623hpMLt/JejxN9Adlyavd7EybeiTieahhDqA5EL:wOLSLzpP4JeVN+dly8d7K3ayEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775537688, "uuid": "0253ec1b-ebde-4700-98ef-ec50b9ce5fe2", "value": 5742754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775537688, "uuid": "0b8a253a-7d8d-4066-8662-1a5aa71164c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537688, "uuid": "36396468-db77-4b2b-8c7b-93618edfbd99", "value": "li7proxi686n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633cb1e1-3238-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775535318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775535318, "uuid": "ff1245b6-acf9-40e2-b548-418de535d182", "comment": "Malware payload (Mirai)", "value": "c416dbc5bab6eebab18a7f39a42e4762", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775535318, "uuid": "61a0d474-16aa-44be-b9c0-070c6ee78263", "comment": "Malware payload (Mirai)", "value": "01a61df6707822b6fdf56ec5cf4a7e144c4b30d56e8ddc2b65577b24d5d4f49d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775535318, "uuid": "1bd69d15-6081-4eaf-b1d6-53c589e036d5", "comment": "Malware payload (Mirai)", "value": "bdfd847b213c1106dcec6b41a0296842c84367a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775535318, "uuid": "fb9931e4-123e-4788-b7c8-cf7737efbaeb", "comment": "Malware payload (Mirai)", "value": "9ccdcc5f9a5a22c996ffc495ea0bb0bc6d2d0fc72c511dd71d00b2c1ba1e890ed52b460454dde9836ab1111f4036eac4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775535318, "uuid": "39189b1d-29ae-44d2-8623-57d874bea39d", "value": "T1E5733C03BE8289EEC45BC2F457FB66319922FC3D093276DCA7E4BD923A49DD02958750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775535318, "uuid": "febe2fbf-ac21-401e-bffe-317211ef37dd", "value": "1536:yaHsrkuHf4mVa+zIgTqjrwyQRKqoyasQ6UV38A:fHsrku/4mVargTtJRKqpQ6UN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775535318, "uuid": "3567f00b-88d9-4109-b318-f6cb7aca2c16", "value": 77720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775535318, "uuid": "dcf9c097-c970-4f08-a301-594b3a3e26de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775535318, "uuid": "1cefde4b-3069-4727-89de-1354cdeaaf5c", "value": "zyre.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4864957-3262-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775553467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553467, "uuid": "dc5df6dc-3a5e-4e8f-b536-af53d6d2cd6e", "comment": "Malware payload (AgentTesla)", "value": "abe4d9cd0017bad9aec639eca08593af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553467, "uuid": "4ed073d0-6f05-4a71-a03e-50183147beb8", "comment": "Malware payload (AgentTesla)", "value": "020643859d860215d31c7e7201e40a1ff61a11ad5ea23fd1dac85b1f2bdbb3c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553467, "uuid": "3ca70f72-8c18-4c3f-808c-27d323eaaf54", "comment": "Malware payload (AgentTesla)", "value": "17c0e9cc3559516e2d0d405532bf1b467f642b22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553467, "uuid": "c523a3a5-36e8-4390-8a23-14a6eff3241f", "comment": "Malware payload (AgentTesla)", "value": "a8bcc8bd5e904d053f76aabb5cc0d2dff47f517540354bbae6697146fc5e063195dab6d5ec8e7a74c9ada1f28cafdefb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553467, "uuid": "9c75c4be-2cc1-4420-8979-978c099e4f90", "value": "T114949C037D00B376CB9206F12A69AD5506B3BEF0386FA5CEE3D176DBA6B2D8145391C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553467, "uuid": "48790e10-9aad-4fb0-8c2d-b9adcb040e2b", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553467, "uuid": "8e98ce5a-267c-421e-9c7a-c5ab8025cf68", "value": "6144:BR+xXQQwnYELusDJ+opq9v5c7HZVviO9QjpK5ms:PswnbLdq9v541iOCVKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553467, "uuid": "cbfe9bcb-2aa6-446e-a1bc-336a6125cd52", "value": 432112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553467, "uuid": "555ae646-e778-44de-a709-50d06b1bef2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553467, "uuid": "1becea6e-91e1-473c-9563-25644dc8b80e", "value": "00928737364511122001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cddace2e-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552677, "uuid": "e81ea98e-3a55-42b1-8b52-3712be030f33", "comment": "Malware payload (Mirai)", "value": "f874c2e61187c088b5d4ff9ec24df262", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552677, "uuid": "a1c9d582-991e-42de-9131-c1b9297bf658", "comment": "Malware payload (Mirai)", "value": "02593a5fc3145ba6525dfea9242c2e77c87e6322c830e9bf2c44e1f46361e64d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552677, "uuid": "0fa7fb5e-0aa2-49c5-bcfc-06a7221b2218", "comment": "Malware payload (Mirai)", "value": "0bae15f7fbd245bb7c86f0d50c0d9c5bf3c88b19", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552677, "uuid": "9e750374-6820-4ab1-bb0b-ded203a6d394", "comment": "Malware payload (Mirai)", "value": "0896b3b04beff87f2a17be0422225513b45757a2b37a2b8fbea73b81c240af63765b584e83b06c78b95417dabc00777c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552677, "uuid": "62049057-8904-49e5-88e9-9029db3500e8", "value": "T10103F15802468CE6CA60D6FA4AE507D534705FA0A747EC4FDC96E3E78CA1AF8384F990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552677, "uuid": "30be4558-72aa-4745-813e-5dfc844d4e5d", "value": "768:di231FZvxdHUt9JqjcXp99cwZDzaDOCL4QloGjRpSpffAbTJgGlzDpbuR1Jh:NhxAKu9VDzGB8ffAbJVJuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552677, "uuid": "a5eb3090-eaaa-440b-a5a7-3006f0919681", "value": 38956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552677, "uuid": "eecf2ab6-62b0-4c20-b7de-3685e00eeb8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552677, "uuid": "f86d994f-d264-498e-b1ad-0ffe7100d8b8", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a345625-3298-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775576454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775576454, "uuid": "b3f6eb5d-e9b8-4673-8262-59e40967f80a", "comment": "Malware payload", "value": "c3dce378093a1b5065cd87a52717789f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775576454, "uuid": "0279beee-93a9-416b-9e6e-249159cfdbbe", "comment": "Malware payload", "value": "03783a9b52d7d464ecbc070eb9ac42ff233dbabddd1c8c2a20bd5f234ae40df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775576454, "uuid": "b1e28dec-a785-49ff-9761-d2e7e32be3c7", "comment": "Malware payload", "value": "c20475ce6b380100a877c47e043373a741c0022f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775576454, "uuid": "9bfbb243-a8fc-4dd7-bc08-07fcc7366ab6", "comment": "Malware payload", "value": "348223c3f8c7c6327532719470b3443d9d32150c0fe15c1b2e2898f8a4350d0f230b1501ca9134f6540ec7f06dcbbd52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775576454, "uuid": "1de1e5ed-0239-4b44-92c8-6d185c979862", "value": "T156878B0773E60095E9B7D1388AA65507D773B8638331CBDF329D06152FABAD09A7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775576454, "uuid": "b000726b-f224-4ad2-9cee-0222a87103bc", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775576454, "uuid": "fe270774-cc98-466d-8dab-ef2d31ced681", "value": "393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfH:fMguj8Q4VfvXqFTrYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775576454, "uuid": "cb157c7f-e507-4809-a2e7-80ce513e4f41", "value": 37664922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775576454, "uuid": "8969508e-531d-48be-bb08-56fa9fc39b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775576454, "uuid": "63761cc3-4bdd-4b47-b156-674367d10275", "value": "Deushack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba180c21-327a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563811, "uuid": "db56dfca-761f-41ac-85e8-154e84dfdacf", "comment": "Malware payload", "value": "0d7c3af088b27a9869f667b7d3cf78e5", "object_relation": "md5", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563811, "uuid": "cedd6e93-cb5b-412c-b6f0-12eadb8e03df", "comment": "Malware payload", "value": "039d648b4cf627faab87d555e994f385ee328755d7441d4a14e26a2bb680d661", "object_relation": "sha256", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563811, "uuid": "873ff6e3-130d-4676-8a0c-043bbd62d545", "comment": "Malware payload", "value": "4c1b57020f450abf5564abab901318ca7ab13ad7", "object_relation": "sha1", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563811, "uuid": "f861046c-9564-4a61-8916-2c808259df09", "comment": "Malware payload", "value": "6b8ac496d2874f57096f4db4ee35cb9f3b1e1b3999bb34283709bdfa941a2c615f58cb126ff5ed5d99b953efb6fce8d4", "object_relation": "sha3-384", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563811, "uuid": "b0bba6e6-967f-4dbb-97e8-598604eafc38", "value": "T1BD136D6926813C289D9998371D7E2F0CB9A983E6310851DCBFCB3CF58D1969DE218719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563811, "uuid": "0a94251b-a84d-46da-92fa-6b1ccd14a272", "value": "768:bKsXOGVv+9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bTLjco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563811, "uuid": "e82d7bbe-c3d7-49a5-abb5-0939d9a2f5b9", "value": 45514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563811, "uuid": "2c48ddda-fc55-4694-8598-8a6b5de4aabb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563811, "uuid": "0449f4df-a3b7-4cde-a7a7-a3a36e8b45bf", "value": "039d648b4cf627faab87d555e994f385ee328755d7441d4a14e26a2bb680d661.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f106962-324f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775545217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775545217, "uuid": "9be772bb-2544-4707-8897-481e2c90c565", "comment": "Malware payload (Formbook)", "value": "e9b50165661f28064818b674de10844f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775545217, "uuid": "2055eb3d-1876-4f84-8d7a-dea1c482c480", "comment": "Malware payload (Formbook)", "value": "04ed8e5814b643d44b7be9d4a9f5c328e2f36a8b6e8a085d1c9c80ba49253fd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775545217, "uuid": "3dbc60c9-4393-4651-8e40-f682eb4db30f", "comment": "Malware payload (Formbook)", "value": "e3f4db9dec35db2e9b06220feabc736045ce0797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775545217, "uuid": "11a535a4-d0fb-4ee1-a26d-72f162d8c0e3", "comment": "Malware payload (Formbook)", "value": "ee8c1def36239d8b02f19fae19d3c337ebfc84820d00b84cb7371e1e55a5490dba00f915bd3108b468ded89e4a3c7b55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775545217, "uuid": "ce2524d0-42a0-4443-8903-f364bd234508", "value": "T1CA251265BB59C902DCE213B805B1E37906796DCDD902C31B8FFDECEB7865A5A7808243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775545217, "uuid": "842ddb8a-09aa-4bba-aeda-3175474711a4", "value": "24576:YYYD248+v9EQT1OVDwQV3qw5gADJONFKvmlslO:YYYD3vWgoRV39FC2mlsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775545217, "uuid": "efc74cf0-d4f8-4296-94ab-8fa4f2aee61e", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775545217, "uuid": "bc534f3c-51e5-41e2-8910-7a5a30e16d10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775545217, "uuid": "e709334a-915e-4f3d-8cef-e283a34b02ea", "value": "z1InvoicePayment4632.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ac9fdc-3246-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1775541470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541470, "uuid": "19d9d074-708d-4480-ad67-5b30c32d4fb6", "comment": "Malware payload (StrelaStealer)", "value": "91e95a20d9abd16c107b2ad78e448b54", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541470, "uuid": "1332fb64-6f3d-4769-824b-eedb5c74d4b2", "comment": "Malware payload (StrelaStealer)", "value": "0563f9e1d0fe8c2cf932f55fb8341ee86c1d1ee7d1be5d99f929db36d92dcf97", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541470, "uuid": "b268afb9-14a5-4235-ada3-9a85da75e286", "comment": "Malware payload (StrelaStealer)", "value": "34c8e0a398edd959361dfb410697eb97529a20c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541470, "uuid": "32d36fcc-532c-45c0-b507-54838bafde06", "comment": "Malware payload (StrelaStealer)", "value": "b81050fd4550512cd8fb1b1c2e1819170e46bd13818692cfedb17dd10509fbfd140388bfdf80818f25c7fbf806d846b8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541470, "uuid": "d29dfbfc-9806-4972-bb72-3ff1dbf52bdf", "value": "T1E664D001E6BE1315F2F35B81AAFB98E08C3B7EA75B5D85E915044D8D0BB1A4488E3737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541470, "uuid": "e0efdb5a-5d0b-4a07-9513-e921f4d8b2c8", "value": "6144:qT+SkqvrQgrYIFC53WoPjRo+XdYCPlQNKSu62AKGLDkmNbfaBwZfdtZ:q3DcIFCZWCRJXeCnSmGLD9Nbf0sfdtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775541470, "uuid": "7b97db49-4a50-47f8-af7c-88b2763bc879", "value": 318950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775541470, "uuid": "b0bad3a5-122d-4c74-960d-3607f94cdb78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541470, "uuid": "771d9009-3659-4dd3-9466-5ca12ad0fabf", "value": "PO#MAIN450000000227897_Sraco_docx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f44e44-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561895, "uuid": "a44e87e1-16c7-494a-b1a5-fab729ca0db3", "comment": "Malware payload (Mirai)", "value": "8187cb355a05a17bb9ae910e2d5c75e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561895, "uuid": "6cdb69b5-a793-4b32-9f53-aba5cc826058", "comment": "Malware payload (Mirai)", "value": "059614a04052271ee94500b6b799b70ca0191bd573ae1b3348d31ada95da3992", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561895, "uuid": "31b3d890-50a5-4fee-a472-ea4d220c103a", "comment": "Malware payload (Mirai)", "value": "f67e18b21d1d689772115b83a3a34e07ed5b4e4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561895, "uuid": "33f16916-dcff-4945-b96e-b8ad7ef0eb32", "comment": "Malware payload (Mirai)", "value": "991788c664c8cf17d31dbd40f1d199cd5441ac29de0ad74758e86b212645791a68b0ec49d415a17cdf55c932fa3f5194", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561895, "uuid": "eb1270af-deb7-4ebf-95f8-766bd6cf531e", "value": "T1EBE3D742BD418F13C6C721F7FB9E42983B166B6DD7EA3102D825BF54378A4DB0A36252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561895, "uuid": "f399482a-7f45-4ac8-bdfe-02771dd27812", "value": "1536:vRys2CV9Sl59zGftkn/28y44VhPkb+VKITlPVwywiIUJjRSwYwyP7K7yrFbQ/OhS:vABiyQmn/b43kKcKjnR7KFxBl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561895, "uuid": "dccdcbde-cbc9-4680-bdc6-28a967a140a5", "value": 147136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561895, "uuid": "61e96b95-15c5-48ae-be61-dce840b3d1e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561895, "uuid": "1d3f9583-9829-462f-922e-383959f2df68", "value": "narm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa5751b-3272-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775560161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560161, "uuid": "686c7136-585b-4a1f-a92d-67a6f30ecdc7", "comment": "Malware payload", "value": "a8e94d8c561278569275a13dea56271e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560161, "uuid": "9cb5c045-f115-4936-8ce7-35d0b74de6ac", "comment": "Malware payload", "value": "05ebe45dab4501184d8e7b0fdc079525f7731089c4dc5948c2e9ae00b9a14969", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560161, "uuid": "cb30e85e-f1ae-4e27-9a68-74ee2df12944", "comment": "Malware payload", "value": "f6bb7ed9a967d7dec3a0fbd5df83111b4ec2402d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560161, "uuid": "cec05388-37db-4384-9200-d1798a7a02ea", "comment": "Malware payload", "value": "68f5c578099eee817748819541ef9ecaa88ec79044cf3bd776b0a8feceba633c1275697038b4d713fb84ab2997ac6c97", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560161, "uuid": "140f2d77-468b-490f-8367-922f54b84470", "value": "T1063533CF8551F316A66903C29DA98EBD1807A6F7B0FEDAE99361C13C3A099470351DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560161, "uuid": "75f467d9-5b97-450f-83e6-55455a3b4a54", "value": "24576:WkkDSHNG/zrMh0c2PyC926Z/nVj8kFukC3lW:n90/z4ucs92E/nZ8glC3lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775560161, "uuid": "20154fa5-08fd-4eaa-beeb-c990b1a58167", "value": 1124607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775560161, "uuid": "b8ab3502-3a67-4f5a-9de4-98e7b7941177", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560161, "uuid": "01e86719-4c86-439a-b181-9af8ce9bad63", "value": "05ebe45dab4501184d8e7b0fdc079525f7731089c4dc5948c2e9ae00b9a14969.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c0e97f-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553016, "uuid": "4e018e79-05ea-48a4-bb7b-9bbdf6d97e8b", "comment": "Malware payload (Mirai)", "value": "46ffcd125b76b72bd6f6a991d935d769", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553016, "uuid": "17d910ed-436b-4519-802d-945ce7bf4bcc", "comment": "Malware payload (Mirai)", "value": "061e3e1591345efda1a1c8d10d56451dbad5a54005c09cdef8f4773954b56932", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553016, "uuid": "167514da-36f3-4aa2-aa4f-17927d734d53", "comment": "Malware payload (Mirai)", "value": "6f88d8a0e9c5bce79a6c843565cb9f22de63322c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553016, "uuid": "4698ff68-8a74-4dc9-9a9a-13770da201cd", "comment": "Malware payload (Mirai)", "value": "4e4e8618c1768889b1add71313c4b2153fb9c2b13fdea25a874320377892c25ea56ffb4754ef108ad06946a5253a57a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553016, "uuid": "a18df14c-870d-46dd-8ba3-1817313da85f", "value": "T1E1B2C014E0881FEAEDAFED944A4A838063E30ADFB551D1D330DDDF120696A1A2558ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553016, "uuid": "1c878ce1-8326-4237-b76e-384070a14c23", "value": "384:iXKdFC/LFWX4BlPWttguKEP9AMfzwNNKu8YEyRA+Az+BdLxmRQ+VM4uVcqgw05Vg:iaT2Nle4uKEFsTlxe8Lx4Q+64uVcqgwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553016, "uuid": "1d74313a-673d-4ecb-aa56-9ab86821755e", "value": 24228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553016, "uuid": "fd366a17-f403-4443-a56b-43b25548f335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553016, "uuid": "5ee0d67e-dd61-4dc4-b62a-5383473b3a46", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16342619-3262-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775553228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553228, "uuid": "99c7072e-f65d-4492-a7e9-b404ff2309bc", "comment": "Malware payload", "value": "325f07d72350d927f77611343821e750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553228, "uuid": "915bd828-c7e8-4332-a839-69a215da5056", "comment": "Malware payload", "value": "0651831bed115fadab00b99b26819c513c0cb03e3781555f6b94700c39fab6a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553228, "uuid": "d1dbfb08-24ad-45c5-b6be-9f2ef7c4cccd", "comment": "Malware payload", "value": "5ce94371c2ec72348c1e275ff01809bdf55f36ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553228, "uuid": "35c4a8e9-66bb-481d-9830-fc1893c9dd5f", "comment": "Malware payload", "value": "d675f2d496a767c4c5df3b89e350c2267a4735563f1d6e84327a98d81b80aab093c10f6b6aeae36426b0e8add8e3d890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553228, "uuid": "ebd30f30-5b71-4e62-a237-4c084077b404", "value": "T129376B0962A440A4E0A6C074C927CA67E6B03C485374D7DF52917AEA3F37BF2793E791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553228, "uuid": "1eebd93c-a4a8-4230-a65f-04c8573b01c6", "value": "d6282b899ac9647f57bdc6b00a424b44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553228, "uuid": "affe2b44-0795-43fd-bd35-17b159b1b0e6", "value": "393216:3iq4rmzH7ZMm59Jwte/d55+eh00l2i8Aoc5jUVb9L30m:zGuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553228, "uuid": "c3e63f70-0fec-41cc-a979-561e6fdf41c6", "value": 22693376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553228, "uuid": "9061a8bc-e004-4ac2-be22-5789ae2f8984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553228, "uuid": "869fe1ba-abeb-403a-a719-4c517ba71028", "value": "qishuiansuup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a87bf88-32d6-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775603137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603137, "uuid": "6dece2e2-92b9-41b7-901d-cab96d0f79b4", "comment": "Malware payload (DCRat)", "value": "54948cf04c8b12fd791f90a3f5e91e26", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603137, "uuid": "efec8d84-609f-4de6-b143-865726aabed0", "comment": "Malware payload (DCRat)", "value": "087a5601bd833d69b1aad7fa35d7e921a00fca6bb6e83403093814bc7df4a1cb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603137, "uuid": "e48ed59c-8331-4707-ae32-442f9f70ff63", "comment": "Malware payload (DCRat)", "value": "763e899b1a6ee81f54dedd106add881f60a5478b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603137, "uuid": "4271385a-530b-4cfe-bf4f-d8c601eb9387", "comment": "Malware payload (DCRat)", "value": "050890185a4b0c15e2825de07987f3e2163693190a5012ea8d7909082a0d53d1dd744b73b50bcb5448a773882f6fe12d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603137, "uuid": "20c46dd7-d917-4481-a0f3-92beaf0f60ef", "value": "T1B705F6027E44CE51F0191273C2EF45484BB0E8516BA6E32B7DBA776E55123A7BC0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603137, "uuid": "16dd26be-7cbe-4169-92de-bd36bbdd556d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603137, "uuid": "5842bb3b-fe75-4a3f-b0cc-e99d3e2213aa", "value": "12288:9+rEcL4MYHOWaubfEgga1ExCwvGzJr8qkWorvqzG+1H1W52Z7DLSYk9:9+d4MYlaYEggADuGFYvuFHU52lL49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775603137, "uuid": "6ce84e13-441d-4eaf-9111-88d0408cf57e", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775603137, "uuid": "38b6edcc-7b73-4b69-87c4-186a41a7785a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603137, "uuid": "69fc56e4-2ba5-4794-9513-0ab6ec130d56", "value": "0087a5601bd833d69b1aad7fa35d7e921a00fca6bb6e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414b5286-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561890, "uuid": "dd4e7545-0fed-467c-8355-68da53de8c55", "comment": "Malware payload (Mirai)", "value": "7886cc49a385ccb9f8d7e2ae5bd990ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561890, "uuid": "bfc73f89-56d6-4f25-96dc-cfd67e7eca73", "comment": "Malware payload (Mirai)", "value": "089f95be5635b9e85e67d0c49f5a8863193e439e93741ec9d0a6e417b3f4a6ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561890, "uuid": "a0cd60f4-6f07-4e1c-bbb1-1bb4f3ba79a4", "comment": "Malware payload (Mirai)", "value": "70743ba2a234e1bd697f3c082379793b59cd410f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561890, "uuid": "69510985-27e1-4b6e-bd3f-3132e4726c04", "comment": "Malware payload (Mirai)", "value": "2010cca998ab5efd1b876c8fb4bf3fa75b08521705c1b74faf151c641fc245d4d785fb63010073d8150d9aac62ab6756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561890, "uuid": "d3b86ccb-4ec4-4618-b5ad-830c175c4111", "value": "T1B1F319C7FD00CEBBF40BF77644A30825B530BBA618521A77721778ABAD2A1D41427F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561890, "uuid": "945b0597-bf19-4d74-8234-076f960e0400", "value": "3072:6LbsHvzTm84Q/72AHF7OsdMVfjbiiLfpKY7br/gQoRyyMYmBd:EoHvzTX72Agsd2LfVzYKyMbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561890, "uuid": "a0dd006e-f8a0-42dc-adc6-d31371ca14ee", "value": 166012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561890, "uuid": "719c0b1c-8ca0-468a-b50c-bbef0175bc32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561890, "uuid": "a5c8dbec-0722-45df-b6a0-f3f4d383502d", "value": "nm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a858437f-3279-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563352, "uuid": "bea71280-371a-4122-bf63-05139a5ae930", "comment": "Malware payload", "value": "40bb6384ac5478bc0cfcc4e8dd13a6c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563352, "uuid": "5cb78a79-30f4-479b-a27c-3841b2975199", "comment": "Malware payload", "value": "09aed8df9e90777f7c451c64665245dc74ffc91312c2eae3d60f305b440f68a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563352, "uuid": "712cece8-5ffc-4911-9a93-448ef4bc8a7b", "comment": "Malware payload", "value": "5759412a6731c690981582234976c796e75146da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563352, "uuid": "40b466ee-8516-4851-951b-8ad8350b0251", "comment": "Malware payload", "value": "e8c8f12502aeeb270151f1e1dd0f3f4306000ccc5f92cfb37b7bb2264d016f732ab4562b5404b75022b94197fb22d8b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563352, "uuid": "193005cc-4236-4a95-acb6-414a9acefee6", "value": "T11E54E114F3EE1028F0F38F119AF66E94563E7D22234D98DD082A4E8D0E766445A97F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563352, "uuid": "09b9fdc9-df82-4197-965b-833b1e4cec00", "value": "6144:M4WGFSShV5f0Q/uO605lnfwckaAaqiPkQFeGILIRofY2DP9Hc0LAUF6:Mhw2KnVkaEQEcW/HXLLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563352, "uuid": "d375e194-286c-4ec3-9749-e39200943658", "value": 305680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563352, "uuid": "4f35ae9e-6d70-42c8-8721-ab52611edddc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563352, "uuid": "569e3b77-3f92-434f-b19c-cf85f6e182bb", "value": "Order # CCI-35791126.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f790db78-3242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775539862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539862, "uuid": "b867fff3-6db5-4f0e-a396-936ad4967af5", "comment": "Malware payload", "value": "45a11575854d6ff8029c5884318cc7a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539862, "uuid": "552d71fc-1f33-4068-a0c0-b7131b895738", "comment": "Malware payload", "value": "0a15af8a9f0feed259acc27145770b1a0dabb08732a9fa44ce793b4448395430", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539862, "uuid": "c7f3b7a7-b6e3-492f-8075-57bfb013d31b", "comment": "Malware payload", "value": "26a6f03cabe616264953b874511ac5f39fc58d3a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539862, "uuid": "e44bd25c-b7f5-4f6f-b8cb-744d23ed666a", "comment": "Malware payload", "value": "2e6122179b75ee0de68e67df0d2cf0fb13c8153087773a6c784d8341d412ec2381c385cd8b529010cc394fa6732036f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539862, "uuid": "5aa62e9c-fb5c-47d2-b64f-8b4a8d90c907", "value": "T132118CE375F278B1321A8C6D336A5A5539431F2708402849F6EE9B649F2AE689842F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539862, "uuid": "54fa7027-ceb7-466e-9055-d3bf8c1370be", "value": "12:hMlU1DsNHMKmFx6IL16irV6jFlIxX9B6IrcVwvCOMmWD6JZCmWDZFFQmtntI169A:jDqMJNLdULSX9d4mqMU6JZRUZFFpt4Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539862, "uuid": "29588536-939b-4c03-81f3-5b168a147525", "value": 952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539862, "uuid": "86fdea10-33ab-43ad-be9e-41c63f891823", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539862, "uuid": "d0f5bcd4-59cd-4f8a-8677-e73ad61daaa4", "value": "deploy_mirai.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39f430e-32d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775603716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603716, "uuid": "35a3a7cc-fc1f-44bb-ba94-c320fd50b210", "comment": "Malware payload", "value": "7bd3201946ef8b8a836bc2f951923adc", "object_relation": "md5", "Tag": [ { "name": "89-36-224-5", "colour": "#D03EE4", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "minirat", "colour": "#1F5B0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603716, "uuid": "78b98cb8-7175-4bea-930e-85736dd04944", "comment": "Malware payload", "value": "0a8ab3d16b12d3a453ee5a3208fe04744ad54514ef8ea27bb8fe32679efad270", "object_relation": "sha256", "Tag": [ { "name": "89-36-224-5", "colour": "#D03EE4", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "minirat", "colour": "#1F5B0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603716, "uuid": "83d30899-5f39-4386-985d-3ab4ebe053f3", "comment": "Malware payload", "value": "db077e20e429b93d9b1187cf09869544d83dbe02", "object_relation": "sha1", "Tag": [ { "name": "89-36-224-5", "colour": "#D03EE4", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "minirat", "colour": "#1F5B0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603716, "uuid": "176bc4b1-b93d-453c-8571-c4fcdb9be0fe", "comment": "Malware payload", "value": "231300f712505055d2611fe45bb607cf6c2e05c7948ad3de27054dd1b67bc93640407cf85dc440531609ee3e580ca7a8", "object_relation": "sha3-384", "Tag": [ { "name": "89-36-224-5", "colour": "#D03EE4", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "minirat", "colour": "#1F5B0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603716, "uuid": "32615d16-b67b-47df-9f13-9035f876c5cc", "value": "T121466A45BD2D6562D5C976781F6653943339EC088F82C3262628BB3DFEF23588B23761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603716, "uuid": "915202a1-2708-4cef-ad88-3f2bde5bd66f", "value": "49152:yUqZRvEFx7nIhqLg+Eo6+IFVXX/itd64AmqQ235EoqM:yUqZaFxLwqLg+2+IFxigmgEoqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775603716, "uuid": "1958063c-c39d-44f2-908f-72fabb678f90", "value": 5830370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775603716, "uuid": "fd3c0e19-1d9b-466a-9084-b4a6d2b9670c", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603716, "uuid": "420d9160-f5c6-43aa-96c7-987a0aa583ea", "value": "driver_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75bde4e-32d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775603750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603750, "uuid": "f2593d58-304a-4939-a29e-c8c933274a6c", "comment": "Malware payload", "value": "860ef29773cf680ed765cb08ac3072cb", "object_relation": "md5", "Tag": [ { "name": "89-36-224-5", "colour": "#D03EE4", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "minirat", "colour": "#1F5B0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603750, "uuid": "3c90c085-756a-4f8b-a706-d02ea3631d54", "comment": "Malware payload", "value": "0b028b781950641818800fee2b4bf68e4ef2bcee53fe71a21755275ba108783d", "object_relation": "sha256", "Tag": [ { "name": "89-36-224-5", "colour": "#D03EE4", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "minirat", "colour": "#1F5B0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603750, "uuid": "1a5a1ae3-641c-401c-9cdd-d0cdeb413c6d", "comment": "Malware payload", "value": "6ca184cb838a989220254ff1914313d774e65712", "object_relation": "sha1", "Tag": [ { "name": "89-36-224-5", "colour": "#D03EE4", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "minirat", "colour": "#1F5B0A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603750, "uuid": "80bf5409-70c8-47b0-9c3d-e9c088377177", "comment": "Malware payload", "value": "f896fbf10c376ca632cebb4b2c1b88f599c54c094648e7c9cad2b8b081e9a012507667a7a5c46db707b10f3317c8c502", "object_relation": "sha3-384", "Tag": [ { "name": "89-36-224-5", "colour": "#D03EE4", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "minirat", "colour": "#1F5B0A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603750, "uuid": "929c7bc6-9db9-4ab9-a4cf-9519a26c0e6f", "value": "T1CB564A57ECA145A9C1AED2318AA29253BB317C495F2123D32B50F7383F73BE069B9750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603750, "uuid": "cfee3a4e-bd60-4775-ab5e-a60c50193610", "value": "98304:hBjL6vNoEuahOqzTArIHwZBzR9ulaE4bBF:hRTEphOsdHcylHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775603750, "uuid": "92b12980-6517-4aac-a4fa-fb688e28f98c", "value": 6252240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775603750, "uuid": "f45a7d79-8f90-46e5-ba3c-9420f624c696", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603750, "uuid": "4fe60d20-4493-4754-89a8-599cf0913943", "value": "driver", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3a31b1-322f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775531634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775531634, "uuid": "e237d0ed-4943-4acd-820c-b7d8e7c053aa", "comment": "Malware payload", "value": "84fad5256a00a3a9717eca38df4d4066", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775531634, "uuid": "d5337975-6170-4e5b-85be-541d582cb5e7", "comment": "Malware payload", "value": "0b0e0d5883fea994e3017b816662df8b5d4c7d8cba2ea5fc7fe2d16baba599f4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775531634, "uuid": "f965cd7f-2236-4780-8343-b8c3ea2824a0", "comment": "Malware payload", "value": "0ddaffe35ced70a10de8b4d44b743e49bdd4a2c1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775531634, "uuid": "bbd33539-0bd1-4a74-bba8-f867e04d1f78", "comment": "Malware payload", "value": "e5b60a1511d3ccc1b0d989680601b3c2dd165c6ebb93b49d33aba4cfff4fc2a8754ab2e5ef5a0f3aed1aea6164c37fd6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775531634, "uuid": "349e4395-fb5e-408e-a36f-24015c2c17c9", "value": "T1CAD57E91274A8022ED5F02F0DD1DC77A69756FA03F62C4E762D4BFBB29B07827521B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775531634, "uuid": "798d4171-35cd-450d-9b28-6545fe77b1fe", "value": "49152:fe0zqYaZrf5jSTUial1JrMf+7UVZDEFem4vLNgmUESIEjPMN2lv+oBzYCMV3eVo0:WjSTBmq+T4veHjPMNaXYCMV39TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775531634, "uuid": "724451b6-1b05-4446-b6cb-4cfa09adccac", "value": 2910720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775531634, "uuid": "fbca9d78-4559-422e-bb7f-6823865ea476", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775531634, "uuid": "5e5927db-01dd-423f-b8ae-a8f9af805d0a", "value": "RuntimeInitializeOnLoads.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7aed663-3276-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775562062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562062, "uuid": "8b51dd10-43dc-4980-9b7e-07814c32c401", "comment": "Malware payload", "value": "df99daf6f1d3cb9354796a2dccbf3180", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562062, "uuid": "40901341-ae77-4ed6-9dce-e3f779c0f4b8", "comment": "Malware payload", "value": "0b7c1fae7ba3558f33fed8b080affb2f9030a7a871b673339dce55156146e2fa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562062, "uuid": "fef03e8a-f7ca-4199-9f45-761af43ea54e", "comment": "Malware payload", "value": "82c0d9f3fb424884817aa108a217741f735434b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562062, "uuid": "57d12f6f-342f-4380-8c29-9c6e3477748c", "comment": "Malware payload", "value": "5c1899d4644d8edeae11c45bae72169c9e3e0090b5fea44dfc82b552dbe3342ee36ed764196f4ecfba96d3e553c736f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562062, "uuid": "777919c8-3122-4389-9a86-f4eb1ee2eef6", "value": "T1CBD32B85BA43CAF7D54304F041BB673E8F31BC2A5837C5A5DB69BEA4DA131C1A21636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562062, "uuid": "b0149e27-d142-4183-92ee-dc7c2f490698", "value": "1536:jliqfKJh2kMj9aUbVXnAQnxgrghibF2FlRXWocsrfy2Q9iEF:jYqfKJh2kMjrRXnAQOrghUFH2f/Qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562062, "uuid": "13be4c7b-816e-424c-ab42-39d7667307b6", "value": 134780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562062, "uuid": "1cfd82d3-9b85-47c5-aa5f-69a907d5519c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562062, "uuid": "efb7a02a-0bf8-42a7-ba8e-230f39f5d7b7", "value": "nx686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30caa640-3285-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775568305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568305, "uuid": "e8608500-cdd2-4bde-82bb-05530f31b284", "comment": "Malware payload", "value": "511692eb82e320b3893f3529c27adda1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568305, "uuid": "b9a0765f-9db5-4333-9d37-073200c10b25", "comment": "Malware payload", "value": "0bcdf887e6bd21ea4073385a8b2e59025768be3131a92e9940886e05c748e1cc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568305, "uuid": "0334e660-bf05-4906-913b-499afc8d1c3d", "comment": "Malware payload", "value": "d686413abfff42cad3a4a5f518400af7c2139ac8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568305, "uuid": "56d17b4f-f910-44e8-b2ef-a48bae1ff683", "comment": "Malware payload", "value": "40e32cc082b8b1772c6e3fabe2df98c59ddb025899194e622ddf6745d1e09d06b833bef4b3153c2329ea5c7549793812", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568305, "uuid": "0ed3c7b2-8b51-4470-b05e-9772e4429100", "value": "T1171523538DCB4093FD77703252AE6B1458A34F6D488AFFB3159A4B612D570F222CB6A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568305, "uuid": "5eaed63d-4afa-4a46-8899-a6edfd31ec78", "value": "12288:vn2oukY09Jp70OS6xtOl2SDn4p3Qzmp3Qzxp3Qzcp3Qz7p3QzFultY6WUwD/A5rG:b7Y0VDSUwASrgZKP8NN0AxIrTnPvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775568305, "uuid": "2552d8ba-567f-4c17-b14c-03863646c5cd", "value": 902278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775568305, "uuid": "ed412d84-adf1-4df3-9e26-ebe3f27f4ee1", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568305, "uuid": "3f0e7ece-5f31-4793-8bad-c26dcaf74d2b", "value": "base (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4581c1-3274-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775561348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561348, "uuid": "9b8b7346-3ca6-478d-bd2e-122504f9938d", "comment": "Malware payload", "value": "50a8425c1352765dacedf5bea779a0a0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561348, "uuid": "d5cd1bd3-b124-4cd8-98c9-d42e6d8d805e", "comment": "Malware payload", "value": "0c2f8bcfed50f3962964d84ad5a40e0e9bdc3cafaad9f26d090cd04bf3027f63", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561348, "uuid": "45d02f7b-366e-4e85-a74f-440f68f75411", "comment": "Malware payload", "value": "50a067315f92264207d4215ab4d8b5771a228d8f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561348, "uuid": "a0e4ecbf-d7e0-45b0-a0cb-a670e4c1429e", "comment": "Malware payload", "value": "4a39b66ca3426ed159632bf1a89794f39944aab6ce68501501c39bf31d5fb59c24f54b3600b890c271ca123db752b95f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561348, "uuid": "4f3fd4fb-358a-4aff-9b36-f6fc2e6bd0fe", "value": "T13841EA919D94E1B06BA780386FAF22AE6116118B3F031D7CB49E2019E7FD9460376DB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561348, "uuid": "d3bde26f-0246-42a0-bf11-242b77ec05be", "value": "48:eNJnwNnWV1iE8z31oYId/IkKj4J1dUL8qit5bRM1cPP1qYXHb4:Cp0WVkoYCwzjUm8qit5bRecPP1qYX74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561348, "uuid": "d12955c5-aec7-484f-9d5d-aa874f6d1a8f", "value": 2023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561348, "uuid": "cb48eee7-3e78-41cd-b87a-b605cedcde23", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561348, "uuid": "c6144564-cf56-433d-aab0-804e3de5be8a", "value": "who.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b991a2-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554657, "uuid": "64d43a81-22be-41a2-bbe7-69b851f09b90", "comment": "Malware payload (Mirai)", "value": "345f695826ef0ef7533f38bb361b5335", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554657, "uuid": "b36f15b7-982b-4624-9751-f9139999cbfc", "comment": "Malware payload (Mirai)", "value": "0c393756c8713871b94d0cda58331cb449662b5325f2a612d86de514706e69b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554657, "uuid": "5e8d1d8c-a811-4894-a2d8-f1e67d2199af", "comment": "Malware payload (Mirai)", "value": "f45e412f81f3ee9a444e25dd36c1fcf9891f7400", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554657, "uuid": "8d0b9554-7530-4dc1-b2db-77b42d0c3959", "comment": "Malware payload (Mirai)", "value": "aede6d94bfae003be6b59af873c7b2616a080910a8cd699bf4f19ca6357186802b76ddd9c9e2a1084e74d0c6895a251d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554657, "uuid": "85231a81-8a63-4ca6-997c-667e0f6cf90e", "value": "T147832A97F400EDBDF80AD77B4453490AB270A3A105830F36A39BB963FD721A45967EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554657, "uuid": "0447ea70-71d2-4281-93ec-351198ee47c6", "value": "1536:quKG91m4/gWxYRyRqwwrzPQtav8FjWtFUo/V6OXZJ7/aNSOFmA7ExtX1dT:q5GTTxYRyRqwazPQta6Q9VXXz4FmA7ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554657, "uuid": "d3dc7919-129e-4aec-a657-8f2103113390", "value": 81652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554657, "uuid": "8d587f1b-c578-4331-9d8f-fd893b3d5b25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554657, "uuid": "85699ca9-d844-4108-949c-8d1d14a01fbf", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fddd38-327a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563724, "uuid": "8a0b5958-367c-4c15-8559-2883c74eecb7", "comment": "Malware payload", "value": "f81666689e5d8a5832efaaf7e5498db5", "object_relation": "md5", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563724, "uuid": "b11a27bf-5e84-4bcb-b44e-eebf6bf9423e", "comment": "Malware payload", "value": "0c58f0dcb4d8d3afc7f222fb7623068b8ef0fb2b9993cb7837ba5d4e6df578f0", "object_relation": "sha256", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563724, "uuid": "cca2612e-85d2-4391-93ed-fd6216b477c8", "comment": "Malware payload", "value": "90c41e02220f83fe7a5dde62ad15ccf57027395e", "object_relation": "sha1", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563724, "uuid": "7ef5d43b-e617-4627-a0dd-9cb9f5317593", "comment": "Malware payload", "value": "66ae6a379bafe81c23939ceacaa89b4a1a569a5b0a2df6f1c89625b0675fe8801475f5da933a2d7c50d1ca729895c127", "object_relation": "sha3-384", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563724, "uuid": "77b8fe96-a69d-43e5-b71c-a44f1479d0a1", "value": "T1DCB092AB021FCD0F3AC275B9246E9D0CC08282367D1A5630CB8D3893C21DB433260F10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563724, "uuid": "3a37894b-00f5-46c4-b706-1afc14d51406", "value": "3:HFdoXkLguhvWS+mlqLw3OAFJP+mlqLw3Ov:lyXXupTcLw33DcLw3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563724, "uuid": "4cfe8d95-4c4f-456e-a56d-7f28fd6ce5a5", "value": 118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563724, "uuid": "9c8d4e8e-6ce5-437a-ae3f-d79c6bcf29ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563724, "uuid": "b342487b-4b61-492b-bd8e-0cea721d4577", "value": "0c58f0dcb4d8d3afc7f222fb7623068b8ef0fb2b9993cb7837ba5d4e6df578f0.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7d056e-32a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775582553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582553, "uuid": "9a02feed-fc60-476a-a6d2-d759ba45f562", "comment": "Malware payload (Mirai)", "value": "33a6ba115b6928c7ebfdb31f3a75eb15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582553, "uuid": "759ec3c5-c8be-4510-9d55-6001789ab909", "comment": "Malware payload (Mirai)", "value": "0c72da0d7145513af26f37b08ccbacea87e67a2978e3929e85b077983d76d340", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582553, "uuid": "42e353e9-66bb-4940-ae4b-25cd9bd531d1", "comment": "Malware payload (Mirai)", "value": "67cd795c55cbe7c284f3997c117ae919a37bd9f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582553, "uuid": "3591e800-6fb1-43b2-b3d4-57f8d90b05e1", "comment": "Malware payload (Mirai)", "value": "fd1a08ad80db0674d4814fcab5c485b3f73f905ca2798158d65663185f7f8c9ef5269b1c2c575e5526a266aaea50d337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775582553, "uuid": "6922d25e-00a7-41cc-a0d7-d33619163615", "value": "T1FEA31946BD428B13C6D221F7BB9F4288371657B9D2EB3143D926AFA1274B4D70E3B610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775582553, "uuid": "f485d0b0-c012-4403-8286-d9f4d7194711", "value": "1536:ALB4gMHtnCRENhVJr2zRwtKrHZjRy6Giuq2rlqW8DpazVTOBwzRSmwi+rzmkv1UF:A40i9wbrzTUm1CBTAMD62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775582553, "uuid": "88db68a6-d14b-47e4-a716-d100dfcf9427", "value": 99484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775582553, "uuid": "35081b7d-d935-4c73-92cc-bae50d799585", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775582553, "uuid": "27aeaa04-0805-4d9c-8a42-66c67b620d4f", "value": "zyre.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f647b3-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554145, "uuid": "7e18b1a5-7640-40ba-8890-4eb8a3177e4b", "comment": "Malware payload (Mirai)", "value": "861d4296fc15f804516a447cd3ac9bfa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554145, "uuid": "81bf53ad-cbc6-427d-b862-d834a2c642c7", "comment": "Malware payload (Mirai)", "value": "0cad4176d8b1d09e277a6bf2a87bba41d5378954adc0480c6185d31a1032ae73", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554145, "uuid": "b9290517-3f0a-4b0c-8951-486ed3def8b7", "comment": "Malware payload (Mirai)", "value": "9620d14463bc7eb2676b51fa422b5f3d7871052b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554145, "uuid": "0b259c4d-7518-4eb3-8420-685904582896", "comment": "Malware payload (Mirai)", "value": "8d3d6776be74bfbc7e8c6b790259ba93eb69b28bc2da55c0da8255c9c951c67f7682690bd4c8f41062fa9bb56e83d577", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554145, "uuid": "716e774d-0f33-4934-881f-487c8cb83fbd", "value": "T1AF83199AF800DDBDF80FDAB74463490EB931E3910A931A377767BD53AC721A14826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554145, "uuid": "4ef82f48-8a9c-4a2a-837a-a86d45472e27", "value": "1536:4v7sC9KZbx5uW8eLoPSdAYA9lJPc89s8br0hpsBq1HHbqFiQpsrH7Ibn:4G5hLsd9lJP4npeqp+psrbIbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554145, "uuid": "413ca468-d002-46b9-8b12-b678db1af58b", "value": 84960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554145, "uuid": "9d371a3a-c143-4de8-bf04-7851314e6aab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554145, "uuid": "fbf8f191-9669-4cde-a5a1-064ec67fb255", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c452a54e-325e-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1775551802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551802, "uuid": "f52a647f-e579-4220-a47b-a9e68db5ceda", "comment": "Malware payload (VIPKeylogger)", "value": "17395dc05b082b366be9b9a0f3cbcb95", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551802, "uuid": "e258fcb1-834a-4bb9-8e47-feb097329c36", "comment": "Malware payload (VIPKeylogger)", "value": "0d9d0e74a6678a7c6cef0c6ea0dafabe3089cf4f3bfd54a8d95d32a96dce2bb6", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551802, "uuid": "33dc3ab2-b01f-4168-bd27-738fc52dcdd0", "comment": "Malware payload (VIPKeylogger)", "value": "1f0f40e797e261a84ad561b54445769ba40ab233", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551802, "uuid": "d96b4c99-76d1-436d-a2da-f1de0bc08af1", "comment": "Malware payload (VIPKeylogger)", "value": "af43505b61feaa45ed312a1a4b4b76a0bee3f52ebf02bd0241f6b16de7d3767bcfb3dccc0602547733686b500ad04a34", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551802, "uuid": "c167f50e-0a87-44da-908c-6fbd6bff4da9", "value": "T14CE2B6CA7BCAB4A5C35275F3195FA0A6B2AE9D80348C9050F6C4ECA87C2C71CD566D7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551802, "uuid": "8617b8ba-766c-4d81-acd5-62810c3fa626", "value": "768:lomtdRbnU4a6ynxIh+anP6L3i/uEgnbYncMcCGS:lfbn06ynxIEaP6L3i2EdnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775551802, "uuid": "ffabf9e1-60be-45a9-bde8-f65d71ebbc6c", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775551802, "uuid": "6bb2a637-f3c3-4e07-867c-09b2b72e1e0f", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551802, "uuid": "931207e4-bc67-4eb6-ace3-461f4ecbd999", "value": "INV237687289.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0626d677-32aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775584125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775584125, "uuid": "4a26b384-a6dd-423e-bd8b-81bb22812e6a", "comment": "Malware payload", "value": "41d051f817ceabc875b40f81752a4ace", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775584125, "uuid": "1ffbd7a0-bf8b-4494-9ad9-699f592dc5f3", "comment": "Malware payload", "value": "0d9ef0a4b2c224793c14d1e87692af970ffa63c3370211e982208045165a585c", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775584125, "uuid": "80d307ed-e21b-44c9-9ba1-48ae45ceba2f", "comment": "Malware payload", "value": "29f130ba9848e30ba996f5ddc3d956b82a7d98b5", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775584125, "uuid": "41c7e8ff-519f-4dc0-b64d-5585986b56c0", "comment": "Malware payload", "value": "92c336ceec1720466c8cd9106b216849e7c8d4405ec76724a77a1a33c84ffb1047807e7e2bd2f187975c88d4acf425ec", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775584125, "uuid": "fb5868f7-9e6a-4da3-9c59-e19b1bc60802", "value": "T165C02BD27007244CE62F0E35025F1450190F80DA0730BC80C28037359C41854A1FC3E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775584125, "uuid": "8d462ab0-6c7d-4113-9e23-61f08a645c6f", "value": "3:mKDDFARQvQbNLwXc7PIC7uC7B7dXdfBOzXbJJFISF68+bAlfVS:hmR3Sc7wCKCd7dXhBi98SFiAl9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775584125, "uuid": "92cb8c3d-8e59-416d-825c-34c80808b9e1", "value": 135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775584125, "uuid": "557bf960-fe33-43b0-a97c-7a8e549f5fdb", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775584125, "uuid": "3601f9c1-0087-428f-b8df-4283ce7db2eb", "value": "t.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b6edc8-322d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775530699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775530699, "uuid": "f0ab827a-4564-4150-a8c2-2380dc537b07", "comment": "Malware payload", "value": "a1fd37a372482fd8209c67c3598451d4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775530699, "uuid": "e59c775b-d7cf-4289-8d5c-03d4e241595f", "comment": "Malware payload", "value": "0decbca617ac3523a39a8582486c10cf98dca7731b3642c9cf0e02a1e33841ad", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775530699, "uuid": "932d9d75-5ae4-463c-9433-27c478cead7a", "comment": "Malware payload", "value": "654b3091274dffcb4eefe810040915b79062b8bd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775530699, "uuid": "c632f502-8c9a-4fa0-97a4-ee5f690f62be", "comment": "Malware payload", "value": "a631aeb53887b93db1e9bf2ba9ca44470c404cac94a016c8088a29fa9f6ecd485a76d5bf42f687f4c6361a1b5c3e40f3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775530699, "uuid": "59e21266-eb02-441d-ab73-be761b6437df", "value": "T1D5D58D32BA81C836E02F877059A8D67E45782EA4BB7388D713D4AD2B3DB45C14635F1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775530699, "uuid": "8563d0e6-84e9-493d-b243-dbbc5d318323", "value": "49152:a4PdMitMkqYaZrf5jSTUial/JrMf+7UVZDEFe34vLNgmUESIEjPMN2lv+oBtYKMs:RdMRjSTBsq+a4veHjPMNaJYKMV39qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775530699, "uuid": "e7b10fb8-43fb-4590-b845-793f3a8e74f1", "value": 2966016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775530699, "uuid": "41c6137b-4ef5-4d62-a4f2-0f38d6a93a90", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775530699, "uuid": "ea153324-e4d7-40c3-a0ec-9b4a20367d55", "value": "D3D12Core.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a26e1e-327c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775564503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564503, "uuid": "0708e154-3508-4eab-93bb-a158dfac46b5", "comment": "Malware payload (AgentTesla)", "value": "13522856238fe31d828b903a39fcf462", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564503, "uuid": "2e475fac-65ce-4f49-83e5-a612cd5d7709", "comment": "Malware payload (AgentTesla)", "value": "102aa3e8c18c183de62fc44b8af19d6775cfc5a00019913cb2e723002b171658", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564503, "uuid": "511e3270-0d1d-4b6e-95bc-b8100e398118", "comment": "Malware payload (AgentTesla)", "value": "34f5ff1ed178723b6034dea86e4b195aa44b2fe4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564503, "uuid": "70fa8ab6-4850-453e-a825-04d820629189", "comment": "Malware payload (AgentTesla)", "value": "96a1dfe7740304ceab3b3d004e7888838385ca79e36854ef922d2ee180716fc8e3f1e7a5a443ec44accb050a653d097a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564503, "uuid": "6b78857c-8255-4ed0-b3de-b22d657db42f", "value": "T139340F027F88E715E1A97E3782EF2C2453B2B4C71633C60BAF49AF5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564503, "uuid": "b794fc38-a875-4a03-bd13-4a19f5397fb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564503, "uuid": "f6393978-6aad-4b73-8154-18aab1388b11", "value": "3072:oZRayCK61EBuTEubUZ3THo9rG8KaG5jnTh4qkufzz:wayCK6WcFgsq8KaWTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775564503, "uuid": "5701aa12-c32a-4bea-ae23-f5d231fce6d2", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775564503, "uuid": "56206bd6-d142-4c64-968e-3599739195fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564503, "uuid": "4d73bd57-33be-4ffd-b767-eaef5c950d45", "value": "102aa3e8c18c183de62fc44b8af19d6775cfc5a00019913cb2e723002b171658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04d53e1-324c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775544065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544065, "uuid": "e9a7a4aa-65cc-49cd-8d05-85c71e180e2a", "comment": "Malware payload", "value": "4da824718dc0d9182bd6386efbd54a05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544065, "uuid": "f5f148e2-c45f-4761-a576-b6140d1ae082", "comment": "Malware payload", "value": "105e2253a5da432ec27d94bb1c787aaca5ed8416d7566484069ca5b6b08e5f4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544065, "uuid": "a3c96dca-4342-4bf9-86af-a8185d82847f", "comment": "Malware payload", "value": "08d93550657f99999d4d2d2e4307dcc46f7d253a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544065, "uuid": "6abbaa09-133d-4e41-84e0-1d7c97d73d45", "comment": "Malware payload", "value": "9afcc969df7b3f01b29765bbfc6ecdda60d95fdfe1ddb786fff169145167fea6d429bca9e99d19962fec9129bc6c00e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544065, "uuid": "b8c1bbcb-be5b-4f35-9b80-01648446e30f", "value": "T184266B83F1A791ECC06AC074935A7633FB32784947246AF797D48B202E65BD06F39B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544065, "uuid": "10884e8a-0a9f-4dc5-a773-09d13fa382aa", "value": "cfe3d01c52f9580d83697ae80bda9e73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544065, "uuid": "ec72c1b9-2ae8-4f02-8735-ca7c3beef6b6", "value": "49152:5XmSdk1Bc8IxkOXEl1bcLUdE4fz6RaVJHcN8TlFJ0zjFzE6FUl/ryDfmUNsxpgRq:ZetE4vZzCxFUl/6NFGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775544065, "uuid": "23d048aa-509b-454c-bd92-ae71d81bb542", "value": 4702208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775544065, "uuid": "9f11d0a6-bf89-4fbe-a894-772265a5c02e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544065, "uuid": "ee13b911-35c2-4194-adc1-fb7623ccb39d", "value": "clearpdf_v1.0.0-dr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561c9f33-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561925, "uuid": "5fdc274d-a82e-4e1d-8245-f487f15471c1", "comment": "Malware payload (Mirai)", "value": "f1b1f792766385651008b0f9c1965542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561925, "uuid": "6f92e5f9-deab-4c51-a3d4-7afc46e680c9", "comment": "Malware payload (Mirai)", "value": "11e30eb4bd88bbf8140636941de533220806468defab344d0fe580bf3fadba99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561925, "uuid": "e6b92c12-83dc-495f-9e26-59695fd19e10", "comment": "Malware payload (Mirai)", "value": "68c011ff426c1ff9c3c7b0cd98891e7a784334e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561925, "uuid": "22717a3d-44cd-4ab9-a2d9-7686fe2127d7", "comment": "Malware payload (Mirai)", "value": "aaf49ffdeaab24c8d47059ef747cc9b858eeb65cfe289369f539a0d0c3b3225428e4f02798760c6f1afdf50d460e662d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561925, "uuid": "45dc2359-eaa8-46d6-833b-bdc7635ceff6", "value": "T1B3846513D9158991E5944CF3226B3285B94B93BBC4EB32D3ED164EA1BF2141F42BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561925, "uuid": "02b55d09-9785-41a7-b98e-36c1c6682ca8", "value": "3072:7Ltg5dLmIMCqC64qSVG4Mudzo4YQIQ7SbTW+Uas4+joC/Fn5:ntg5dLtMC7qSVquxo4dx7Sm+LstjogF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561925, "uuid": "0c811036-36a5-4046-a622-cdc323e2a080", "value": 395392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561925, "uuid": "90a5a457-dee8-4dc8-b067-4cd0d3211a07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561925, "uuid": "97579148-4312-4c8c-b604-9a79f16c789d", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18526df-3234-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775533732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775533732, "uuid": "e9526dcb-ad99-4c5c-9fca-d881b7c23709", "comment": "Malware payload (Mirai)", "value": "67b1e0670d799211df5831ed5da72475", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775533732, "uuid": "34c3f5a8-5340-42b8-a7dc-f458cc661e55", "comment": "Malware payload (Mirai)", "value": "121977ee65404b3fa16e3a218fa4c5d5f07779a0ce0a72b051effed747b05a6f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775533732, "uuid": "a3a9ff4d-5910-4882-9d7b-0d2df3ff3e29", "comment": "Malware payload (Mirai)", "value": "fa988a5d0f1f4f2f95ca4712ef9f7076f1f53390", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775533732, "uuid": "4fd7d803-6a52-41bf-904a-a22d18a5b674", "comment": "Malware payload (Mirai)", "value": "e1bee6a4c166669b8bbda01b6aad977d008b18ae4eadbe89d8e504cacee2664bcbb579cb1fec2215f977e071aab59d97", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775533732, "uuid": "1b111aed-751b-4ae5-adbb-53e3aab85c5d", "value": "T13D011BCF11A13F71D20C8FECB66144505856E9F2F56336CAA94F047A4ED8748B718EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775533732, "uuid": "0ef040cf-1ae7-4923-95bb-ba870f2fc2aa", "value": "24:eEeE9UvNIxE/MEIKndiGk8FADZIMUO7sW7Oln:eEeE9fE0EIWdlkN9IDOgWil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775533732, "uuid": "163bbba8-5057-4459-89de-2bceb13425f6", "value": 813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775533732, "uuid": "8732c88e-9e4b-4f23-8909-20622598781e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775533732, "uuid": "66c75410-8260-4a1f-9856-b750827ee91d", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de8af22-3285-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775568408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568408, "uuid": "945bda09-bd0c-4907-afbb-dc237b0d7681", "comment": "Malware payload", "value": "4d79f169a1567c7ae88e11ba55aa7ba1", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568408, "uuid": "55d90647-ce28-48ec-bb2f-fc1d77c0a771", "comment": "Malware payload", "value": "12e88279a1be82a6627219dc806a9e2a2dfb3a5aaad55a5c10826977135b1ed9", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568408, "uuid": "9b5f5144-8c78-4008-b105-6d76ed32229d", "comment": "Malware payload", "value": "69dfd7a72aa4defb2fe8b727db8ed25ad2f63a95", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568408, "uuid": "88468178-58ca-4117-974c-b20a74b6bdc9", "comment": "Malware payload", "value": "9519e1178d8483306a08cb0ce2438b1099b0904ddf466e6ef6b770b5fc62613e47ce68011012a52a3d7bb6f30a37e514", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568408, "uuid": "da225fd1-d6c7-4ff4-89fd-990af21bc974", "value": "T1C5753A1BBCD008F6C0AA9332896665917BB1BC450F3127D72EA0B37C2F726E49D79758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568408, "uuid": "186d1bef-5353-4fac-b5cd-d8f7cc65b59d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568408, "uuid": "24d26152-7560-4092-a567-4dcf70815ff3", "value": "24576:bHNxzstCU8zws5nwZTg/RFv/QBele5zKD9/no13V0bLWjZun:bH/zsgUDsBcTH2A13Sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775568408, "uuid": "bcd2cb81-8685-45e4-8fef-c06d0475c092", "value": 1639936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775568408, "uuid": "a98a7439-29d0-42fd-b1f7-0456a9938676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568408, "uuid": "7615f988-8f41-42aa-ae68-aac2c4792b32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0af5a6-329d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775578555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578555, "uuid": "2d6aa130-cfc0-4f2d-87ac-dbb22ab704ce", "comment": "Malware payload", "value": "a28f5a15134084d4da831162544bcaa3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578555, "uuid": "95dd87f5-cfda-4bb4-98c7-cf8de3e69c04", "comment": "Malware payload", "value": "12ef6406d006d603423ad792bfbc6d885821f2104271c4364092c77fcfb225a4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578555, "uuid": "fe9eaede-e922-4426-b0d1-fc91376eb6f1", "comment": "Malware payload", "value": "cee91fb23453dd5c477ff345bf4cd6f1f95b5dfe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578555, "uuid": "efe0f48c-9197-41b2-916e-cca0d5a97fbd", "comment": "Malware payload", "value": "7e5c27e40bcd9a3d2ece8d0c4990020fa76bce50b67f17a7bd4a861dc6607640bfad0f61d6bbd43b4326ebabbae30ba2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578555, "uuid": "41198a29-6a83-4c79-8d4b-b0becc66e10f", "value": "T175136D6516953C25AE99883B5C7F2F0CB9A983E1304891DDBFCA3CF18C15A9CE318B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578555, "uuid": "276807a5-a1f0-447a-beee-39a211c700af", "value": "768:bUs9NyXsZztCd9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bBHusZXco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775578555, "uuid": "96b75041-1d63-4aa3-ad12-7870b0838b3e", "value": 45502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775578555, "uuid": "36a8780b-0f3a-435b-aa1f-07c909ff15ca", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578555, "uuid": "3456b6d2-1482-4a8d-87df-293adbfc6d1d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b83243a-329c-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775578121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578121, "uuid": "085aa94d-2fa9-4d19-82b7-8f3b9a53722b", "comment": "Malware payload (RustyStealer)", "value": "cadd1f46e64dbc9701b6fde2bbc9f33b", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578121, "uuid": "e9d78c2e-48c0-4a5d-8a39-cab35c38be62", "comment": "Malware payload (RustyStealer)", "value": "1339967c8919ed04d9643423765d641413ca5086ef6bcfa832db9ab4a4a2717a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578121, "uuid": "c533c198-acd4-4ff1-90b1-4398788d0b76", "comment": "Malware payload (RustyStealer)", "value": "aa6ea061f8f7d0bf2615da9024fbc570ea4cc7ea", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578121, "uuid": "038db5f5-33df-4cd7-8471-b99c25765081", "comment": "Malware payload (RustyStealer)", "value": "8b5e890b081c3732bb811872ff766084c07aeb6f7efddcf14b3f16d120d9c7a47533be9d6c1fb4f477a6010b8fbcc8d9", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578121, "uuid": "2e7a9e92-90be-41c1-b1cb-605b8cfa1e1d", "value": "T1F805121735A154FAE058C478C34185A75A7AB0C31F2266FF12A066343F6EAF71F3CA66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578121, "uuid": "420241cd-1382-497f-a16a-f07b1e44c02a", "value": "e81bf5d8be632e7285f925128b034568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578121, "uuid": "327f25e7-da79-40e2-81e8-f065a5af2afa", "value": "12288:psce8zBoQGAx8f8Quwq2ao1ylTeoLc1YEAcmY7LEYclQh1OL+AxF:psvQGBfD7qDoslTeOc1HiY7LE2h1OL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775578121, "uuid": "d720be5e-70d8-40ef-95f5-2f5b94bb21a6", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775578121, "uuid": "015dfc17-2a32-4546-9eb3-847c766d3e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578121, "uuid": "461bed39-52b8-4bcb-a4ba-4fabf643cc43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6eb38d-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554150, "uuid": "22b327cb-93b4-4e58-a08c-e6ede5c77257", "comment": "Malware payload (Mirai)", "value": "b7e3c3d3419ade030c2ec1239f946a34", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554150, "uuid": "997a5806-e4d1-4eb8-80b3-0298dae77f75", "comment": "Malware payload (Mirai)", "value": "13b5f79c838723c4287f749f898783c3975708c7ea11bb2095b996894abafe28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554150, "uuid": "c361de86-ac1d-4b1e-879a-4389df3caa99", "comment": "Malware payload (Mirai)", "value": "1a145c00cbfe71ce73dff48d49a86de6664d9e8d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554150, "uuid": "7f6e3a86-75e9-472a-a849-9a3973dfd4a2", "comment": "Malware payload (Mirai)", "value": "7cfe30ab2ef8c0ddcf286cc41df19e5820a46e5d408f5892816644c4fde6e01ab35deff7fb771380c09342e1d791f372", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554150, "uuid": "8e66202e-ded3-4621-9a5c-565c3e982033", "value": "T17703E149E490705BC90F1C3F238A11AA1E90F1D6715A777BA364CC89BB37D0B94CD8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554150, "uuid": "6c0d69b1-858c-4d84-ba13-c1ea34c5eae1", "value": "768:tF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu0OAP0ZfWh:zl5JnsrXvrKy9QjyBZLvDmR0O00Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554150, "uuid": "44a29d7d-fd16-4ce7-8995-f82ff1774108", "value": 38640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554150, "uuid": "f28150fc-87d6-457f-b9f0-0ea39834363d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554150, "uuid": "0bcb2409-669f-493c-98af-108bca81d3ff", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa88bc4-3219-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775522204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775522204, "uuid": "938b01ed-4531-478a-9154-a84026495bb4", "comment": "Malware payload (Mirai)", "value": "d1fd618e4ed430a09e879bf4294315fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775522204, "uuid": "44a04aad-f5ef-484e-b608-c06bcb2cac1a", "comment": "Malware payload (Mirai)", "value": "14ebf52dbb1c7b5e8f104d9b49d9eed05f91be40cf42d04f9c42cb5e1ff987cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775522204, "uuid": "b91f45fb-d926-476d-9e71-51a4e462b3bb", "comment": "Malware payload (Mirai)", "value": "3ef41308ff2f7a7f7f5f9bffeaf7022711492361", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775522204, "uuid": "f91b0d6b-bf9a-47e2-8bc3-81ae8dd46f7a", "comment": "Malware payload (Mirai)", "value": "4349e5b6b6f0760fd41d30abe685c997f02be2d6659389dbacf112b92049059bb697a1455d4f9e7f3ed49b6c0ffb2902", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775522204, "uuid": "12ac9de1-c003-4407-9a5d-129de7605c63", "value": "T153E34B56EB418B13C0D62779BA9F424533239B6493EB33069928BFF43F8679E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775522204, "uuid": "16dde40b-ac50-44b8-9091-535ec7766b61", "value": "3072:J5C8MLkzh64UNFsa9ruZnbTV5rTO+eJObipuJM/9PEInSKCZ:J5C8Mwzh6xsa9ruZnbJ5Ukbip8M/9PnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775522204, "uuid": "2c22879d-3e1a-450c-8694-4558e164e4b7", "value": 153660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775522204, "uuid": "a7278743-54ce-49c0-a85b-0de63c6b790a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775522204, "uuid": "1d544a4e-eebe-436e-bd96-b9bf8df1865e", "value": "kkk.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97715847-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775562035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562035, "uuid": "cc84f216-8c95-4895-ae4a-700df8623adc", "comment": "Malware payload (Mirai)", "value": "7f091c42a019651e108318ff61e7c712", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562035, "uuid": "f6e7c692-3f0f-495b-baf5-514be569cb6a", "comment": "Malware payload (Mirai)", "value": "17846244c538f7d917efd2d0d326a4a2cec42d9423bc0edb846d252be9f7ab3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562035, "uuid": "0f8460a9-cfa2-46ec-b207-8c2e4ca070f0", "comment": "Malware payload (Mirai)", "value": "40b28ddff559142bf6d99469465cac497638a61f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562035, "uuid": "bb93353f-f258-4c9b-8dd0-63bcadeeb2da", "comment": "Malware payload (Mirai)", "value": "5461557058ffc4bbe95f83b1679ef81d694a74a5a6e058013c2661ab773327d813da1d4902af112aa55dff7675b34870", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562035, "uuid": "67f45b93-ff13-4d5e-91b4-d8156b999082", "value": "T1D5848813D9154492E1255CF2227733C5A94B87BB88E632D3ED5B4991FF3182B42BEEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562035, "uuid": "6136c259-5632-4b60-9fbf-3a6492b985b6", "value": "1536:XUK+CXz5EXS3yxhnMTi2LywJ6sMKvTJLz+K+YmvAvg+giT96eETqybrQjHejTstt:XUtuz58Dxgi2N0K9LzbPvV+joC+QcPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562035, "uuid": "ee24032c-28a9-4bac-a6b4-0a7708f2bdf7", "value": 379124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562035, "uuid": "f370c10f-d258-4445-add8-154d0e9f575a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562035, "uuid": "a8298b00-feb3-4815-9b86-6a66b6c43d3e", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdd429d-3279-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563445, "uuid": "2e9ab01f-dbc8-4648-86d6-91715b630a39", "comment": "Malware payload", "value": "4f1773a1228e2c009cbcf61e9e550e01", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563445, "uuid": "d2b5b370-389d-4026-8fb4-ed385cdf97d8", "comment": "Malware payload", "value": "17aae57cf6255c7eb169bf62ea67376d9708976eb7831f8cdd0ea38bdcb37dc4", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563445, "uuid": "5ce121c4-6091-4d7a-8bb4-1fb5bcb2a2ed", "comment": "Malware payload", "value": "2aa47fb23074e8ae776a369f9e28d1a2f6e70739", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563445, "uuid": "1bac9088-1607-4449-973c-8c0e77eef3c4", "comment": "Malware payload", "value": "f53a2eabc67768f4b9ac7091e5464347829463f7ca43389207d6a3be8d2c6601feabcfaa29fac01b54acc9a94d679f72", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563445, "uuid": "40a2d808-e7dd-40c2-9dc0-3ba22d2e08ba", "value": "T1E8621A8595685043DE9A6CB042ECEB877C3D73C31B0169A72BA8F4043D937E9E73926D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563445, "uuid": "6f6fb42b-e42d-469c-8491-5ee3790a5f98", "value": "8f807f5d16a7d2b173533a187d77dfcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563445, "uuid": "b36e2610-cd8b-45f0-8fe1-e59fd8ce41ad", "value": "192:PqMVhPghXDEwXEhYCPzWYHnsTX01k9z3AkFH8W0u:PqMVKyh3LWYMTR9zhFTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563445, "uuid": "3b0c11cf-4b89-4ceb-9255-4b5a22b810dd", "value": 14528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563445, "uuid": "4b9f4fb5-5b44-446b-aa31-ffe9d08ff96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563445, "uuid": "8648a11c-0886-41bc-a042-f119fa7b2128", "value": "Core64.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a662e614-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775562060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562060, "uuid": "8012296b-f063-44a8-9032-3d09287ebea6", "comment": "Malware payload (Mirai)", "value": "90c2f4c64c3e537a8373f67c82093346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562060, "uuid": "20dc0048-2d22-4df4-86b4-873fcfce28a1", "comment": "Malware payload (Mirai)", "value": "17e7fb5b52d285b904017ac569bd7f70530483c1e26818f624cb370fe4340524", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562060, "uuid": "f1356d45-4372-4d0d-95eb-3948b0b18445", "comment": "Malware payload (Mirai)", "value": "126957ffb8e7f31466e8fa3f8c97a657bb3a5000", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562060, "uuid": "585c4f09-d0dc-45df-b37b-8457285a3bfc", "comment": "Malware payload (Mirai)", "value": "cf3f225d4f0e2a0124fe3b26f2a2c39914e8536c84713c3887a6ce20b25fe3efdf816001f26e1ff9ce5742c687d1aa20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562060, "uuid": "eb38ec6b-02ce-4d0e-b2b4-99e14fc4ab01", "value": "T105847613D9118991E5A44CF2262B3245B94797BFC4EB32D3ED164EA1BF2182F42BEDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562060, "uuid": "46ab1e9f-5747-41c4-8a93-183fba2f70bb", "value": "3072:cSYte4lmf8GO21DYgmffXpfwvczDEAavebXBqTmtB6GbZ+joC4y:FYteGjO1Eg4XFkcn5agATmP6Gbojovy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562060, "uuid": "1728c13b-81c1-4f4b-9859-3bc38b0cea8d", "value": 404732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562060, "uuid": "ffd51029-9d07-438f-911e-4c2ed5bf9e91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562060, "uuid": "e6889146-1273-4583-a3cf-ac65b05b1986", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebeeb65-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553001, "uuid": "b52c1857-6059-48ea-b7ae-64ff34481a94", "comment": "Malware payload (Mirai)", "value": "08990ad865fd6efe0a7aa62583edc106", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553001, "uuid": "3490bbf6-b798-4bfd-a4d2-a334e2ca308e", "comment": "Malware payload (Mirai)", "value": "180cea8e57ffdc6779966afca0d61f658923c2509d8fc2d8f7e1cc7093bc3091", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553001, "uuid": "798fd42d-4f01-48d0-acb0-a4c81871062d", "comment": "Malware payload (Mirai)", "value": "d084f7dabf7e67d0b707738382cfd9e6882add98", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553001, "uuid": "5013977d-648c-4b40-a7bc-67f434ca7e18", "comment": "Malware payload (Mirai)", "value": "e736ed2980144ee9d923ebd9ce28c99d5bd8acad767496e62852a07c503f9c612c5d696d6ba7423bf3bf4e0e7a798801", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553001, "uuid": "12fcd870-9765-4de4-b0a2-f4c56bcb0572", "value": "T1DAB3AEDBB70B5191D8618AF14BC74BED3E2332119E67C8E76C0E2539497A1CF4A0A7D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553001, "uuid": "50d606b6-36c0-4621-84e7-27835bbeb4ac", "value": "1536:k2G87Mp/L2U6gJsYWeNqTpuFqdAKW1bmJide0g1/LWG:jG87Mp/L2U3jW+qs4dADbmJide0g1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553001, "uuid": "d8c3c37d-44f2-40e5-be60-b398ecee0abc", "value": 107628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553001, "uuid": "989fe943-db33-4e51-b0a0-c6252d1515b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553001, "uuid": "effcc4b9-2266-49c3-8bbc-be87e8090cd3", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6069c45-322b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775529847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775529847, "uuid": "6afab747-0d80-4d1f-9884-42065d8dfbd8", "comment": "Malware payload", "value": "d817eaaed40fd24985e4aaacabf5fe09", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775529847, "uuid": "11368a3e-ecd2-4447-8c91-06927ae8da60", "comment": "Malware payload", "value": "1858b9d82008be3acdec6d8410c33006c36454089a4f0e3f3e3c44a560af4b1d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775529847, "uuid": "4cc170a3-b2b8-4fcb-8f12-a16d94720eca", "comment": "Malware payload", "value": "82b3506fc003cb689f4ba1fadd0fba236788128a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775529847, "uuid": "2a6957c9-2cbb-4836-88cf-f83282c5e155", "comment": "Malware payload", "value": "11565736f38f26732be7e558f562337269145d9e1008ac1188b4ab18e99516263e6274a7e9a196630de07f7f6b724ad5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775529847, "uuid": "cb4d1add-368d-44c2-a6ad-ea68ad15cf77", "value": "T1FCD5172C31858026C06FC7715B29DB6947796E70276344E7A3CB7E7B2ABC5D14F32A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775529847, "uuid": "f2f7323e-a82e-4b54-9f19-d744b424d243", "value": "49152:XNBixMOqYaZrf5jSTUial/JrMf+7UVZDEFey4vLNgmUESIEjPMN2lv+oBsYrMV3L:+cjSTBcq+H4veHjPMNaAYrMV393Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775529847, "uuid": "c76700ca-04da-4b80-a9ae-d512ebc32ffb", "value": 2966528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775529847, "uuid": "b217f910-833f-4bd4-a425-a94647ea4e4d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775529847, "uuid": "42fbedb2-5bc4-4f74-bf6a-5983b53cd04f", "value": "app.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dcbba3-3256-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775548429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775548429, "uuid": "73847613-4f88-468f-9fee-480385e2b099", "comment": "Malware payload (Formbook)", "value": "f2b79f615cc4de94ed0a1a3003f0b3e0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775548429, "uuid": "3c68b02f-3682-4bd2-ab23-c6896c1dcbb7", "comment": "Malware payload (Formbook)", "value": "18f9f0b849d120f1bf78a3c82f0946692f876c040a25383eeecf726b3d0e7038", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775548429, "uuid": "bb8e329d-4458-4089-9d01-fbf8a5ef5bbc", "comment": "Malware payload (Formbook)", "value": "274f56dbc974ad5bfdd5c0b1a8f9eedc2a9b5dad", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775548429, "uuid": "7a214e86-7848-486b-a011-4fcee4d5014a", "comment": "Malware payload (Formbook)", "value": "58f7550658d5e589030fc8d9c04e4e7d1a42a1275cefe9e44b6b725cf8bf85695ac85c022f6ba936364d15963d2bb4dd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775548429, "uuid": "c6b09320-ca8f-4f3f-b757-ea8a9643d709", "value": "T13295025149C43FB9CFAC6A1D40BE160FE3E05A8A601A7549FB73FD47BFAB604421B198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775548429, "uuid": "b7e1139d-6b1b-4fb3-8b9f-e018d9bf4d1d", "value": "24576:8fimQU0My/UHDQAEcLKz6aqxR5b4M/SaJm2jDbDvdYGdVA23tH6BOplg:EhVHDDxMh6/4Kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775548429, "uuid": "1f73acfc-83bb-49da-9a26-3662c19016e5", "value": 1965663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775548429, "uuid": "8ad1718c-3041-483c-b36f-afd932138677", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775548429, "uuid": "3e9098d2-07d7-484b-9b61-9ce7577c8794", "value": "PO No. 4500425000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0714014e-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539888, "uuid": "a49d6910-e938-4700-92b2-68a4a335a202", "comment": "Malware payload (Mirai)", "value": "9eb2786ef007470f629f359c7888d71d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539888, "uuid": "08ff4bcc-eed3-4edd-bbaf-9a6740666d41", "comment": "Malware payload (Mirai)", "value": "19f33c08065cad6e4ad86e518c391d1d9469c623d30a9bbd5f39269c7983ff79", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539888, "uuid": "45c525d2-f103-4b75-90fc-ec44dc402be3", "comment": "Malware payload (Mirai)", "value": "f13944145d4327254dd1dc0207092741d8753b2b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539888, "uuid": "6ea2a9ba-0af8-4574-a93a-37be3b80444b", "comment": "Malware payload (Mirai)", "value": "3eaf2c7e2b0d0b126a67e5ad9b6c47234aab7559603715358f83f79359e5f24b939e2c93869373a2b2e6771c4597bbc2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539888, "uuid": "e93cb56e-ba02-4529-a39d-a51382d0d826", "value": "T1046163D631834AB26CB99F23736D49153143E0A628DF7F15D9ED28E884ECF55F144B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539888, "uuid": "11ebcfb9-f7d8-4cba-b945-939233e18c93", "value": "24:It3shO9Tys/DgnJYLN1LVWNIAksJ53uL03zpY:i8hO5D/DgJATLmJJ53uL2FY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539888, "uuid": "d641d01d-3e4c-411d-a103-8e1cead71fe2", "value": 3254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539888, "uuid": "3556a3ce-2d49-485a-a2ef-1cb8e4410af9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539888, "uuid": "696cc384-ab5e-4b49-bf5f-2b3bc3af64f4", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fe691c-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553117, "uuid": "c85c1925-c958-4dc7-a317-36ec5cf1f9ec", "comment": "Malware payload (Mirai)", "value": "cf26cdde16864b7efc6da1faec5e803d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553117, "uuid": "3adf4fc9-7d2a-481a-a9b9-bd6c46f8b2f6", "comment": "Malware payload (Mirai)", "value": "1a0c841790c1d83aa12dfc118bff9c2fe7c64f16f6171d255498046459ad1e59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553117, "uuid": "0f37b1a0-5faa-411d-9e96-734d07fa8987", "comment": "Malware payload (Mirai)", "value": "77ac3f2e345963a2ddb4417da4911f938dabf767", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553117, "uuid": "e908e1b5-eb0e-4e7c-bd5b-1dc2ee5d9017", "comment": "Malware payload (Mirai)", "value": "9b04833d704a8110ab66059342a27804b14b658bf38a8fac4abec7499516fd6fc422094a6ab8bd0a47071b89193ac36c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553117, "uuid": "19a6bbb7-7cee-4f74-9239-a40e5cff7dca", "value": "T1D0C34B46EB818B03C4D51776BAAF42493323E765E3DB330689186FB43F8679E4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553117, "uuid": "8c71b29c-ff1b-4b5f-ad1e-2621006ca124", "value": "3072:MZyQtgAgsIsirczK8mVtitGyidpLguLp0WLI0M/9ODh:MZEAgs/irczK8vtGyidpMuaWL7M/9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553117, "uuid": "5844591e-347e-4919-9cdd-27ad2c232ebd", "value": 125893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553117, "uuid": "675891b3-a1f2-46f4-be82-3bf0c93e53aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553117, "uuid": "ce165090-920c-4532-84e7-a833d3f94021", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27182da-325d-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775551450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551450, "uuid": "f8cc0b3c-a6ee-421c-978f-ec3926f8a1b1", "comment": "Malware payload (a310Logger)", "value": "faed95bd93af6c43feb7fa0b155b709b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551450, "uuid": "a269f709-bf72-429a-acc9-bbaf35f51a26", "comment": "Malware payload (a310Logger)", "value": "1b41bddd7bbed57b395306ace1d4e0154dd1a82f2b6bae3e0a70f8cccc7b7db4", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551450, "uuid": "e97f00f1-81f2-484c-8cdd-2dc74213392f", "comment": "Malware payload (a310Logger)", "value": "3051741082a84ee4840be71a8e76ce0562d29890", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551450, "uuid": "f634fa75-5cb3-4055-8a3c-17dcff2f8751", "comment": "Malware payload (a310Logger)", "value": "2556ed1f8140c9f0a919d1071a650f360d987026c1b3f64168efae588e999c98e8420602daf4b122d9b6e059eb026465", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551450, "uuid": "e7b30e90-767d-4dac-844f-8b2df527d82c", "value": "T162451265BB69CC02E8E503355AA1E63403796CDDE901C31B8EFCFDFBB4A96057928253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551450, "uuid": "549e6057-cb0b-4d33-a55e-ba48e670cd2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551450, "uuid": "318fa0ee-f6c0-4a77-b36e-da6dd22ce6e6", "value": "24576:2YYDJGqHK25tFM6DEbeFV9E2bYvSUPrsIQAU5G8/wMH87c8+v9:2YYDIqqSFM6DEiu2bYvHgJAU5lIMc7qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775551450, "uuid": "da81640e-c780-40e2-a399-281e9e3a0408", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775551450, "uuid": "f5bcdef3-c946-4732-a3ce-c7667dbf7b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551450, "uuid": "78133149-61b5-46f7-8097-f7d18a371e9e", "value": "T. HALK BANKASI A.S,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e5fabd-327a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563799, "uuid": "64395dc2-9b76-4ae7-8b57-617a97638c19", "comment": "Malware payload", "value": "3e7d6bf602316f3e7f457453cba533d6", "object_relation": "md5", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563799, "uuid": "382d3c28-9523-4432-8aaf-345e0e3dcf35", "comment": "Malware payload", "value": "1bee536276947038094983ea1d402e90e38f8f652731771ac1c7645caf46b9e4", "object_relation": "sha256", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563799, "uuid": "c77a9d68-8a8d-4a5f-b504-e91b553b76c7", "comment": "Malware payload", "value": "2256500f3bb756c56b80402067882eddb5918cbd", "object_relation": "sha1", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563799, "uuid": "55da2452-62bc-4333-b2b9-ceb5fe4f5baf", "comment": "Malware payload", "value": "e2bdf7971b8c1d339021d26c94d24f6c811e5b2889f7897eeed60cd8de98d9646e47e2e7bcc29afe5b98231ad0f5469e", "object_relation": "sha3-384", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563799, "uuid": "a0a9087a-f30e-48f1-98db-264f71bced48", "value": "T18A137C6429957C5AA984953A5C3E2F0CBAA9C3E1310940CCBFCB3CF19D56A9CD72872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563799, "uuid": "167e1be3-331f-451f-944a-5eba573f3608", "value": "768:bq22sr0a1ldg9GKYpZUpiUU0S2fkR4nnGb429GKYpZUpiUU0S2fkR4np:bqSh8vcf42vco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563799, "uuid": "ade0d2f5-42f5-4e40-aee0-18272983215a", "value": 43129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563799, "uuid": "a9423fd8-838f-4042-b3fe-70b2c905aca1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563799, "uuid": "21218f79-8702-498c-9e5f-9f1b978c5eca", "value": "1bee536276947038094983ea1d402e90e38f8f652731771ac1c7645caf46b9e4.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fce4043-325e-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775551714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551714, "uuid": "6cd8be5f-eb3b-41e8-9ff5-fcf2cfe7f896", "comment": "Malware payload (ACRStealer)", "value": "5a166f98323c2a279eef8856bcced74e", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551714, "uuid": "2eca93f2-1897-4de9-84a6-95c1ecfc89e8", "comment": "Malware payload (ACRStealer)", "value": "1c2296192762ef4a2e4e6fa51eb6f931669fa52e8c83d28eef76ef9a5f11750e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551714, "uuid": "1c4883a3-a82e-42c4-8af7-9f525895d4ca", "comment": "Malware payload (ACRStealer)", "value": "c7525543293ce166884f1c4deb4c1c4040ae2531", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551714, "uuid": "15028623-746f-41bd-8176-d25485e9bf13", "comment": "Malware payload (ACRStealer)", "value": "03ac9c8021ddf119bf80da43c5b572823b98e75d9ad2c46716b405bbf5264cef67ffe884be6efb5f2410b71670d44a3d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551714, "uuid": "ded0048c-0015-4c61-a3db-db321ea09153", "value": "T154064B0BFCBD8CA9C499A2348433A147BE7578405B3173D72AE0B2682E77BF09975B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551714, "uuid": "da88aaca-423a-4582-b6bb-b38d4d3fcac9", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551714, "uuid": "f56de3e9-a5f4-4265-8733-19ad2569afdb", "value": "49152:KgRZuE4hpe1Wp87o9rg0pVbep5tv7j8qQcX42H:KwJdenVbwnvOBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775551714, "uuid": "3d872c0e-73ed-449d-bcf1-71ccc0b26e3f", "value": 3748416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775551714, "uuid": "082f6ae1-90e6-4e66-a8c4-87f8c2ac5f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551714, "uuid": "dada8520-fae9-465d-aaa6-c7c0fb8cabd3", "value": "SecuriteInfo.com.Program.Unwanted.5384.29289.5368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a32cc5-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539914, "uuid": "f69396a6-0b0b-49ba-9b77-52b39522cc82", "comment": "Malware payload (Mirai)", "value": "169e01ebbeff465cb14b17da93fdf17c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539914, "uuid": "cfe567c6-543e-4e68-8b27-18ddfe1bf1ab", "comment": "Malware payload (Mirai)", "value": "1d010867caf1dc4bc143eaa71365aaa831eb87367c9e9f83d4f424a430c42c1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539914, "uuid": "c858fe9f-fd6c-4604-bdee-87d81ba8e460", "comment": "Malware payload (Mirai)", "value": "3dc56d4f8a41e0ca75bd3e1c21fdba5391a6e392", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539914, "uuid": "d0599758-2232-4276-906e-cfe909a2ffae", "comment": "Malware payload (Mirai)", "value": "94b8faf87ea1e05842e42a927c5e832a7d982eb342294887b82287d40e3d90ce9c1ca0508d081b7c05052ccf0da955dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539914, "uuid": "5e08c8ff-42f1-47b6-ace5-139353e20390", "value": "T1C5A32A46FC814A21C5D512BEFA1E318E331357B8E2DE73229E149F3173866AB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539914, "uuid": "3616985d-50a4-4822-a5f9-93337fb9e1c7", "value": "1536:AAnky0uOMdiA/5JHa9yiqppkGBEdQxmQ3k7/axrlOXzD4RidpSxfVwv7fh5GYWMq:gxL+ppkYU+k7/axMpSxfVgbhULMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539914, "uuid": "5ba8d2a2-6a39-4b34-aa3d-bf0d514361e9", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539914, "uuid": "efe5d32d-88cf-4573-8ec1-194f5d822e2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539914, "uuid": "dd856ddd-c6aa-415e-bcd7-b49dcf08c5f1", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa73ebad-3269-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775556483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556483, "uuid": "89037a93-b139-4805-8e54-3ac7c2b193d5", "comment": "Malware payload", "value": "6d4591bb8aafbb48b2324558c21d28f5", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556483, "uuid": "88d082c7-03a5-4a61-ad00-9838b20f58ae", "comment": "Malware payload", "value": "1d8c5f5ce86e175ee8d55c981c33a303291d4c1f9c0cf8136d5ef9c401f73ffb", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556483, "uuid": "348508b4-4fda-4fe1-9ea5-24bd56ba34ac", "comment": "Malware payload", "value": "1c2fca1936c62ccf8ae8ed59aefe11691f93b484", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556483, "uuid": "81acd52a-a6d1-49bc-bd7e-6bedd172738e", "comment": "Malware payload", "value": "da16d006e87eee9aaa10ce16f893fe5243ee12c701d0a19658d3b0d498adbf7dafa899aa4272541010e5430aebda27e4", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556483, "uuid": "d16046b4-d69d-4996-8ea4-0c83362e03a7", "value": "T12404BF984E9A88B0971F6425051F6D1BCB8DD263121DCED0FBDE9F463F129A071BEAD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556483, "uuid": "e671c5e5-4d4f-4228-a447-600613c7bd1f", "value": "768:UwsNAIcUPRCyBcbG9KSaNDKcKMD8pB6z0VfrubFr395jjub6J6S6I6b6v6w6Axem:jZIrB/9Lkbp8BszEaspZZ62oCd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775556483, "uuid": "25a4a1e8-f487-45be-b44f-75667e562fdb", "value": 176604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775556483, "uuid": "0012ad6a-991d-4017-b5dc-2078c56904c2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556483, "uuid": "db116c5d-cc2d-4aa7-ac2c-97b19a06f384", "value": "Nova_Dataset_Tokyo_5033.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19f7c64-324c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775544040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544040, "uuid": "6e9626ef-77dc-4d9c-af80-7198aff0752b", "comment": "Malware payload", "value": "cb5f649d169d67a2490e8d5f87b06288", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "studiogioeli-it", "colour": "#3B13C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544040, "uuid": "dacd62fd-ea03-4577-ba02-3ff69447ffba", "comment": "Malware payload", "value": "1f8b89a8b474f70c08dbfcb27284e5d434d9490d903386b5f6d4b23c8a4cd4d8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "studiogioeli-it", "colour": "#3B13C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544040, "uuid": "8f183bd2-575c-4b21-8dce-66f6fb890ebf", "comment": "Malware payload", "value": "24954f8a906352895f09c596e9da6b039b6d1aab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "studiogioeli-it", "colour": "#3B13C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544040, "uuid": "97b999c3-359f-405e-9da8-7aac926b9a4a", "comment": "Malware payload", "value": "06203b625145b97a2f0e256d1b1b25b626858105f325b425d6d63babff36b23378dc4626b39738a7ecb247b7b93d038f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "studiogioeli-it", "colour": "#3B13C2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544040, "uuid": "fd9d17dc-4dd3-4ca1-8a2d-79fbf4796222", "value": "T19935D231F3A316E342046263A585B2A6EE2FFE633A4700BC21B1D5DF6125DED9870767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544040, "uuid": "8f0d963d-54a2-4334-8ef0-488da214689a", "value": "192:5RLbebKKr8/3EcbBwlGJ8iE8MYhwcaFqbtgcsiawPhTWjOdEyE/dEB3i9V8eEUr3:5DtGPIARipsyNvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775544040, "uuid": "0a4cf371-ef95-4afa-92c7-4a23c348cec4", "value": 1088100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775544040, "uuid": "a8de5b92-7dc6-4aa8-9812-47b2d1221f96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544040, "uuid": "d057c047-2785-4a11-b967-5b50c6073065", "value": "1f8b89a8b474f70c08dbfcb27284e5d434d9490d903386b5f6d4b23c8a4cd4d8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9802677b-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553016, "uuid": "c4e0e5d6-3235-454f-8a93-aee4217a3d38", "comment": "Malware payload (Mirai)", "value": "146ddfec3e83ef06b5e7c82c33202355", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553016, "uuid": "d47726bf-71c3-4576-87af-56aa91dd2e75", "comment": "Malware payload (Mirai)", "value": "1f990826615dde2397554929c3ce9ee3ef736b0152fc03d8a298336fa28b27c4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553016, "uuid": "22997d43-3e53-4489-89ff-c35f4c3e3ddd", "comment": "Malware payload (Mirai)", "value": "467801dcbfe8608faf72f1fda96360b94a280614", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553016, "uuid": "ca1f2d29-618e-4ca6-b207-93619f8b4194", "comment": "Malware payload (Mirai)", "value": "f26b01748526a182ab5613531b3ddd4b0951753a7c77ac7f7cb594ac16039aecccb2e9b16457d65ef8f2670acdc81df8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553016, "uuid": "eeea8a25-d6ca-411f-8c78-2faf90b4f3b9", "value": "T1CB238DA7C43C6DD4D14982B8BD244A3C5B23E016A6933EF6B64785628047EECFA1D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553016, "uuid": "eca7dfc8-fd12-4bd7-ab3e-b617d57ead4d", "value": "768:f/eptstaT85n1Oya5wtg10sKmqRrKBXXG0QJqF5Uu7narjC+oCZ21Cu1E:f/6s+Yha5wtg5WKWq5UQaHCG21Cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553016, "uuid": "fef9fc49-6742-42a4-b724-5336fc3cec04", "value": 47560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553016, "uuid": "6ff47d33-e013-463a-a72e-9139c9bbc0bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553016, "uuid": "df07018a-48c9-47d7-8aef-9a0b19c1d52c", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8786168e-3297-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775576182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775576182, "uuid": "edae053e-cc41-4c44-9213-2983c83fe438", "comment": "Malware payload", "value": "630ccb31a5483e7bbbee7528e5795373", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775576182, "uuid": "c7a5a7e4-fffd-45d4-bf6b-f5da10ed761a", "comment": "Malware payload", "value": "1fc1bb9c6f7df68a84d402b2d2be5a08d9244d9b32a05e6a8c91a851030761b7", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775576182, "uuid": "01ccdee7-952d-4c2d-a1d0-0868b66edf85", "comment": "Malware payload", "value": "45abe0448da58acb95ae5249678754e3431569fe", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775576182, "uuid": "1b8b5e49-f97b-42c2-8c34-140f028106ed", "comment": "Malware payload", "value": "2b34b57e3d290cece9f05f070a1c2ca6a15043878726cb7e0ec74364b6943035df88f7bb7aff5806d57ca364c24fffa9", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775576182, "uuid": "f66962f9-7283-4322-9171-16ff91c71671", "value": "T12D450192797B68E8D3BAC03894972A39FB603461537C92AF129403960FE67F35D3C356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775576182, "uuid": "ac220b1a-4e97-43c1-bb1a-6c377b32f454", "value": "3027408cd58248b0e40eaddb2a0ea753", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775576182, "uuid": "bd61092b-be34-480a-a9a7-baaa35704ae0", "value": "12288:hexUN+XWfvSZw/R0INJDaIStZhaK3rW8xqDLQAORwQo6nfa+cxliF:hewyZw/R0INhIZcw5x8WHo6nffM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775576182, "uuid": "989637ae-90c9-4ead-b3e5-0794321def74", "value": 1209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775576182, "uuid": "7772a393-c3ea-44ba-a0df-6f198b8c6d14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775576182, "uuid": "36de9a56-231e-46ce-a734-5e9a0cebce28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7042c024-323c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775537058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537058, "uuid": "64fde4ef-e7cd-46ab-bdd6-4def386cebdb", "comment": "Malware payload (Mirai)", "value": "75c3dba74a3769c12166623b510421a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537058, "uuid": "2e873cdc-d408-406d-9eb2-9084f6713fd4", "comment": "Malware payload (Mirai)", "value": "1fcd2ba33df1f7d312877ccc38b3874e5b0af1a04531b73bc8657cfa85c0a4a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537058, "uuid": "32943e04-c440-45c6-8d3c-3ac3ad78e540", "comment": "Malware payload (Mirai)", "value": "18629ae572ef2cabdd671186e1d2415b08ee712c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537058, "uuid": "380b9995-7b35-4205-8b05-d286e88265b6", "comment": "Malware payload (Mirai)", "value": "50442cbd673c0bd4b67b2e549b61f00d8b7a885222ac099b2b5c51d8b783de95cef38a583bac7be7fe63334a4c16e6c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537058, "uuid": "a4ca3275-83c5-4d6c-94b2-6281bd7dcab5", "value": "T11BA32A86B9818B02C4C211B6FE6F554D33136FF8D3EF72129D24AF6463868E7097B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537058, "uuid": "e10b222c-7bb4-4257-87b4-b52c92ad43b7", "value": "1536:eZnLlwl06uWuTrzZ9uTwHBAtqVIK2FmSioGjIfMmSO6WCG9YwRYW0E64jg76X7gG:burTXoP8DiXn6jXZadmv8qCJuyXpQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775537058, "uuid": "d397f3b1-6e5f-4e80-ad6e-2ac13308a2e0", "value": 98992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775537058, "uuid": "7dfb69c4-2bd4-4b85-9aef-e7dcb755a5bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537058, "uuid": "1b165ca0-2d5b-406e-abe4-49ab8673d56c", "value": "zyre.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b030cbc-321f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775524621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775524621, "uuid": "25078644-bcad-4921-a5a6-24ad6a8e11c6", "comment": "Malware payload", "value": "a045cb4a481d52b05e890ffadbda9dbd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775524621, "uuid": "4da3ba35-1d3d-4ac3-b09f-45fb82a1ddd8", "comment": "Malware payload", "value": "1fd7675e3bc001c6f6373c87a90fa381b0c2834fca40bce4382dab2da64ac72b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775524621, "uuid": "52a63324-b39a-4e55-b3ad-8ae4035d7b54", "comment": "Malware payload", "value": "33031203d7541f73b6ede798ad3499bf8a7f2cb4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775524621, "uuid": "2ee1b1d9-b915-4e21-994b-94dde85063c5", "comment": "Malware payload", "value": "87dde2b74d69821189bd8d0e46e73af14e5bd42614147332b0082eb3bb7e26bee4f19e53e0fa5c68bc5d692b6dea9985", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775524621, "uuid": "2184524f-94ef-4b2f-a9e3-a9e5661838ca", "value": "T138D528D2B14182EBCD1F0733261E972A46396E72372347E72FC43ADA0971F91B675A21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775524621, "uuid": "b625cd63-da63-4859-9ec8-a24a8ef43253", "value": "49152:PQ2CxqYaZrf5jSTUialSJrMf+7UVZDEFe14vLNgmUESIEjPMN2lv+oBjYIMV3eVM:XXjSTB5q+s4veHjPMNanYIMV39gAXLZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775524621, "uuid": "80bafea4-0d19-4fd7-aeab-91c8f4d0804d", "value": 2927616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775524621, "uuid": "67381aab-07b5-4348-b847-42c6780a1259", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775524621, "uuid": "1b24b80a-52bd-454b-9a02-461308dda7f3", "value": "RuntimeInitializeOnLoads.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60708726-3241-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539179, "uuid": "a7ce5d84-2a5c-4997-b4dd-a0189a3169e6", "comment": "Malware payload (Mirai)", "value": "df1c57f4045af269f4f08b784334e2bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539179, "uuid": "0cca1d79-eafa-4ed7-bea1-05f75b5fd179", "comment": "Malware payload (Mirai)", "value": "20b0994b30925347b54112beb92d761f0d55c8b69bee7a71db6d9ad493e0ef49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539179, "uuid": "f22c929e-945e-477f-9e40-acb0132b7fb0", "comment": "Malware payload (Mirai)", "value": "974d5113d8d7b44b2b69274ec284f6cc21c1ccd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539179, "uuid": "bac91a87-3006-4061-bae6-aec62312d524", "comment": "Malware payload (Mirai)", "value": "d823bf1c94706723cc062a47f100617509913f5148de4b24cafbebbb938a0b8adc5a900f759b015d524fe9c369bb6c52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539179, "uuid": "573c5161-148a-4e34-9b64-b206d5a74c3b", "value": "T15B732A81FE57CAFBD81794B441F6763F9A31ED2A0431D6A9EF617FA1CA235C02206358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539179, "uuid": "214da004-18d0-4add-bc7b-d9398c06f363", "value": "1536:f6qxyW5RaQ11o2/WpCbA6ti6AboW1fDg:NyW5RaQ11oxAbAv6ooWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539179, "uuid": "ebc53ea3-d7c2-4b71-b917-ada7fccae30f", "value": 73984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539179, "uuid": "5f896a80-5097-405a-afb0-4d0f99142c79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539179, "uuid": "9f29697f-5cc1-465c-a19c-59ee3a861fbb", "value": "zyre.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf0e5c2-324b-11f1-a769-42010a9c0008", "comment": "Malware payload (For)", "timestamp": 1775543735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543735, "uuid": "d6b2f9ad-b467-4744-b9e4-e9367f62a783", "comment": "Malware payload (For)", "value": "7d71329aaadefce193a6b60d4e96f135", "object_relation": "md5", "Tag": [ { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-maxbotfinance-ru", "colour": "#3BD072", "exportable": true, "hide_tag": false }, { "name": "www-xg66s-sbs", "colour": "#423F2D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543735, "uuid": "11c3918d-2a67-4092-97ed-3dc7b7d1dc28", "comment": "Malware payload (For)", "value": "20fb4b323624fa19c8178969f7ab24594ac28a3d560d831688e4616458789ecd", "object_relation": "sha256", "Tag": [ { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-maxbotfinance-ru", "colour": "#3BD072", "exportable": true, "hide_tag": false }, { "name": "www-xg66s-sbs", "colour": "#423F2D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543735, "uuid": "2a28fb6e-5b44-4d0d-b8e3-d11ba7433aea", "comment": "Malware payload (For)", "value": "362cc70b06a32c024f6017878d2f9c8180df03c2", "object_relation": "sha1", "Tag": [ { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-maxbotfinance-ru", "colour": "#3BD072", "exportable": true, "hide_tag": false }, { "name": "www-xg66s-sbs", "colour": "#423F2D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543735, "uuid": "8213a2d0-0194-406a-9a8e-ca5fa1b1cef3", "comment": "Malware payload (For)", "value": "d30125c98a9da3ec11c9d389e5f51318307f54d9ef11ce49407defd416ffb4c89d462ecc931284ffb803aee16d36a973", "object_relation": "sha3-384", "Tag": [ { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-maxbotfinance-ru", "colour": "#3BD072", "exportable": true, "hide_tag": false }, { "name": "www-xg66s-sbs", "colour": "#423F2D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543735, "uuid": "46064e8e-8c1d-43c4-b856-1b6fbd23d844", "value": "T1536533281EE92E7F876DD37579BF2EA307F11FC7480DC9AE52A406C206D85A2060FD65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543735, "uuid": "6ddc9790-bf8d-45f0-ae1a-6023faac3107", "value": "24576:9+VlRCGvX1RVw2DN/UXps3LYzW7vOzlM8nTF/fKzFPLfXj1Pf2sej/m:9+VlRN/y2hcZKY/fezhPf2b/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775543735, "uuid": "1b7b065d-4d80-417f-b3c4-354f17aa322d", "value": 1438092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775543735, "uuid": "16aa0657-2018-46d9-a8f0-1fa8e0963e59", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543735, "uuid": "21de0fc0-06b1-4e98-924d-50d157ddb129", "value": "ps_EKLpwcSFCVpB_1775543575053.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1a5f99-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553162, "uuid": "c19fc211-96e9-4b33-b78b-147814de260c", "comment": "Malware payload (Mirai)", "value": "9fcce7f1fb78e065d74b47af8dc3938c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553162, "uuid": "389526ca-94a2-41cf-a36e-fcf44df1a9ce", "comment": "Malware payload (Mirai)", "value": "21752bce021cb34d5a82750c19ce1554278bd3ea57c4da69260feb372ec75b42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553162, "uuid": "8926205d-2a60-4c90-97fb-8b1b664515b4", "comment": "Malware payload (Mirai)", "value": "567312d167ad3f71e4dcec2cc750e48e52b72f9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553162, "uuid": "f8e1b21d-32b7-4353-8002-57c39a1a45d7", "comment": "Malware payload (Mirai)", "value": "93a0b1f3651042603ae50b81527c70933e32b4f23439a2eba6ba58dad883d15edb032de89ece092d083e68ec78aae401", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553162, "uuid": "6dba7199-8ca5-44c4-ae87-8508bc4eb522", "value": "T1DF63954E6E719FBCFBAC863447B75F209248339626E1C684E15CEA011E7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553162, "uuid": "f3acd85b-b788-407b-afb6-8d3a331d43b7", "value": "1536:u8aCKglaDrIjtb3stmjpYpt13bUObB7O81UQ+eG:9H+0Jb3vypttUAB7O81RHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553162, "uuid": "78e802cc-b0f6-46f6-86eb-e18d056ba234", "value": 68256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553162, "uuid": "e922e806-3e0a-45bc-91ca-90074b22cf7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553162, "uuid": "3ce0e9f2-928b-4202-b6d0-9ef569641f6d", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a67ec4-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553111, "uuid": "b015ea5a-14a8-4582-bda5-0b83051c8dad", "comment": "Malware payload (Mirai)", "value": "4675ec26137b782861ccc746e7ab1d02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553111, "uuid": "194d9dd5-79ee-43c6-a7ae-f974ccff0eca", "comment": "Malware payload (Mirai)", "value": "21d5cfebf93f1af7ee1b464b3e959b336994eaec02bfd4ac86678f6234738436", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553111, "uuid": "bf201016-e7e4-44a4-9395-9912cd2f28ce", "comment": "Malware payload (Mirai)", "value": "557ac051be6d481b43fc54b19b15bd6a0e1be1af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553111, "uuid": "d4117d45-ff15-4775-9fa5-d7d29e0a60af", "comment": "Malware payload (Mirai)", "value": "3c26d5c31d56c010b1eb3605690e99dcd7d4683192360902f10d5b41a0b9a42f6c8a112031adad317c10a17b9e02e97d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553111, "uuid": "24885e8d-1e12-4276-bf92-e6e89b81f04a", "value": "T1EF230752BCD28A56CAE02376FA7E02CD331163A9D1DF7267CD105B10368991F4D77B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553111, "uuid": "9622f7f5-fc18-4c29-a08f-2454c22bf1c0", "value": "768:9bfPA1RUGzxhmlgTgDqEVd4YrLOPsiNiepK0eRAw1V+6ogLMQ/BNoE9w:hHAnF3mmTgzLO/NppK0eRpP+gZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553111, "uuid": "ce3e7692-cc12-4191-96da-98c175cb3e19", "value": 46320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553111, "uuid": "a578e182-0f14-40fe-9e4c-2ba34304972a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553111, "uuid": "61cf02bf-ad02-40ab-bb34-7cc880883a26", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f45961-326e-11f1-a769-42010a9c0008", "comment": "Malware payload (N-able)", "timestamp": 1775558494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558494, "uuid": "4e577295-6525-4072-9166-b1a9275dbfb0", "comment": "Malware payload (N-able)", "value": "185cadbd537c1ee20bb231bcb973b44b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558494, "uuid": "b35747d5-b349-45d8-a1bb-3d729294069e", "comment": "Malware payload (N-able)", "value": "2209a4f4092873a8bbd34f9165e8d05adcfe5d0a2ae3ee0c3308459bf355e420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558494, "uuid": "dce6108a-003b-4685-b0f0-81f5b43b46f9", "comment": "Malware payload (N-able)", "value": "33be0561723549be6d9f80baa52e9210c24e8558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558494, "uuid": "a6f9b8dc-6cbd-4e9d-a896-7788a273b52c", "comment": "Malware payload (N-able)", "value": "967a66fb315bcff57752551d2dd3399df2f0f8823e4fc66be03870fb6ab3da36eeef355564a42e1157bbb119d04b7ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558494, "uuid": "8dbb15e5-6958-4e58-9f05-9e6f1164ea14", "value": "T17EE633527D88DBBFD4212770C6429B77529BBA744810186B6F0C1CB66FB28CDE528F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558494, "uuid": "c71208f2-f5ac-433c-a8fd-f5cd3900f8c4", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558494, "uuid": "de88860b-79e7-4856-a3c6-b48fb8100bfe", "value": "393216:YbF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1B:arRxvoC/7a0jUxX7h1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775558494, "uuid": "41a055ec-8d6a-4b0e-86d8-44529a9f3f6d", "value": 14782032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775558494, "uuid": "ffe844ee-7d7e-4066-a43d-a710e8e2be2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558494, "uuid": "2061846b-9f5d-4aec-af62-f81daf3a35ca", "value": "onedrive.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8d75df-3281-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775566773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775566773, "uuid": "5c117ccb-d4d4-42c5-a0b9-ce7d74bb657d", "comment": "Malware payload", "value": "456f8f667d2c6a74df8ce37955ddc48f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "alzap-ddns-com-br", "colour": "#DA8A78", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "magina-online", "colour": "#4E21B1", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775566773, "uuid": "2ec63b11-41e8-4a7e-9e10-eabe71cc112c", "comment": "Malware payload", "value": "2261c2a0b9ca14f1f68d83e8bc3f660a681a385b1932945fa826f0be89d39939", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "alzap-ddns-com-br", "colour": "#DA8A78", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "magina-online", "colour": "#4E21B1", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775566773, "uuid": "75540be5-99c5-4db2-aee9-dd7908fee0af", "comment": "Malware payload", "value": "1760a1cf8ce9beccd9dff241391a0e454178d03b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "alzap-ddns-com-br", "colour": "#DA8A78", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "magina-online", "colour": "#4E21B1", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775566773, "uuid": "a81cfab8-eac8-48de-9c1c-79958b78d96d", "comment": "Malware payload", "value": "ce0e9d18131d5f2343327a9164b7e3280574d0da6d88f0401183c7f50ca625e28369f16e38fb8f87c6042415296569b3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "alzap-ddns-com-br", "colour": "#DA8A78", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "magina-online", "colour": "#4E21B1", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775566773, "uuid": "6fb9751c-ff52-482f-977c-ca2386d1f3e0", "value": "T13632C07A88C83E7116995F2E827B039BC0521E314550E8D73173AA4E6F35BA293129EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775566773, "uuid": "d2296ae0-3a62-4957-8c81-0fcf377fb75b", "value": "192:Sv6azGNAUx2zGT47XTb/9C/HsU8FjLwsRLR8gXY2k7KgaOS/SJ09xm5/SbYLT:S5SNAJXv/n9tL7Lk7KgaOStiabaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775566773, "uuid": "6e14a0ac-36ac-4270-9cfd-e089b06916f0", "value": 11161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775566773, "uuid": "26013333-1c0a-4a9a-a680-aa8e33c0c639", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775566773, "uuid": "e791b692-7032-43b6-a9d9-660f208be49b", "value": "4c05a4f514bbc7f84b397abfe571c9c34505b0d142a0e8e13a981c8ffb194857.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85c1b72-3237-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775535139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775535139, "uuid": "aa69b5a3-390e-4813-896f-9659d18f71f6", "comment": "Malware payload", "value": "2594a81500ab4bc40bf7ce8c95b6cb39", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775535139, "uuid": "85bd74f0-4254-43af-bbd6-f13f31564442", "comment": "Malware payload", "value": "22bf2ddd776724d8d8e3f5e61e824f4283e26b1bee60bd41d4a4ee4359d5f4a0", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775535139, "uuid": "543513ef-b494-48c0-ad1c-4110f524ac54", "comment": "Malware payload", "value": "2b47ed8de4f0219cd9ce7dbf7d7b591d6781b2b4", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775535139, "uuid": "a61904ec-5a29-4e20-b21b-fff0603c58f1", "comment": "Malware payload", "value": "0b5c1aec35b91b467ac0455d0d0b791a7f46a434c2571fa09e37e4506ea6a54432166e0a4f13b740560d2e1074127008", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775535139, "uuid": "fdc3a2f7-57f2-47c8-9cf9-dc3a936c28f8", "value": "T15304AD8F4ACEC4EC872FA418022E5D53CA4E9167061DC680BAEEBF757F16DA0756D4E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775535139, "uuid": "dc71dba6-c3ab-40eb-8102-4348df6ade31", "value": "1536:sM71XwPEouLLMyQai8lcGHGUCP/nf3G53o:sM+EouL4yQaE3Glo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775535139, "uuid": "714a90d2-9dcf-4c30-981e-6b54c495f070", "value": 177851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775535139, "uuid": "0da6e860-7cb5-4014-9ca1-fb197fb3dcb7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775535139, "uuid": "21989a44-67f7-4d26-8ee6-63ef9a35799c", "value": "Europe_Release_Monthly_10.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff198854-3242-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539875, "uuid": "b616a7a8-b8b7-49da-bf88-9cec6dc69cd8", "comment": "Malware payload (Mirai)", "value": "61981de1eb49fdefcd8073b5e684264e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539875, "uuid": "1c4c05e2-7e68-49d0-b7e8-88fb0f27068e", "comment": "Malware payload (Mirai)", "value": "23281be23caaca8a875aa064623e8c17dcaa0599e3f57a80e54a73b664ad322e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539875, "uuid": "bbc81f53-2423-4fd8-ac5e-a3aa656609a2", "comment": "Malware payload (Mirai)", "value": "6fdbfd49d3776eb627d4f53f92e0673f76226a1f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539875, "uuid": "421ce77d-82db-428c-ae89-aeb56a4642bc", "comment": "Malware payload (Mirai)", "value": "7a134c78cc3fa79ad49c013c23c6a9adea7921cd7e001211c3a314a3f325ec148410dacfce31a275157cc8501f610737", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539875, "uuid": "8c0a79af-baef-4e79-9bcb-fa7b3633c588", "value": "T13A13F140DF6C8920CFB60FB4931659162765BBF8ADF1BE88D14007CEA27C3661B95CAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539875, "uuid": "bc991419-7263-48ba-913e-686bf3eadcf3", "value": "768:BG9/UbcEBvb8Nni+IolIwECOzzWKNbwJ4I7sVe3gqC3xZ1bUG:BW/UdFEmold3OOSEmz0gqaLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539875, "uuid": "a10387fc-d9df-4b0b-a843-eabcc03a0d25", "value": 44452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539875, "uuid": "33f882cb-b316-49e3-bda6-10ce6c91b9bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539875, "uuid": "849e6a4e-6e3d-43af-b452-3281cab25faf", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ac2a15-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554143, "uuid": "83a98fbf-7873-4c6c-802f-d79f2cb940ab", "comment": "Malware payload (Mirai)", "value": "801b91e85f1ee2e92ed7e83465ffb876", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554143, "uuid": "a94a063c-9ae4-46e1-9cb4-22fa8f0ed91e", "comment": "Malware payload (Mirai)", "value": "23dff6a3f5b2f5500f3c005edb55768e75226cf378fe1073ce0b8b5a32c76bd7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554143, "uuid": "1c258e1b-41ea-40cb-a361-b842ea7f7b75", "comment": "Malware payload (Mirai)", "value": "cbd970615da9ff67c9b7ff3fa053c59f7ffa57d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554143, "uuid": "4a9b27ae-4c83-4380-b42f-1ace5e7eb603", "comment": "Malware payload (Mirai)", "value": "02c5b5a3aafa4e5a3cfa9c3d73ca23da959f2120f7034d784b7a9771d82b3b7ee00ad7b4ddac0faaa6d9284ea2c61b39", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554143, "uuid": "cfd3412a-8af3-4187-bb69-4e7ff36be8ca", "value": "T12CB3AEEBF64715A2C85243F013C79F8E3E232290AE57E4E76D1E167B19760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554143, "uuid": "873ed9fa-6dfd-44b5-bfad-6227aa212091", "value": "1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgDb/LWW:8YSZ3e8ZE3MYlphDgDbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554143, "uuid": "a7956397-d6a9-477b-befc-dfbb7faba27e", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554143, "uuid": "755870d1-0423-4181-8fa8-9e19285df4f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554143, "uuid": "773b47b2-80fb-451a-9642-3e0e9a70a132", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcee0be3-3242-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539871, "uuid": "9ba182d8-8c46-4806-b4fd-270e99373592", "comment": "Malware payload (Mirai)", "value": "098d02f91bd9e6b66f03be540bccce39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539871, "uuid": "a6e3c6e8-7d86-4276-9e53-a9ce9432c355", "comment": "Malware payload (Mirai)", "value": "245e01086d02c587005e16c0445aec64a3b6d679f36592b7f0ca2c04c1e6dcf1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539871, "uuid": "5c0d072d-8621-407c-8d63-3c72581878b0", "comment": "Malware payload (Mirai)", "value": "7fd88c8f548b8dd7de51c24f14883c5d67539ad2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539871, "uuid": "83adad4e-7036-4d7a-9957-224274b4a8d3", "comment": "Malware payload (Mirai)", "value": "33a69c534f9f0a9125c82bdc362ddbd994e1506ba2ac788c107b51b7010ec2ac7dc79cfff6e9e6fde0ae64ffca371b71", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539871, "uuid": "c674d80e-9e3e-40a0-9648-4431db0b8942", "value": "T1093302C666411984E088AFBA7662DECF33D845796DB30B1E08430D562A980FD37539BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539871, "uuid": "881f6c1a-fcc7-4ba3-a5a3-9bd6f751f722", "value": "1536:4vTIV8pnYZjiPBaZLaADxzWyiVTYPe1cZE9nDD:U8VldiPBaZtzxiV8GcZE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539871, "uuid": "81f565a4-9189-41dc-bd97-40933fb5320e", "value": 50312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539871, "uuid": "b16ab0b4-bab2-4303-9f94-14e39e2f43f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539871, "uuid": "a3af5689-aa5c-431d-bb18-a84efcb59811", "value": "windy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de510a9f-324e-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775544974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544974, "uuid": "1f2f9e73-1971-4dc7-acb8-576e17c32071", "comment": "Malware payload (NetSupport)", "value": "35186be97e1b3959de8e9bec3cfe2827", "object_relation": "md5", "Tag": [ { "name": "107-189-19-35", "colour": "#81DC5B", "exportable": true, "hide_tag": false }, { "name": "167-148-195-179", "colour": "#872435", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544974, "uuid": "d4ca99cf-669f-442b-8b7b-08d75eeb89d6", "comment": "Malware payload (NetSupport)", "value": "246e1980420b9a54c457961b99c6f768fc6608a6fca2e38f95dd25d189027320", "object_relation": "sha256", "Tag": [ { "name": "107-189-19-35", "colour": "#81DC5B", "exportable": true, "hide_tag": false }, { "name": "167-148-195-179", "colour": "#872435", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544974, "uuid": "50b53664-f71b-470a-ba3a-541279eda86e", "comment": "Malware payload (NetSupport)", "value": "933fd5e9673d62aa1b8dbba9b0ccbb6e1cbdad8c", "object_relation": "sha1", "Tag": [ { "name": "107-189-19-35", "colour": "#81DC5B", "exportable": true, "hide_tag": false }, { "name": "167-148-195-179", "colour": "#872435", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544974, "uuid": "bdd41813-7e6b-4f7b-843c-56137f78daef", "comment": "Malware payload (NetSupport)", "value": "074d1b5c811f85264bed0d11ec6b96864f3f465c8886f1cf858fa86eb85e95d1bc00b686e27501a555b6a3b4c0eaa439", "object_relation": "sha3-384", "Tag": [ { "name": "107-189-19-35", "colour": "#81DC5B", "exportable": true, "hide_tag": false }, { "name": "167-148-195-179", "colour": "#872435", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544974, "uuid": "cdccb005-b78a-4902-be06-9fd5b40b0026", "value": "T133565BCB339BB671C41CA5777D99519A3451DBBA338207690CFC5BBC08AFA4E4A0D60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544974, "uuid": "53e804e0-4754-4b4c-9de0-1e6b9dffddd7", "value": "c9b8e75da4a253dea13666baeb93ef5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544974, "uuid": "1ca779d8-96c7-4030-9e51-12bd83059741", "value": "98304:wmuSXhG74uaeT1YwEr+xLt7j7jUdzxcmrTRZ5mZTkrJGtnwhqRSLXwwwwBmB4B4U:ZHcae/s+xLtn/U9xcgR6ZTkWmXwwwwBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775544974, "uuid": "e4e6bd88-e72e-43d4-87f0-28e3567cf64b", "value": 5910374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775544974, "uuid": "b77cba7f-74ed-47e9-bbf9-b6f5087855a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544974, "uuid": "41c65c2d-dd44-4155-9fa7-a7ec40778214", "value": "RateConfirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f53f21-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775553008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553008, "uuid": "037a2792-a839-4928-a571-44584a2541ad", "comment": "Malware payload (NetSupport)", "value": "6a56339622ee45908956f78ef98476c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553008, "uuid": "8844a871-c820-4c65-bea6-704389a7be95", "comment": "Malware payload (NetSupport)", "value": "252756d856eda174d3a18c0210a1861476ce7bf286472b91940914e0a6f506f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553008, "uuid": "6eb44acb-f6af-4f58-97ea-6a9b9122b8ed", "comment": "Malware payload (NetSupport)", "value": "1d8ffcb6e76c2f4518d3002191960c0f68762ddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553008, "uuid": "d9dc8e71-6819-40b7-b4ab-d5d13a0c1b12", "comment": "Malware payload (NetSupport)", "value": "bfaa0a8bf800b2e325e259ee1e61177e8b4812cdc6c527bad599fe3821d0e3ec7255e83d1475eb53312ef478aa1018f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553008, "uuid": "3a81e87e-4b4b-4260-9ba9-412453d89d84", "value": "T100F6DF21B68ACC2AD5AD01B85E6C9F5AC23CAD221B6140D772FD7F5E16764C23336B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553008, "uuid": "685a9537-6a14-408f-a2a1-718773266889", "value": "4b200e917ee33d8e56206c360a98a2d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553008, "uuid": "38ed8d62-b84c-444b-91e8-0c7dd308795d", "value": "393216:npI55gii2t3OF6yuoq1swi1HEeumm+6L4nzFnEeTRLIOolWafVCt3Cs+I:pI55gii2OF6yuoq2wPn4zBr8Oo8SK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553008, "uuid": "82158a64-dc28-46f4-92c5-f2f81b6d9b1d", "value": 16610907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553008, "uuid": "9ac97381-791c-4b29-bd3b-8ab4203f916f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553008, "uuid": "fe4c6ea8-dcca-40dd-b2b5-198bae0e1795", "value": "Your Application.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196b9188-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539919, "uuid": "b3c3101d-990d-455d-9450-7f041d318316", "comment": "Malware payload (Mirai)", "value": "aa130ca6b619e599748b48bcf8c704ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539919, "uuid": "159a1a17-160a-4eeb-94c3-8f8b0a664692", "comment": "Malware payload (Mirai)", "value": "25b85a4f146f8cfdf4fff68c73a161856a0517732c7758b8602e803edf9a94b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539919, "uuid": "6ed48804-7bab-481f-8e18-26d4c4f7c0f8", "comment": "Malware payload (Mirai)", "value": "2d0849280ca2fd258d14311697297678361f327b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539919, "uuid": "ecad7d01-70e2-4bf8-9597-eee7b1466555", "comment": "Malware payload (Mirai)", "value": "e940a2996aecad0fabd5712918daed79fd6655121bcebcb5186bfcd746cb7b9e98d9b80964abffa103f7b714f4849c07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539919, "uuid": "eeceb5f4-7b2d-4360-85eb-1e191594781d", "value": "T1A0832947B981D0FEC459D03887BF7637C923B47E1239B29A67D4AE262D09EE01F19742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539919, "uuid": "e13ee278-0f8b-4458-b62e-07e7e794170b", "value": "1536:cTHF5amJjfczdAqI+zKRqakCkj6Rv3U8GbdGrAyvT9ol:cTHJFczdAqNKJkCdRvAbdGrXT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539919, "uuid": "712a8e7e-96fa-47db-a21e-9d155bc5eeb7", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539919, "uuid": "2099ca82-38ea-46ec-ba4b-3cd6c3407840", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539919, "uuid": "7a790899-a76d-470c-9d90-7a4adff7fa8f", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab4b418-3248-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1775542418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775542418, "uuid": "424940ed-48fe-4ace-ae0d-cbf760d5218a", "comment": "Malware payload (GuLoader)", "value": "c06069df9b66a7c4a6c7b12709e3643b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775542418, "uuid": "137643e4-17d8-4867-b8ee-7fcc824f1847", "comment": "Malware payload (GuLoader)", "value": "27fb2ade95bfa9d06cec93fd30f293e02d3311cce4d5e31b6bb93e5d5976e723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775542418, "uuid": "215fd836-8a58-4b0d-b456-c7acf129639d", "comment": "Malware payload (GuLoader)", "value": "e2df88016c4927387d8ff31114c0234648fc1d19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775542418, "uuid": "f778918e-79f8-402f-81d8-ef2208b61804", "comment": "Malware payload (GuLoader)", "value": "5850aa2160dd3f8d491ca92e1065be7386d40c30e288642fb0c37803757ef2c36ec0d377a3bef6c192b345e8f6072b74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775542418, "uuid": "58ed6c2d-6af5-4d65-bf74-53f37e77c7fa", "value": "T14484E143BB81CBA7D478473149AB83556771FC225B821F0B3398B7292DF32616A4778E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775542418, "uuid": "2df9d4ca-2099-4fca-bf69-85b45f278d20", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775542418, "uuid": "d4903f86-c44c-423f-bdc0-0f54b1ef0a27", "value": "6144:m5lz/1R2mcE9JsdPjRbvhU4vrRwuktWgOeWoMiv:efr9JOPjRbvhU4PAdrWHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775542418, "uuid": "a302b88f-0641-492c-b9e8-d2b7a80983e4", "value": 401976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775542418, "uuid": "9acae7eb-4fb7-40e0-b5ae-3ad74f1c7bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775542418, "uuid": "67a86a59-5e35-45fb-8ee4-fa57e6bc2750", "value": "Second_Tranche_Payment_Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a5c861-3263-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1775553840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553840, "uuid": "73754150-1801-4d6d-bc6d-9a636504fff7", "comment": "Malware payload (MassLogger)", "value": "9505a1d9114cda476f0a0e4614e7cbb1", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553840, "uuid": "e25f631a-07f9-4cb8-a558-d4c69e0af0bc", "comment": "Malware payload (MassLogger)", "value": "2801ccd00ad4c93afcc23b9f8e5f56a8ddef81c1f4b331978d9b288a69f8ce4d", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553840, "uuid": "4002f48b-ea23-458f-bd46-3d0eaab20a69", "comment": "Malware payload (MassLogger)", "value": "825586012df0b9c84aab2b528c883a603c0ba252", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553840, "uuid": "98f8b561-5eff-4de1-b938-1e34f785e773", "comment": "Malware payload (MassLogger)", "value": "138bcf0710b4b2194c078660404b1c9cb8856d818f32df4707eddf7114c52e57de33528077a4d1581ccd442c264f5c50", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553840, "uuid": "02831b46-529f-4008-b8d7-121a261eac5b", "value": "T12D3523658D85097C0682C11E316F4B5CC2B35B85C885F8E2BE2F98125FBD387975FE2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553840, "uuid": "ff59cce0-6d54-4d14-bba3-884ac9cf7077", "value": "24576:D4X1o6DS+35fKxZHbP01d1xO3HLJsEuGPuXM2nHA:0dKGc3l5eHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553840, "uuid": "06cdd0d9-6b89-4436-8ea5-1bb2689b1eee", "value": 1120257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553840, "uuid": "14d85efe-e262-48c5-bdd8-ae37adc0a280", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553840, "uuid": "b7b9b8f0-ba20-4b6d-a340-21e216550089", "value": "DIPS (1).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12eb779b-32d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775600897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600897, "uuid": "ab1a51c5-7832-4822-b340-0cf21c27b5a2", "comment": "Malware payload (Mirai)", "value": "eccd2c4eff5c20290a0592866f9ca249", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600897, "uuid": "95385232-dc6a-4572-a554-57ccdeff25d3", "comment": "Malware payload (Mirai)", "value": "280b43127e0ec992fcf8675ccdfca0f947bda32ba72a085c013a003051f9be84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600897, "uuid": "dd1df779-9e70-4ae0-861d-72c3b24c1410", "comment": "Malware payload (Mirai)", "value": "70d595c757740bad96c6963cdf5e80185c42fd58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600897, "uuid": "4a74f2cd-11f2-442a-824e-dc8fad288e57", "comment": "Malware payload (Mirai)", "value": "2cd6488aa427aa678646cc407da2da2dfda8e9040ae27e5484780028c3e3fea3aa30458f7acb8e1842fee196df21329c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600897, "uuid": "f4225c74-5d4a-445a-a917-f4eb6bbf8276", "value": "T1FEC30806EF511FABD82FDE7346B90A06388C6D5722B527757974EC18B31A1CB0AE3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600897, "uuid": "a924e1f0-424e-46ed-bde7-8ba1afbc297a", "value": "1536:8gQz9Ph17xjpE8PmyVQtHbELUarzBXmCZGePJCaHA0tKvpgr7FcplZWFPnaEu59M:ixP9jqyDJz3ZT98pSFUNtY/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775600897, "uuid": "f2441995-4eb0-4665-85f1-9366e8fe25b1", "value": 125188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775600897, "uuid": "39895aed-88f3-40b2-a045-29894c625b43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600897, "uuid": "55a98cf8-7892-4afa-befd-99ba17e34ccd", "value": "SecuriteInfo.com.ELF.Downloader-DN.19549156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e74f99d-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554155, "uuid": "670cdbe3-347c-4b21-9fc7-b86194e6a827", "comment": "Malware payload (Mirai)", "value": "f1971c716654ca4f3480e6456d542572", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554155, "uuid": "737ca66b-0526-4ef4-928e-af5e3300583f", "comment": "Malware payload (Mirai)", "value": "28f1cea660ab2c6d85d02bb96b3cb34c7c9d7110998b87a8d536340c84031c97", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554155, "uuid": "2e326d97-24e9-427c-8e91-91203e8050d6", "comment": "Malware payload (Mirai)", "value": "07035ba43611952cae96407bac755d7cfa525a9e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554155, "uuid": "357149fb-1216-437d-902e-97ed23477b1b", "comment": "Malware payload (Mirai)", "value": "f07d11dbea913de41a56ac8ceb2d22a0b24caecc10a1f6a87a0060407116118e498c883ba7fc10dfae0699e4b5af1eb5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554155, "uuid": "80c8b830-0ddf-4305-80a3-42f2b3e5ebad", "value": "T1A6639E16D82509A9C286C5B471EC8E3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554155, "uuid": "32bb586e-ab9b-4bd1-9ca5-1d444a3527b4", "value": "1536:D/rMkOtfaR0glv2ZKsT5Z7BPxznCI0sCp8udK:DYkwfCFlugsz9xznsxrdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554155, "uuid": "792b9308-e6da-4386-9698-6d968d74b5c2", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554155, "uuid": "87bddbb6-2ede-4452-9fe4-5ffdede85c52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554155, "uuid": "9c6ffa0e-df7a-4686-b83c-c4cb59056a4c", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4a7508-329d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775578552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578552, "uuid": "df1d43ae-ffc6-4683-8ef7-273a22391351", "comment": "Malware payload (Mirai)", "value": "eed01c510ef03a847cbc65dc34f26e66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578552, "uuid": "ef3ff288-7987-409b-badc-abe333d587ed", "comment": "Malware payload (Mirai)", "value": "290a5d0603d5c679a475dad31807f8397e06753720c396c491669e0a56aae66c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578552, "uuid": "474dbd77-1ffc-48e7-add8-de0cf962377a", "comment": "Malware payload (Mirai)", "value": "1b9b12426bc9730b94f61485c1f2c322420e1be3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578552, "uuid": "fb6c9611-0aaa-4467-9532-50d083aecde2", "comment": "Malware payload (Mirai)", "value": "402c4a42f05e855c482fc81c0310a4dd15e9a31d114028a622ce691aff0d1d62cc2178515835ab8aac97d4929d20b2e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578552, "uuid": "168a1370-daac-4395-9940-dd497fd7c4ce", "value": "T1D6833B03B981C9EFC45BD2F41BFB65319922BC3A0932B2DD6BD4BD912B19D903A6D710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578552, "uuid": "bcb589e7-23ee-43bd-8c7b-2732149110fd", "value": "1536:9UlR9FJdW9p0r3qNEhpAMPOwW6csKdwNjRNSpa3R5Ru:ilR9FbWT0reMPqNstNjRgsR5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775578552, "uuid": "68ca3854-4449-41a8-b848-64247464a439", "value": 87344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775578552, "uuid": "3b4cac3b-d841-45b1-85ed-f124d09e7ba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578552, "uuid": "e64d9ca3-ee4f-485b-9218-380c2d26b571", "value": "zyre.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc3eccf-32a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775580007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775580007, "uuid": "e9b83267-e967-4e6e-bb8c-bbccb21fee00", "comment": "Malware payload (Mirai)", "value": "16112c6d730749269b4971a2ab0fa74d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775580007, "uuid": "761d63b2-d66c-495d-bf0c-eda8628e497e", "comment": "Malware payload (Mirai)", "value": "2974f438e7962ce6a540c6f788ab38b0151910feac41b22e7839f69bd0621761", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775580007, "uuid": "8ef40f39-74de-481c-8ef0-ef1055f985e7", "comment": "Malware payload (Mirai)", "value": "f47f2bdf7349dbb0cf8cd51c6cd8219c12d18f9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775580007, "uuid": "57739ad5-54f1-415f-8fb4-c3d7e27a415d", "comment": "Malware payload (Mirai)", "value": "f7ea161bfe3e43dff00d7280d08de3968fe69c1e3611f83bc8990a8b7659f9c5f7d5ee737a22b4ffc8ce58bac1792930", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775580007, "uuid": "0df1c7d1-b8d3-48fe-b49d-d4129e434f76", "value": "T1EEB3F706EF515FABC82FDD7302BA0A12388C6D6B36B527657974EC18B7161870AE3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775580007, "uuid": "d6bb0985-8f18-4b37-876d-c122fb8a676b", "value": "1536:sYZhGybM7abdvNfZsK1xTXOBEb+dPmArvXBHBCQBZV9Sh5Ygub+NZJZ6IPxn33yN:juyZcPBEMPLUvYL+dVPQa30XT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775580007, "uuid": "43484cac-90d0-4ac3-8e8f-becb0d103c1a", "value": 117212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775580007, "uuid": "032e5297-5a61-4e54-9507-d405a7953dc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775580007, "uuid": "c05a3fd9-25f0-45d5-8515-34dc32bd0815", "value": "zyre.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f64acf-3273-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775560737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560737, "uuid": "96a75ee7-dd2f-4366-9417-478082847bae", "comment": "Malware payload", "value": "381247c1d4c68a406237d7d3aa030930", "object_relation": "md5", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "Invitation-Letter-No-02-2026", "colour": "#57A275", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560737, "uuid": "8918795d-fd43-476e-a924-bd46187e7f24", "comment": "Malware payload", "value": "29cd44aa2a51a200d82cca578d97dc13241bc906ea6a33b132c6ca567dc8f3ad", "object_relation": "sha256", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "Invitation-Letter-No-02-2026", "colour": "#57A275", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560737, "uuid": "e75c2871-c1a7-4f08-a219-b5871d8a2e1b", "comment": "Malware payload", "value": "1151100a0aa1ed88f7897709444fd3b3b1044c10", "object_relation": "sha1", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "Invitation-Letter-No-02-2026", "colour": "#57A275", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560737, "uuid": "57eb93c5-1b17-4e6d-8486-5ccf34b0974f", "comment": "Malware payload", "value": "c8e1ac0aea6449f1e270e6fd2169830185461bd3b67b10cd125414463eea7ca22651aeb92635667e26e4f40fe8259ece", "object_relation": "sha3-384", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "Invitation-Letter-No-02-2026", "colour": "#57A275", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560737, "uuid": "a8d83d74-b2b4-4f5e-b91d-2deaea188414", "value": "T1FAB3124C6A60977119E1E03EEE41E04473B93C8882FD3C24C6E6D94F9E5ACDA947879F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560737, "uuid": "0ac0bccf-604e-4644-b0a1-44f7a02981e3", "value": "3072:H2dP4WlUaFT7U4cy9YA4GvB8R+mFZipuqK358LWh5BA:WZxldRl8RzZQup2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775560737, "uuid": "5a0899d7-c4d9-47bc-ab2a-264b62d18a75", "value": 113212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775560737, "uuid": "eb8b2eae-6e16-4f50-a498-957e98d6c2eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560737, "uuid": "d1b05504-ec5c-4696-8422-d59c5559e55b", "value": "Invitation_Letter_No.02_2026.zip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5305e2-32d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775603572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603572, "uuid": "cc90dbb4-31d3-494c-893e-51a3b2795557", "comment": "Malware payload", "value": "5fa825564b4ede126005a88ba9efbb54", "object_relation": "md5", "Tag": [ { "name": "89-36-224-5", "colour": "#D03EE4", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603572, "uuid": "8e69dfc3-e127-41b0-b429-3dfc81ea221d", "comment": "Malware payload", "value": "2a10ffe0367bb1b26ba2c3bc600892c21074725c0b8c9dc9161e6ceb33915460", "object_relation": "sha256", "Tag": [ { "name": "89-36-224-5", "colour": "#D03EE4", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603572, "uuid": "22b7235f-53b7-46f6-8236-3765640865ed", "comment": "Malware payload", "value": "2e763321936858b8a566eaadcaf5a7ce064bbad0", "object_relation": "sha1", "Tag": [ { "name": "89-36-224-5", "colour": "#D03EE4", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603572, "uuid": "8c443f49-12d3-45a7-87ae-cd7530a8cfb6", "comment": "Malware payload", "value": "2fc7e6803a1445e8364317a64d49c455872f4f2f8e47bc636fd3a26861536d8e33e8b16a3e7921560dc641246b6d9c0e", "object_relation": "sha3-384", "Tag": [ { "name": "89-36-224-5", "colour": "#D03EE4", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603572, "uuid": "f827b181-2dee-43c9-92d7-c7a3aae7fcec", "value": "T176F0DC841EBC96F603C6A824363011DC606E35BE3EC7370170C224EAB27B8009F67B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603572, "uuid": "7ab83efc-7f72-4e81-bf26-950cf9c36162", "value": "12:JMxwKuMPazNpDmvOKu3WDHFUpOKu3W3RIZOKuzXIQOKuT:u2rEMWOr3WjkOr3W3RIZOrzDOrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775603572, "uuid": "2c2f0377-b3ae-434b-b0f0-0b9dc8b119f0", "value": 463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775603572, "uuid": "f47e176b-1176-48ed-a0ad-b1a6aed99982", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603572, "uuid": "af89a886-d48e-49e9-990b-7f01341c190c", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49513453-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561904, "uuid": "40ba7d52-06ea-46e9-a79c-cdd4b69c2594", "comment": "Malware payload (Mirai)", "value": "6bc1d8e99b4ac946ba63fd6a16cbe1e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561904, "uuid": "7cd4c0b9-9aac-4054-9239-2e6666e94c61", "comment": "Malware payload (Mirai)", "value": "2a1ede98be213e2b825bd4483468b4f0bf73a2620cf5d78b32e9586523fab8f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561904, "uuid": "2a65452c-0d85-47c1-b01e-058a882467b5", "comment": "Malware payload (Mirai)", "value": "28cd4e850e8f6a3454d77c62d0a43464c3834c21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561904, "uuid": "d24e9b92-de0f-4590-8963-32704f8a6152", "comment": "Malware payload (Mirai)", "value": "ef5bbd6cf682901322a76a4b7ce0b9f58fd6de6fd8fd47317a05da2e477b2b6c21f415712d891f81452fe2fc14d91a64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561904, "uuid": "d85ae9f6-50a7-47b9-a408-848f874d9b88", "value": "T14524741A3E12DF7FF569837047B38930969876963AE1D585F26CD70C1E2028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561904, "uuid": "c5701372-2974-4614-892d-eec00e0ee546", "value": "3072:S41m2ZzWL2gc2Vakg95ISd68KHP7ZUXG97lWYj:S41m2ZzWvdakgEpzPym7cYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561904, "uuid": "0588084a-eeb7-43ca-8b09-a23f79a95c25", "value": 219176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561904, "uuid": "b426b976-f146-4107-acc2-fb336b150b65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561904, "uuid": "b0ed868c-f429-411f-b9a3-6977b94fa916", "value": "nmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc119846-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552674, "uuid": "bc5ce392-0028-4242-ab2a-ff03514a39c9", "comment": "Malware payload (Mirai)", "value": "354ab8834477605e932dd6ba7abecc27", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552674, "uuid": "cad58532-49ed-4139-acaa-f91aa0936dd3", "comment": "Malware payload (Mirai)", "value": "2b47f9a9ffc2792e83eb0967a1a9e3b97647c327681203452c1d9d6870d55e94", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552674, "uuid": "5300d0b3-d2b8-4718-b29a-e7062e8e35f8", "comment": "Malware payload (Mirai)", "value": "4004f59c088d3aa78a2f1331a57fb8fa4c109c61", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552674, "uuid": "ba3ab955-bde2-4511-b17e-fa43bda5d9e2", "comment": "Malware payload (Mirai)", "value": "e4d48a34e88f83fbff60c85304d7af53e560203d791a7776aaecab2c5137d59c9abaec17c6952b97f6bc600de8f73173", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552674, "uuid": "15380a49-fa3a-4c09-9817-3396980c0794", "value": "T18703F1AC922729A5CFE0BD7BB4BD41078C96CB7864CFFF652135921CA8D2CE0309951B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552674, "uuid": "94b06089-436c-46e3-8e3c-47ddf3824548", "value": "768:S2zhLcO14U5jSzX5IrY+qnuvO7HxKrf4RygxVfUbHtvyHj3uOjr6DP9q3UELPN:S5O1LjKXK0nuvcgf4ggxtigaCmD+LV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552674, "uuid": "bc550334-728d-4597-ac7a-0bbe5380227b", "value": 40024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552674, "uuid": "bee6aa77-acb3-4400-bda0-da3b25235242", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552674, "uuid": "6582dfa4-42fe-4a9e-bc20-7cc61b992b54", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051c0c1e-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539885, "uuid": "b5f1f514-0199-4ad1-a781-e4979ac7e95d", "comment": "Malware payload (Mirai)", "value": "ef1119ef15a7a2c487dd3bce7779d79c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539885, "uuid": "6c63b572-5610-40a2-a89a-b28f9fcbbd8b", "comment": "Malware payload (Mirai)", "value": "2baaa3d0f641a498a55717aedce89f7124497831eca797738ea599ae6a1e9944", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539885, "uuid": "7aacc008-012b-4752-98a5-4b5b66db5699", "comment": "Malware payload (Mirai)", "value": "11c7805b11de373477fd74b168572b23eeab9b17", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539885, "uuid": "cf180781-769f-423b-a496-655a2cc8e7cb", "comment": "Malware payload (Mirai)", "value": "55ad1ee8baca3e1cd8c03ffba88b03f6256701c02415132cd8ba60e95ee91c1bb2938b815704a9dba5dbbfd0f3b71fbd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539885, "uuid": "e303349c-b5c0-4b99-b598-41b28814e815", "value": "T16113F1AC966D56A1DA13C731905D1DC681B9BC0285CF77423A085AB50CAF8A7333BCAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539885, "uuid": "57d5b87d-cdd3-4356-b176-06342928aefc", "value": "768:EQ7lh0vLMADljRyANe45yerYY+JPP1e/AlB+knMQ0eGdWMsvs:vSvLneAoyN+JPoIlB+QMQ0HdWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539885, "uuid": "b27fc3f4-dfd6-434e-bbac-b52489c83406", "value": 42096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539885, "uuid": "eb14eaed-262b-4d9e-8db9-73488702de71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539885, "uuid": "cae0508d-6a1c-473d-8c15-99639182692c", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a43a99-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553009, "uuid": "f049fe46-9e3d-486c-b1a4-de80522adcb0", "comment": "Malware payload (Mirai)", "value": "7169b7c80a64f88b10dc89100321c101", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553009, "uuid": "b5abc69c-326a-4185-8ef7-6bbeb2251bae", "comment": "Malware payload (Mirai)", "value": "2cc6e19fdf1452019ff35593e29781588212cdf6d592423f700f5a3b090c186f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553009, "uuid": "f122eb7b-f486-4456-98bb-fce16578c805", "comment": "Malware payload (Mirai)", "value": "beffaad71bc0f6b0c37ce661c751a1344cec8e8f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553009, "uuid": "0c72711a-b921-4e53-879a-de8a7bd91176", "comment": "Malware payload (Mirai)", "value": "a62f8f6bb712362a20b832ac9c9a82a693301a8c6b0d0625665525df1360f4cce2d1c655c46aeca43f74d0eed4a02a4e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553009, "uuid": "00e232b4-a226-410b-82ff-e648a9384f72", "value": "T160C2E17478FD4EA8FA99DB37512E2CD1907E9DD887D9C90EBF80CA7349EE1945028432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553009, "uuid": "3c5a21e5-3f55-4e4b-9a89-4b85f1472609", "value": "768:0I0SFhL/fi+MzEZgJ8obPcN5t9XvhU0ayM/8RolD6u:nF3nfZgJNbkNLrU09M/FD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553009, "uuid": "7bbab8b9-3334-4e32-8512-df0ccdef5a00", "value": 26072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553009, "uuid": "c5e7ee21-7146-46be-ac88-f75ab47fc985", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553009, "uuid": "a4ee86c1-5a6a-4aef-bf4d-5c72a08d8698", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85d43fb-32c1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775594275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775594275, "uuid": "9184f9ac-13e0-4314-a165-e8c71580f2d7", "comment": "Malware payload", "value": "58c7a3fc8618ab7d57819589cc65cca9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775594275, "uuid": "a386fc55-6a36-4302-9f03-3ae96f4bad16", "comment": "Malware payload", "value": "2deb86e693f3ecb90036d0181a05363a15e203f346ba8708a14976c80d275a17", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775594275, "uuid": "ee659f2b-dc5b-45c1-a34c-8b1eb755134e", "comment": "Malware payload", "value": "9cfd655cab75aa1809b83b4c303c65287e3c328f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775594275, "uuid": "2f59b8fb-d031-424e-a06a-7be624e769d4", "comment": "Malware payload", "value": "d5f9fceb7cafeb953baf012004e91ef583ae79f41e81348d371d156a699d861344b8af49498f6ef7d070d9b07d309b3d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775594275, "uuid": "1f7d056a-14b9-48f5-8593-1106f1a743fb", "value": "T1D1E07DE23CADB373179140106016D3657625011E153ADD69A6AD592083C0D88A1015C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775594275, "uuid": "4fcd2127-6b39-4db6-875d-20c056a1bf7e", "value": "6:udVy9fYQgbds7XtG1i65tGxo0YhxZffSwYWS/tmT/nMGzeQzp6glzkl:oVy9f10dsR6t30YhDffSwW8T/nMGLz7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775594275, "uuid": "0e91e44e-baa8-4412-beda-1fe3e96b48dc", "value": 297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775594275, "uuid": "79d2d966-eb28-42ae-a631-a3172f6383f7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775594275, "uuid": "d5c861ae-024a-4d85-8bd1-54a146e6384d", "value": "Important_Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586ccc2e-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561929, "uuid": "790b26e5-cf21-4ef4-aebe-b775ceb4f285", "comment": "Malware payload (Mirai)", "value": "e78681217d65d0a5028744f1534f48f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561929, "uuid": "c79ade4c-4904-490f-bfff-465f722c1733", "comment": "Malware payload (Mirai)", "value": "2e73789409644c0636c29cfa50b72d39977f5804bbaa2fbbd01cf10592307b7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561929, "uuid": "12537be9-d5bb-4960-89f0-ea53c03c976c", "comment": "Malware payload (Mirai)", "value": "46ba06d849ba496e6e97352fa02f350557769e83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561929, "uuid": "a00b4bf7-2f33-4bab-a7ed-4da18715d029", "comment": "Malware payload (Mirai)", "value": "035bb491e6484936e2c495d1600cad6ccf588c788ed5d7dc60b39138a9b9ca2527c1fb7bedb636dcc15fe1e4c8eb34cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561929, "uuid": "b81a5fc3-2625-4475-94f4-46e0bc42001e", "value": "T1BB746513D9164895E5258CF222673385AC4B83BB8CE722E3ED5A49A1FF3145F41BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561929, "uuid": "cc0632c5-96a5-4dac-8d1c-0fa0d90f75be", "value": "3072:UZaqZamivABj8zk77gCFhm5n5YbzWcemgb+joCVqA7:UZMajtRm56bRxjoWq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561929, "uuid": "1ed77667-bae5-4202-9372-4209087a45d2", "value": 344940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561929, "uuid": "44a0f5d9-774d-46d8-917e-c1a1cbc2d564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561929, "uuid": "f38b5c01-a7bd-46b2-899e-9064bd2162cb", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5181c9-32ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775585288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775585288, "uuid": "76d6a725-4bfb-4fd2-b96c-35f381b82564", "comment": "Malware payload", "value": "3e6a2d2210851ce17fd0c579ec5c96b4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775585288, "uuid": "b2fdf365-ca0f-4efb-8463-7a78eb9ba765", "comment": "Malware payload", "value": "2fd841539c8b1fa0b2f7a102e6ce3254b050585b7fd667918beb70052648c1f5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775585288, "uuid": "3d10e820-4dd2-4f94-97d4-8a6e53cacbd2", "comment": "Malware payload", "value": "5e1fc20f59a7cd419b035d96696f474952e58b0f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775585288, "uuid": "4b450626-b32a-4f24-81d5-c03a2e713a0d", "comment": "Malware payload", "value": "8a7733c7eec8fc6e0148214b89cd0df6d5ed786a1e5ffdcb52ef4f6566d698aced15b3616359cfffd3b03dad46546ce6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775585288, "uuid": "a59993d9-6f5a-4947-8ff3-b91e381cd8f7", "value": "T1FFD5E4E0A942C232D66F83701618CB7B09796DA22F3B46D717DB7D3B39705C25922B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775585288, "uuid": "6f11cc34-d8b8-4c62-b3d9-d1405c951148", "value": "49152:cTrqYaZrf5jSTUialOJrMf+7UVZDEFeN4vLNgmUESIEjPMN2lv+oBNYHbMV3eVoN:9jSTBNq+w4veHjPMNaxY7MV396A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775585288, "uuid": "84243f59-83dd-4e3b-8c34-7207c9b7ffe4", "value": 2878464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775585288, "uuid": "582693bc-72b7-492a-935f-b722fc602439", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775585288, "uuid": "9a4388fb-0631-4e37-a6db-1f4ce6c154ce", "value": "globalgamemanagers.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82dfdf63-3283-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775567584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567584, "uuid": "36372827-e8c3-467a-a966-0e1f1bf511d0", "comment": "Malware payload", "value": "4ade1144d0107534c81caf61b31dedec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567584, "uuid": "d66e2db3-508a-4114-8ef0-703a0acb07ef", "comment": "Malware payload", "value": "306d34752786ff8aa6385cf143b150bdb247e594af1060937f1318c96d598e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567584, "uuid": "b242996f-b4ad-4149-9468-ed88b5e0b694", "comment": "Malware payload", "value": "3707230dc1e56c4d1dedd7e822ca2f5088e96d61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567584, "uuid": "d4c6ae58-f33c-49fd-8097-100e19070d50", "comment": "Malware payload", "value": "a41d7a35561c17096a64a4f13d494ba856e28e1c847232cb9c36a02dc90bd2a7341e51e01e10fcf2ad474175f8bc3996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567584, "uuid": "712f1a53-c650-4eca-bccc-14ef9a5811aa", "value": "T1DF357B83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567584, "uuid": "0d647994-a036-4973-b72b-ab7bb83b0c39", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567584, "uuid": "70f56d7c-4c22-44bd-abd0-e3125b04a0cf", "value": "12288:ebs/m0E54jwaFXGc8lEBBBHGBKq2IZwDryvfqItNqdg:ebOVE5ifGPRZwivf3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775567584, "uuid": "5553037c-9d54-4e33-8546-79f7f3d59e0e", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775567584, "uuid": "b0e1a0ad-fb3c-44ab-b31e-2dbc70bd2688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567584, "uuid": "2f5c71ee-55f2-4ff7-a491-281eb0f9a20b", "value": "matrix cracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364a8e17-3277-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775562301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562301, "uuid": "6dadae72-082a-49f7-a487-b89d9f3c7c80", "comment": "Malware payload", "value": "d7ee0e37a0f1d9b1f47f496ef2addd4d", "object_relation": "md5", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562301, "uuid": "c536da89-3124-4052-9571-c710122e4026", "comment": "Malware payload", "value": "318802be235a4106ff1951c4dbfcf86cfbf3d64124c694d8b067203070ddd1fd", "object_relation": "sha256", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562301, "uuid": "4c6f025c-8c2e-4a21-bbb9-6f4f7c82b628", "comment": "Malware payload", "value": "79d6423eae1749c5a10964bf457f8200b817729e", "object_relation": "sha1", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562301, "uuid": "0482e5ad-43de-4183-9fbd-f936c5965dae", "comment": "Malware payload", "value": "1a83b825d9573234fc5bc2461f3b85700df873257d834719ff0c4dc060607d11e4ca0e3a69b1fa2cb1ebfed4c369c058", "object_relation": "sha3-384", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562301, "uuid": "6e42606b-ad24-4642-b865-d04c2d605bc5", "value": "T14D353339664C2624E7119EFE0DA7E3E14B49EE8D9D0718D539A1B12FC7311C2833BAE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562301, "uuid": "26ab9997-8984-4cb8-855d-251fe81c409b", "value": "24576:i+j+1BxtFbftaGkDc4ku+xqm/YxsjiqoN:i+qtbfI3Q4krxqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562301, "uuid": "18d3bd4f-b91d-4e9a-a266-60403f9625ce", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562301, "uuid": "8a6161c4-124a-4f3d-bf88-93352300736c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562301, "uuid": "4cd031a1-0931-4b64-80a5-ae9de937e494", "value": "318802be235a4106ff1951c4dbfcf86cfbf3d64124c694d8b067203070ddd1fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aefe10f-32d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775603997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603997, "uuid": "6c765a7a-d626-4a4f-aab6-38eda8d913b7", "comment": "Malware payload (Mirai)", "value": "426e99e8a993049a3462d2793f536def", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603997, "uuid": "0f848a75-8cee-4520-baf2-6ba939ccbe85", "comment": "Malware payload (Mirai)", "value": "324f1f8d21316886aac155d7fe025d4d138b045a980add95d9100c036d0099d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603997, "uuid": "cd6cd4c7-20a3-40ce-99ea-ab5a86ef7fa1", "comment": "Malware payload (Mirai)", "value": "25e2f03ce47abf609754c00746d185b0930021ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775603997, "uuid": "0e1e872a-2c7e-4827-baba-4e2f83afc40a", "comment": "Malware payload (Mirai)", "value": "ec2e0ed4ba50caee1fb3ae622d2f49c30cc78304e51d89f1180a423120ad574aabf881aed7f3e0674f2aa25bab5af6a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603997, "uuid": "32a70144-954b-4b10-9b0b-4b63092567cc", "value": "T1B1833A86AB03DAF7E44315F002B7B7325970FD3B0822D58AE764BCB6A9159D06F1636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603997, "uuid": "9a437fc2-146b-4cd5-9c7d-8ebbe92ab44f", "value": "1536:SlyPB9uAbRJQVFPYR7fFDPfyPZvbldRbxHQdmXQtfK8bml7/dg:SlyPmzPi7tHyRJd0mApK7pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775603997, "uuid": "5ec9f916-f852-43b3-9acc-5968226e6679", "value": 86496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775603997, "uuid": "f5b85488-812a-4d24-99d9-8b414bf0f466", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775603997, "uuid": "d6f210be-080d-456f-aedc-857b7f9b8b11", "value": "zyre.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337944b1-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539963, "uuid": "6b3ca5f8-047c-40db-9917-a81a7809fbb2", "comment": "Malware payload (Mirai)", "value": "70a9d12af0a97b4ea94d059e93538513", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539963, "uuid": "853ef4d5-acfb-4935-9877-0513ed7f10dc", "comment": "Malware payload (Mirai)", "value": "3258f89cef49432f0316b1ebe2df0c5802428fedf1bcd8413fa683660ec0afbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539963, "uuid": "f3dbebe7-f538-4054-971f-3e38b52f995e", "comment": "Malware payload (Mirai)", "value": "828a95daed9c7e39f28edaf33393bdd62e6efade", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539963, "uuid": "d21b3713-66fa-4160-b2bc-96cd19c60a5b", "comment": "Malware payload (Mirai)", "value": "c983c937a3844bdf775c9863a9fa2597ee4cde6266a45f698457066071a66ee5cc7291bd3eb5ae20b8ece073af17cbdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539963, "uuid": "013afec7-9918-4862-ac67-aed75a7747be", "value": "T1A3045C46EB818A13C0D71779B69F524633239BA4D3DB33069918AFB43F867DE0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539963, "uuid": "686297b5-548b-4b1f-8fc2-011897441d44", "value": "3072:OUYNIkBWDMBaShF/h9b1tgBKsXCmiHUd3oy3d0fM/9jezpFM:OUKByIaShF/h9xtwdCPH03oy3dEM/9gM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539963, "uuid": "4af865fa-f39b-4b09-a6e9-7649958e3226", "value": 176507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539963, "uuid": "ae3f5e3f-fc65-4455-b956-b6e8c2711b45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539963, "uuid": "7428f197-10d8-4b38-9e6a-8af1b40a2efd", "value": "windy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000daf04-325a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775549755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549755, "uuid": "34eb7a69-0b47-4acc-9b8b-6e29e9c9f276", "comment": "Malware payload (RemcosRAT)", "value": "1d8341fb71f4f2301f6577aa5fa3c678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549755, "uuid": "35dbbd30-5bb9-4bd0-b0a1-21ca344e3a59", "comment": "Malware payload (RemcosRAT)", "value": "32839e5fa6a7e0f95d88153b87b2234f07df06228b9f62517a1b47a737e5d1ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549755, "uuid": "efa03a9e-8d76-477b-ab66-0bfe0dab798f", "comment": "Malware payload (RemcosRAT)", "value": "b45b312ffc799c40bfa278c71a46550ffae0048e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549755, "uuid": "1d1e57e8-c17c-4a4f-8feb-1c1e8dd85846", "comment": "Malware payload (RemcosRAT)", "value": "7b3b9ca0b179e0a40a35ecf70038a5d24ddcb80325e8d1938e14cb1d0e1fea0bd12a880dde92095efbf1fbd03578cbe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549755, "uuid": "f0a2aadc-a20c-48a4-8586-a1527527b3e2", "value": "T1FF94F1037780CBA7C46487314AAF8715B736FD165BC2270B3398B7592DB3362291A79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549755, "uuid": "ca786af5-8469-4997-a71b-111c53d8d745", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549755, "uuid": "6edee2cc-7cf5-41ca-9500-cb9cbf4044c5", "value": "6144:x5lz/1R2mcE9J4XhEn/lb3809+aFKkVsIHDMq6gNDtj8Dx6gk:rfr9J4XI9b379+ol2Opz4Zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775549755, "uuid": "fddcda22-39aa-4ee5-912a-2412c2bf6726", "value": 435144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775549755, "uuid": "96bc6e12-66cc-44ab-ae37-f2f76a08cd82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549755, "uuid": "ed25e2b3-6f7a-4390-87a4-d3888442f490", "value": "Trigae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd5af28-327a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563740, "uuid": "d96abade-8a2f-496b-afdb-19c58e0ba4ca", "comment": "Malware payload", "value": "a8b80f5968a888acfa582f6a0ae5c142", "object_relation": "md5", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563740, "uuid": "1eddcdf1-b8ea-4ae9-8c4c-a0cd1e775c63", "comment": "Malware payload", "value": "3292a41c6b56940f0139166d5bfade79911fc1174dbb5a26b6151294628e8de2", "object_relation": "sha256", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563740, "uuid": "31bcf86a-7aa6-45ea-8057-896aa307ac35", "comment": "Malware payload", "value": "fe3d40ae7c04b6a4c09b50b66b424d204fb590c4", "object_relation": "sha1", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563740, "uuid": "b91d1566-92db-4dd7-b76a-097773146c32", "comment": "Malware payload", "value": "95e5b320353c071fe5e4f75bd8e325c86f6c59ac716a2172c9b32e7e74000f24fff6742bef6b92deedb1078a8fe0ae59", "object_relation": "sha3-384", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563740, "uuid": "a1b0fa51-409a-450c-acda-6d0a1bd074b1", "value": "T15CF1D802805E2C67A3547F5B7CE41E1D7B9AF18E7CF4A4C985CA3A68408CC0EE974A3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563740, "uuid": "72a0d9f8-9771-4375-8fc4-820f057236cf", "value": "192:zzkUU0ijUHBjZq/zkUU0ijUHBjZquzkUU0ijUHBjZq41:zgXqBtAgXqBt3gXqBtv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563740, "uuid": "6c2980e1-e1fc-41b6-98c5-a27e952e362b", "value": 8067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563740, "uuid": "65f7b50c-9b6c-4dce-85dc-bffddbcd7324", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563740, "uuid": "c62c53f4-7695-452e-a526-c71bae23564b", "value": "3292a41c6b56940f0139166d5bfade79911fc1174dbb5a26b6151294628e8de2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddaad351-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552704, "uuid": "2fff496f-46ea-43fe-a6ed-c163533ee99f", "comment": "Malware payload (Mirai)", "value": "9a5f148d3cde3d5472a31ef267afc21a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552704, "uuid": "d562cf36-58a9-4e0b-a31c-deb37888ba66", "comment": "Malware payload (Mirai)", "value": "32c9637d85336dc2d1f6913dd369e4268badbf7be34b42bca60f96943178f0c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552704, "uuid": "d6945a89-45b1-4a5f-bb5e-eddacc9f7aea", "comment": "Malware payload (Mirai)", "value": "98ab539f115417664d9e1f7412bbbd412c10751c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552704, "uuid": "9ab8a94a-5e6e-40c6-bb46-79b4a19e71da", "comment": "Malware payload (Mirai)", "value": "075f717cdd998701240ff18cfb29e6425733250932e4a2b2de3d4ce0d15783630bae7dbaf9507f69ff7daa3bc2f97884", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552704, "uuid": "babb29d6-d54c-4df7-917d-450bfa60050c", "value": "T152835D91B9815713C5D012BBFB5E018E372A13A8D3EF32139D266F11378B86B0E77616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552704, "uuid": "4cb8c939-31c6-4e36-bbb2-c6d9293c1523", "value": "1536:ut5KJswRN0GkGgeMcXVIed8/OC9SqnB34N/Cv/61d6o:u5Kl5x/VIUDwBOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552704, "uuid": "f988cbfd-fc27-409b-a9a6-9dc774718cbf", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552704, "uuid": "94dd8296-8072-4b65-b331-938f8521f470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552704, "uuid": "d9cf9690-623b-4b5d-a7c2-ebadfcd971c4", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372a1e84-328a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775570463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775570463, "uuid": "1a6273dd-9328-4753-a602-021899c7c134", "comment": "Malware payload", "value": "7f62cedc39bf7e19af131691c79cfdc5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775570463, "uuid": "93d019bf-d042-4e03-a386-6733c70aeccb", "comment": "Malware payload", "value": "32d111bcb1698daae985643c6d71ff3f3dec0843141e83c8cc8feb7ab44d9362", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775570463, "uuid": "0613ffee-0809-4fa6-972b-0d2264f85ba0", "comment": "Malware payload", "value": "b448652356cb934a5ac250f899a6405ad6fe2fe8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775570463, "uuid": "0364e8d4-0ea9-4ff9-918c-6293bd5af6f2", "comment": "Malware payload", "value": "90b9205afb7227298b544ed1222eea78816bd799b3e3a9e2f2107736bfb0ae0803d0ddbe5b17ece3bdfc091c463fa3c6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775570463, "uuid": "2b5698f5-705f-4652-badc-bbd75b4ad5d2", "value": "T14856D6401A9366FDD63EC3BD481A0A42E101BC5FC22CCDBF06FED9956E2B535226B167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775570463, "uuid": "8e8ca762-b2ec-46e6-8542-b4ab6af83240", "value": "c4c5b7eeb6a65687446c62dc250c5433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775570463, "uuid": "2411b951-e16c-45e2-9a3b-c132f618556b", "value": "49152:fWD94gMUm/gjJ/XHC3eNU/Qa5Er2z82BcuFQnNRJH1RTMeS3IcOHG:exMH9z8CFQNRJH3MnZoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775570463, "uuid": "b7edf354-804a-4b33-bb63-76007931aba4", "value": 5990400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775570463, "uuid": "e5c1444e-3074-4b0c-a53c-b00a46f9b839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775570463, "uuid": "941daaef-4ba7-4f47-9c19-f316b28b7326", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3861b0d-3284-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775568122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568122, "uuid": "86592afc-5d9b-4cb8-b5c0-12286974f826", "comment": "Malware payload", "value": "ea598b913f77beefe78fe6e92d30f551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568122, "uuid": "52e2b8b7-f8b3-489c-8c2b-8f4ba2ad4025", "comment": "Malware payload", "value": "32e8354e4c16a36e84535bacffeb876529bd1bcea2290b682f201d29d0ea532b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568122, "uuid": "e6d74942-8a10-4ff4-ab73-daed9c4cc738", "comment": "Malware payload", "value": "b448e84d856c9da6c2c558cc98ec2bd0ff796405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568122, "uuid": "4b1cb99a-6bb1-40a4-b01a-a9d06b27406e", "comment": "Malware payload", "value": "f08bd7cd4e4fd1c0fff0481721d9b9a2d169d846068f6b71aef3c09e7fd2808c5b08ce24b60df6fbcbeb11c82eaa20a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568122, "uuid": "71190e44-cf20-41a2-8464-b3135c5ba290", "value": "T172B58D0AADD008B6D46A63368CF752927B34F8094B7367D32E62B6782FF27D05939744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568122, "uuid": "c809ee62-fc99-486a-887b-21983e259ab2", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568122, "uuid": "fed688bf-deb0-49b2-9601-93cac77cfac8", "value": "24576:2NXvk+E1ruGZgrJQW/VjOoehEpvny9KiT0K13qGFWIRvWgz0xsu:2xv5E1rirv9jOveUKiTR3c7xsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775568122, "uuid": "2f691460-020c-4759-86a0-abdac4db2b8e", "value": 2306280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775568122, "uuid": "06e847c8-1813-40ed-9411-925c027c2c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568122, "uuid": "508736b8-76de-46a2-873e-e1fb5c1225b1", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1258a4fb-329c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775578132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578132, "uuid": "d8e6f67d-1322-49f5-9a08-9c29255eb958", "comment": "Malware payload (Mirai)", "value": "d2d7275ba977eaf2da3e5163eac9e898", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578132, "uuid": "0eec2a66-6b62-40e3-9785-7eda0ce722ed", "comment": "Malware payload (Mirai)", "value": "335001fdf98f94efd163c662c0387a7137acb66de548ad620970141c5a2a34f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578132, "uuid": "c67b2110-29c0-415d-8363-cf37597b9e44", "comment": "Malware payload (Mirai)", "value": "b78f88053b797b1f1db6c639a6aa5ba7bd4f9046", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578132, "uuid": "c1a568e3-1c61-4a9e-9f63-c2fd5c0cbe62", "comment": "Malware payload (Mirai)", "value": "2ceb5bef4b24d9e407b0e6d431e9a04e39cb4f7a8b2329ec5ad2e3fd5e2ef3c6cba67ebd3b89c2558a151b32023fb927", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578132, "uuid": "cf273e3a-eaf2-48c4-9c1d-276401fbb6cb", "value": "T16E833943EE669F0AD057A5F060F6C9715B12FCA64D271EF2B462DEA88243ED871033B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578132, "uuid": "df0dd584-31aa-4828-ae06-fb9e258c3643", "value": "1536:VTnug+grhU+KRPJz7J71ai6+jLFzO9tIC7WlEcs+/qSJ:VTnuRCiRx51ai6+jLFzO9tIqvJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775578132, "uuid": "0f4b1b89-8e31-4ed2-b6b1-05515d372aaf", "value": 84124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775578132, "uuid": "91ff4921-5bd3-41cd-9f69-321acb06fc11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578132, "uuid": "bae2d403-3608-4836-a9ae-ff11abc2b7ae", "value": "zyre.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f354fdce-326c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775557894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557894, "uuid": "4b097ad2-8736-438a-b5a9-66621ee3dc53", "comment": "Malware payload (AsyncRAT)", "value": "88473db282dc5c0176ebc1a1d4aafa79", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557894, "uuid": "51ba44da-1f20-4875-81a1-b4a0dd1871c9", "comment": "Malware payload (AsyncRAT)", "value": "3380d357123e5b81f36a3e606864da12ec9ae2a94c0cd580a89309adf077acd6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557894, "uuid": "ec445c72-6159-4f9e-abc1-e91fe1cdb38f", "comment": "Malware payload (AsyncRAT)", "value": "c3a4eee7b0e460046d04a90c453058d16e10527f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557894, "uuid": "7d2c765f-f281-47a8-bb48-e03b326e75bd", "comment": "Malware payload (AsyncRAT)", "value": "a65ed71009db4216231c040fd2dc671f4b420be4a873a5ba2558406dbbc1462663087d1f720befb2e757431d33702d84", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557894, "uuid": "d2cfa24b-43cf-4e23-bede-08134f9b0c4a", "value": "T1E2F36C07B3A935F9E17BC274C5A20605FB3678764B21ABEF03544B761F222E09D39B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557894, "uuid": "4347be2e-7247-4fe3-92d1-5878776a3f73", "value": "d010692da5e0e07c07c8928e1fe93691", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557894, "uuid": "9aefeef2-af87-42c7-941d-10e2b97e628c", "value": "3072:vGs2uJl2cH33VUhktwWJ75q9nfsv55L7onNkOGSOCt36MCM7ix5:vGs/P33VU/WJ9q9yLMkOGSOCt3q6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775557894, "uuid": "3c896faf-4d8c-44f7-894b-7e1e34379e8e", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775557894, "uuid": "728dabb0-86f3-4d7f-a614-3a4283f602a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557894, "uuid": "54e695b0-bd19-4bca-8558-c957d37ac297", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4348fd5-3268-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1775556097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556097, "uuid": "bd9bceba-c064-44ee-aedc-d2ccd6c8128b", "comment": "Malware payload (MassLogger)", "value": "8daee673ad1af44606a43cabd030e4ee", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556097, "uuid": "cba6004a-8675-4400-a067-eb6823f249a9", "comment": "Malware payload (MassLogger)", "value": "340d44d2823cbb4630451f02fbf087f246c91d93ba89716af630fa7c0c6d35ed", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556097, "uuid": "ce3889d7-5325-4fe8-8ea2-62452f939c0b", "comment": "Malware payload (MassLogger)", "value": "5ab74c38dc062c3075bb678e73466171d072298f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556097, "uuid": "f80b134f-db34-43c5-9495-6d37c0e38a25", "comment": "Malware payload (MassLogger)", "value": "ba4946afd472c1c23c1f66e62b96e150891dd598e18d00857991664cdde25c3c93ef87e7f934afe47ff2b63b16848a00", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556097, "uuid": "0ca8d59f-d1e6-49b3-a1a4-560cf9bb7c65", "value": "T114C3F1128AC92F748E780E25C0BF341533E19AAE0567F68E9F337E825FDBB4815171A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556097, "uuid": "573e0791-7d51-47dc-a3b6-a8fc573563fa", "value": "3072:IhS4ut8/D+RVCy+0FxLXOvCECmeE6bhxGYKgsW:CS1t8KjCy+8XOvjqbhx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775556097, "uuid": "fb8bcaa6-d07e-437b-825b-e532e952d9fe", "value": 121326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775556097, "uuid": "94e5430c-4e54-4532-bd92-8f3d03159c6d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556097, "uuid": "564ddd5f-2292-4f48-90af-35470ca11551", "value": "Burhan services-Enquiry-G24103-DSTM36.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c285bf9-328e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775572270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775572270, "uuid": "9681a2cc-d519-4318-aabe-91cf7b88e2bb", "comment": "Malware payload", "value": "3ce3081ce894d58d8f592d104d61678b", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775572270, "uuid": "4db63834-0151-494f-9420-8a3ca9e4a251", "comment": "Malware payload", "value": "34102f8cf4661b34623627a987ecd8b3fa909a36680b35fe1191a7cfcc8731a7", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775572270, "uuid": "ab009705-8cc5-4281-8279-30b6784e43c7", "comment": "Malware payload", "value": "66e894f14ee2a5dad7d7c1f0447975fc8fbd13d5", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775572270, "uuid": "84090e2d-7108-4088-805b-bf2193288699", "comment": "Malware payload", "value": "0119bd59104325925e09c70ac3d354bb4ad9813efb9d7dfa26a021055b14805ea0356229ab1ea64c1f945ff3eef5ca04", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775572270, "uuid": "4b9e4ed4-85db-448f-9c5b-3b55eb689100", "value": "T1A8A7C04AE50CC625D4DEB278BE7D0A9173644D3C85D68916F81CB124FBFB1E01AB3B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775572270, "uuid": "1cac2627-2c3e-48fc-8a85-da206566de5e", "value": "393216:XRbShruhE8b+Nk2+537kW2ZkYqMAZa4WIdPxdFI+iSjJp5MStorht02Ce/d9+Hw9:XRbShrv8iAMobFI+Pf9AmP4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775572270, "uuid": "e6d7a927-5ba5-47e9-8ab0-a9a482211bf2", "value": 45112922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775572270, "uuid": "2def32b8-1437-4f06-8a1b-e9e65aaf7d7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775572270, "uuid": "42a01324-66c7-44bb-815c-eca1ef3bd0dc", "value": "Beautiful+Wallpapers_100.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259dec11-325f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775551965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551965, "uuid": "1a07ab12-4059-493f-ad0c-e74cdb4c0bb3", "comment": "Malware payload", "value": "ef0945cee7a044a905e38951d7d448cd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551965, "uuid": "d8a145de-53cb-46a5-96fb-a1217f1a8299", "comment": "Malware payload", "value": "348235942bbded0ef428a4e66e31fa5a58678ddeff4c8a95d51685b8a09f1166", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551965, "uuid": "f34523a5-78b2-4ed5-bcbb-94792ab17967", "comment": "Malware payload", "value": "51930598ab32a64e5ee5a9a387a9c4d49552caf8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551965, "uuid": "8d7b58a1-85ea-4d41-8910-4f322a3fa283", "comment": "Malware payload", "value": "68324cb2868cdb0d3040103a5a389aa6df2d7fc33493722c5466e484ab611893c1a58f6a1d5636468a7413888acbbaf1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551965, "uuid": "1e24f153-64fb-413f-a4b3-900a056fd522", "value": "T1502138F175C1A6DE6E587A1DD8CDC4248F4727C02099F987EC0B3E946E9928532FB50B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551965, "uuid": "5258622e-c83d-4a3f-b6fa-a038f6346d5c", "value": "24:MJnafXbwfXa/CEf6PsGPeGAHlHBNfsOfLJh2vs3m2vKHoy9h:MBaf8f2xf7GPet5sOfr5JvSdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775551965, "uuid": "ba5cc3e4-9cd8-4dd1-882a-cee83106bfc6", "value": 1367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775551965, "uuid": "f93bcbda-765e-4ba3-bdf0-282a5afa1eac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551965, "uuid": "c97a5aac-7606-4dad-8d38-39f522986e67", "value": "348235942bbded0ef428a4e66e31fa5a58678ddeff4c8a95d51685b8a09f1166.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0944ee1b-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539892, "uuid": "546a1943-60c0-4bdb-ab6c-dd5f5e9a1120", "comment": "Malware payload (Mirai)", "value": "1086fe317150ff9b7d6befc832738a2a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539892, "uuid": "15498924-835e-4078-85a7-35dcfbdd4804", "comment": "Malware payload (Mirai)", "value": "35206386f51d3be9d253a67e40c65cc93b604f91f0fcdaeb37470a027f3517d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539892, "uuid": "e1043ac8-8dfa-471a-ac54-3d9989e1616b", "comment": "Malware payload (Mirai)", "value": "1f7cab3ae4fc23fab3996a1cec84100959c936dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539892, "uuid": "3d24d24c-e49b-43bb-b8e7-9dd7310f7d84", "comment": "Malware payload (Mirai)", "value": "177fc1e83b69324f5a00e2b80fe48d6d137f5f23cb4871499091bc7070b3c50405a6c0f98a89ecfbc42f1dfeb6f6c689", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539892, "uuid": "c37bb53d-bc7d-406b-9ebc-a37607ddc9f3", "value": "T150739E23C8A61998C25C42B8B170FF3A6773D91056536FF6059ACA7AA047EDCF8093F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539892, "uuid": "7f6602c2-f3a9-4312-9655-f86e1095cbfb", "value": "1536:8/D/lVA7lbCyOyo+gKoJ/U74svhQC96I9hIXm:879VU8yOyo+noylvhQNGaXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539892, "uuid": "4984a40c-fd61-4beb-8eeb-61529cba1530", "value": 80380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539892, "uuid": "cb0417ca-125b-4f2b-82b6-ea5e5fdd169f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539892, "uuid": "3fb4f57e-e45f-4205-8648-abc4e432dfaf", "value": "windy.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5daa13e-3258-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775549255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549255, "uuid": "cec86549-f55f-41ed-ac58-82bbe1b3a198", "comment": "Malware payload (Mirai)", "value": "f4014642ccc1410b5adf9ef395bef5f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549255, "uuid": "5b0359e4-2b8f-4a8d-9f8c-1cbe1c9afb61", "comment": "Malware payload (Mirai)", "value": "35460c40e5d1764b71a7da2d19d211f4d141032b2bf01c0bd3f6915ac76550c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549255, "uuid": "47773589-4d69-4813-ba7f-00374740aa12", "comment": "Malware payload (Mirai)", "value": "604cb0b91006265dd899cbf13f62631a440ee9cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549255, "uuid": "50de80cb-9fca-4d95-83c6-eeee4dee4618", "comment": "Malware payload (Mirai)", "value": "fc01f5ab9680ada37ca39788e388961e8ee38889b1fce916f66925541aeccc1549b8597a63638493f9a6c1b88605e6bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549255, "uuid": "6942d239-1c39-4390-9740-8d2736c05a36", "value": "T134331817B58084FCC55DC27487BBB63AC422397E0239B2DE67C8FE165D46E611E2D8C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549255, "uuid": "9da0ba5e-d92c-4366-a9a3-1d10b190a58c", "value": "768:OuC62RaupzhsQV4JLrMwYNX/y2B/c2fMESUPG1tC3sJRUkBusFJIpq:a62RakV4JLrMwY1/y2BUkSU68cXUcFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775549255, "uuid": "b33e2611-7d6a-4dd6-b85a-bca509fb90ff", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775549255, "uuid": "8def8614-601b-411f-bf3c-7f6ed30d0046", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549255, "uuid": "841ce5e2-bf57-4628-b7f0-35945abb5ac0", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd75916-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554152, "uuid": "52a9badd-37d5-4bfd-a7d2-ee63f1497a43", "comment": "Malware payload (Mirai)", "value": "3799d910aad36bfc2c4b021227ae9ac2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554152, "uuid": "26cf7ccc-1a14-4732-823c-1acdb588314f", "comment": "Malware payload (Mirai)", "value": "3575f6af976aa33aefdb83951cbd2d6ae11cbc2e71dab4d5020143151be75e54", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554152, "uuid": "2231fab1-15bb-4508-b4d1-f8f97730a538", "comment": "Malware payload (Mirai)", "value": "8181343138c291143927dee1ebee9deee0cb3183", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554152, "uuid": "be2ccdca-4bfe-4508-9b78-f81b2a0f72f9", "comment": "Malware payload (Mirai)", "value": "60ff052db4d7cdb4b7f200764c8bd237a77afc8697113d0e2feb76a6aaf591b7841ebbb29ad23c4750e675feabe13eae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554152, "uuid": "3eeaf91e-f38e-48ee-97af-ee665b36a232", "value": "T14AF2E174C1AC4FD7ED9ADFF426D153EA7FE80A4B1312CC9371428F955B02401899EAE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554152, "uuid": "10d0eec6-5ded-49bd-a908-382ff0498f36", "value": "768:teDRJ7WcwHDB40LYBm1A/PWyi7yWr/iu2TS15IRk4uVcqgw09l:tCRocD0Lu/PWUWr/iu4Rk4u+qgw09l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554152, "uuid": "d3be2635-033c-4173-be4c-32b0c8fe21c9", "value": 35140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554152, "uuid": "3ee6bc66-621f-4d08-a136-c191a32c2d4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554152, "uuid": "98744e50-2a60-4eb5-aeb8-8a18d7ff1f45", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd615dd-324a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775542956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775542956, "uuid": "64593180-9ec5-433c-a53a-75488f707d6b", "comment": "Malware payload (NetSupport)", "value": "189b2379b749f50fe27511e4ada81b9d", "object_relation": "md5", "Tag": [ { "name": "107-189-19-35", "colour": "#81DC5B", "exportable": true, "hide_tag": false }, { "name": "167-148-195-179", "colour": "#872435", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775542956, "uuid": "2d3b1277-154f-481a-a48c-6109ca384394", "comment": "Malware payload (NetSupport)", "value": "357d58ef822609e528d8050a0f1112873309b4b54822d6a53beed73301b75929", "object_relation": "sha256", "Tag": [ { "name": "107-189-19-35", "colour": "#81DC5B", "exportable": true, "hide_tag": false }, { "name": "167-148-195-179", "colour": "#872435", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775542956, "uuid": "c9f91258-126c-4347-9369-d3bf72385cb7", "comment": "Malware payload (NetSupport)", "value": "3c8c4024f4175c930951d695512cb72abcc2c87d", "object_relation": "sha1", "Tag": [ { "name": "107-189-19-35", "colour": "#81DC5B", "exportable": true, "hide_tag": false }, { "name": "167-148-195-179", "colour": "#872435", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775542956, "uuid": "ea0f4ac4-221a-4e1e-b69d-44cf669f3b3b", "comment": "Malware payload (NetSupport)", "value": "94aa91fa52721894f2fb21028ed3c08de286d499e7d524916e844b441b7c99bc3ff2a5371829bf22da7edf81119453ac", "object_relation": "sha3-384", "Tag": [ { "name": "107-189-19-35", "colour": "#81DC5B", "exportable": true, "hide_tag": false }, { "name": "167-148-195-179", "colour": "#872435", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775542956, "uuid": "4eea441b-f9c2-4842-9565-4eddcb0a7d5b", "value": "T1DFA2D116B29C75A2FFB49AB934424A014FB3B84B53EB2490EBD0E9D9BC7567807C3452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775542956, "uuid": "c0122638-4549-451b-896b-24c59fdfba58", "value": "384:B2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSfNkbrxc:B2+x6TLKQXK1myQCSr2VS4jTXaRnPFMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775542956, "uuid": "38d6974f-cb36-4e37-ad80-7c85e175c919", "value": 22193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775542956, "uuid": "a63d56b4-93ed-4453-8ef3-5407286e7f8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775542956, "uuid": "e2243de8-94ba-4d0d-9d80-db6bdbdb0d9c", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6356c4-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552680, "uuid": "2ad03aa8-c6cc-4abe-b4c7-34cf1e4a81fd", "comment": "Malware payload (Mirai)", "value": "64911aafe717b1af0e6feef63ff8ad64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552680, "uuid": "51d1480e-d291-4b81-ba02-1f0155a20914", "comment": "Malware payload (Mirai)", "value": "35e04f7f7d7a2a7165892e2a2a63acc4b1c4969c2910b686bd9787064ab16d9b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552680, "uuid": "b614776e-e23f-4dde-82c3-e89a3faf70df", "comment": "Malware payload (Mirai)", "value": "4c3029d382cd7d106cf584669b070bda91fa4a0a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552680, "uuid": "921bf9c2-be87-4b06-802e-f9b02612c470", "comment": "Malware payload (Mirai)", "value": "c04b5af3d546e80d0aee0738475819ba9fbec9497c5ae9041ab843ae51ade61638f4dd75c111fd0ab22448239c90d385", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552680, "uuid": "7f2b0da4-b288-4db6-a74e-ee2ba0512f12", "value": "T1DB834BD7F410DDBDF80ED77B4463490AB131A39219831F3A639BB967BC321943966E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552680, "uuid": "edbe15c6-a4a6-49ff-b851-a5fd4089318e", "value": "1536:mEOAoGHPHg5HqZWaDX+aZ8oyCsFTNHFFaWonzs6N2uAQJSYh2a4rsvg:mEOAZHPWqcaDX+aTyCsFJiW6zsKAYh2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552680, "uuid": "63c1c15c-5b19-49e3-8f12-498e8492e4cb", "value": 85804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552680, "uuid": "87f0adf0-0c78-4307-96c0-65fad71fc586", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552680, "uuid": "b96909a4-0386-4c4b-ba25-6ba3c1a65d06", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30251a48-3268-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775555849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555849, "uuid": "8855b74e-7c28-4099-a6ab-89f44a469ec6", "comment": "Malware payload", "value": "89442341f1eededf4aa8fe5cc1ad9e3d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555849, "uuid": "af81b0d8-bd63-4a61-9136-c68e1fd4565d", "comment": "Malware payload", "value": "370930695b62e12ec28be5d3a85887593709df4acd68c302671f82da193f2e09", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555849, "uuid": "019ff331-0d1c-4778-9948-c73a27b0a926", "comment": "Malware payload", "value": "47cb68e19cafd6b619ea2c3d4520869896d29c8d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555849, "uuid": "10fb668a-14fe-4750-a82a-731662d80b89", "comment": "Malware payload", "value": "ca3be3ac0348956ce6fabf2dff597d52317792cb3d589b9f9378e6f92f4e3a5f40aa277702b1691911bcabde0d957dea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555849, "uuid": "6281fbd7-500d-4a9d-9b15-d66e5f3242cf", "value": "T11E64D086E3D60508B67B2E5996782548482B7BB22F2EC8CD14540DEE4FFAF48C573778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555849, "uuid": "cf5002b4-89c9-450a-8beb-9f290b5d52a2", "value": "6144:a7ofVPtXVMUS4pHUCZEDAiwyMsA1nb/GdaSHOSbpxCTJa1wD3XyosmF2w8:a787XHUC8wns0n7GrH5bpe0GbiPe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775555849, "uuid": "4c0b4ecb-c89c-411b-be7e-62d8d6204749", "value": 309064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775555849, "uuid": "60ab396f-c8ee-4b0b-81b4-efc36c58eb08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555849, "uuid": "6340af1f-4b8b-4f3c-9882-fdf9a28591e1", "value": "Bank Swift Payment Copy -TT7001772331888033383452903509007362_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58b54fb-329a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775577628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775577628, "uuid": "d080acc8-60a2-4383-8371-b7f811e75020", "comment": "Malware payload (Mirai)", "value": "ad2443fc969801a300518d841debf806", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775577628, "uuid": "1ca34c76-4aec-42a4-acae-c308918efa58", "comment": "Malware payload (Mirai)", "value": "38266e85097b945ca4abc1eb053fbe1dfba9e13b1b10c4a57e7dfa9bc82519cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775577628, "uuid": "6d478f04-2f36-4e32-b44e-901919e856b7", "comment": "Malware payload (Mirai)", "value": "ff08535e5a83a9a9181b29c1c83cf7b194d62533", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775577628, "uuid": "dee85256-8c24-47c2-a7d8-53a0ed1e1029", "comment": "Malware payload (Mirai)", "value": "1acafce28898b855a6011e28cb54a3ef493b8c66b4dd2913122dfceb6013940594b2b8f0793ee3782b66538d933088e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775577628, "uuid": "5da5ba8d-b1b5-437f-b872-f60ee64734b2", "value": "T17BC3284AFD419B02D4D325FAFF6E414933136BB9E3FA3112DD249F60238699B0A7B611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775577628, "uuid": "35c801b6-7fe0-46d0-90c4-749e43105eb9", "value": "3072:jTC4aYXRE95ciaK4zysAjppSkXmKa+0f1JIcXb:xMGiaK0ysAjppSGmKy1JIcXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775577628, "uuid": "76a5a2c9-9abf-41f0-be12-4ff91277cfb3", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775577628, "uuid": "0c0d3800-f000-41d8-aa04-5f8a64a141c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775577628, "uuid": "339b0e3c-7a06-482a-bdcb-990c77540961", "value": "zyre.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d01b68e-3269-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775556273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556273, "uuid": "7037c73a-e644-4a87-b462-37c488c40256", "comment": "Malware payload", "value": "bd3cdd41da620e9d28d93c4d39c8244d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556273, "uuid": "924c91ea-9482-4bb5-ac5a-5ea31558a985", "comment": "Malware payload", "value": "3836f5a09462558a918f4117ef9610d6440350792383811e37f4121ddaea71c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556273, "uuid": "2d693c15-6cbe-4903-94dc-89fe2a77a7be", "comment": "Malware payload", "value": "f714e614a19a0e2bb04c7721164dbd64ce746fdb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556273, "uuid": "2fe87401-27ac-44c6-b0f1-46abc38bf08b", "comment": "Malware payload", "value": "a06f674d12b40ac1922c8bfd4bb733c3783d4aa237a6080e9ba611e5eac12e22987a8f2815e7cc89a7dcaa346ac843b1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556273, "uuid": "033414aa-a5a3-429d-be03-c095a1096c21", "value": "T11265C826F660CA7698A0430DAF63ED776DCA301CA7A27D8BD391C4D4780DC3DD849BA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556273, "uuid": "3f83fa21-eaed-44c3-8c13-b66182cd5992", "value": "384:SqsgvoRqz5qLz9CWWkdi2ZY164QpcViyPx9rV5uausTsamayIbrbBuLZlvy5Pn7W:nBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775556273, "uuid": "e659decc-2330-4957-a47b-10637155854f", "value": 1544141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775556273, "uuid": "91672b5d-bb36-4691-bf31-7e315c00840c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556273, "uuid": "e785d7eb-3ccc-4cbd-9245-20e4d76387b6", "value": "Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b45518b-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554659, "uuid": "dcb74f94-f160-4fde-9fc2-23667d0d3c57", "comment": "Malware payload (Mirai)", "value": "efc23f223a647b848cb2ae6bdaeb78dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554659, "uuid": "55a2bbc9-e872-41ff-be7f-db88776ef39a", "comment": "Malware payload (Mirai)", "value": "38560878d6da281011c9e628f4c9cbf07075ea4da4b14d1bc35849f1eeee6aaf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554659, "uuid": "7deccd14-d8fd-41c2-839c-84b6169c6b25", "comment": "Malware payload (Mirai)", "value": "3b4ef62217ad543456afd063d5fe2a63ffe9f318", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554659, "uuid": "e48b473c-e368-4704-a19a-88697a08f97c", "comment": "Malware payload (Mirai)", "value": "fe15054e4c074af80aa594d7b250b95032d164206132076880a5a86ad57bfc5e0b2fb528d260d9d65865c63073c6240c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554659, "uuid": "201178b7-09fc-4642-9487-6e2e7f34a4f4", "value": "T14AF2E064D11C7DA5F3BE2EB02F8A798227A08DBF732CC652119DDF42673A41361189D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554659, "uuid": "8e3aa7bf-4ff4-45dd-9fc1-a93fc0909a8f", "value": "768:sk9hrdmlHUQ7yWGU4TUtU2V3ZMTS5s+fYHmM5Iyy4uVcqgw09F:sk9Nd6HWWGjAtU21ZMTSvnmy4u+qgw0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554659, "uuid": "645f08d9-bd81-450c-923b-d7786af44b44", "value": 34324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554659, "uuid": "9b89c5d9-36a5-42c0-a0d8-1fe163768e6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554659, "uuid": "9a465bd9-64c1-4aaf-b6a6-f844c6d8ffa9", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cb2cb0-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554145, "uuid": "1cc75a56-25a6-476a-ad25-68fd44543f46", "comment": "Malware payload (Mirai)", "value": "c1bc94cc0b5abd843fcc536006f09011", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554145, "uuid": "48beb5c8-2825-4aaf-b2fe-1c2cd03e8598", "comment": "Malware payload (Mirai)", "value": "39a357078fcff72267526a38691c5621fb5864834b2db50df9c0d0a815f593c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554145, "uuid": "4d02489a-09cf-4415-8ba8-d58db6f2e82d", "comment": "Malware payload (Mirai)", "value": "1a1056defd3aaadb93877bca1171082307dc26ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554145, "uuid": "7989fa52-89a8-4a12-abb0-27fb1411f8b5", "comment": "Malware payload (Mirai)", "value": "336ad8d738c72e6efdb81acec6cfeff3ba0a972d041712c900c2d1a40f85a4e4c1be7cb8f42328bda905f5b62ce56f12", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554145, "uuid": "7b7d48ff-748f-4330-9867-f3bae0caf034", "value": "T106F2E1B52249B47681F4AC73C960C7E12D3E00F5D4E537A01FBA82CCE1857625977EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554145, "uuid": "1af1771a-74ec-4f27-aa47-2d2c44e3b887", "value": "768:prFs5me135wp1C+s9vbM5YNMygu+OR1juP3ACqtqNLIzLtZ6G/vHVs3Uozq:p/eRSnQjMgVuP7qtqxgtAgYzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554145, "uuid": "1ec97199-cc0a-48d9-9708-3dbd69e2c9b5", "value": 36840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554145, "uuid": "fca22deb-4933-4919-abb0-210cc802af33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554145, "uuid": "8da23df1-8a4d-4fdf-a663-92a19076ff89", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811a8dc8-32a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775581325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775581325, "uuid": "9a98815a-4dd1-4e91-8f6c-9f87c36b79f8", "comment": "Malware payload", "value": "cd6e0c4664b5816d014f4fe808a00eac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775581325, "uuid": "aa1e635c-31eb-45e6-9eb6-840e30d88170", "comment": "Malware payload", "value": "3a3511aa0c7e42daa2b6467bdd6fd2006605c6a72667300ee3740df930be51d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775581325, "uuid": "768b9305-f96d-4771-afc2-43285345de9e", "comment": "Malware payload", "value": "2c0f230dd3b10452eef5deede09e8c72b35b291e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775581325, "uuid": "cf171e05-a4e9-4793-93fd-3cb7bb54f739", "comment": "Malware payload", "value": "d1cba477692148ee3dec2e95ee634650ead67e4bcaf05b4c0142a0f16f14c9767d0d281a53399affb44390b385a16d2e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775581325, "uuid": "3a579585-8cb8-4544-90d7-5fc04ecf3557", "value": "T11C06B3037BA48D26D8F9F3379B662E11B3A7B44C6F43D31728C4D79A2816342AD0576E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775581325, "uuid": "6a212b85-6780-4088-be79-93ed5ad63173", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775581325, "uuid": "4ee2b50e-3656-4021-a8d9-d2caa0fa3e7d", "value": "49152:SdSf/l+z0E098wgGkWBD3Piozy/pqqYLp3geEUFtJwXlZw77LQ0soNE8yiS6E+vP:Hl+OBDwhqXLp3hFtJ4wF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775581325, "uuid": "2f73dcc3-bab4-42fc-b904-202db6fe4dd4", "value": 3857728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775581325, "uuid": "21c82355-b30e-42d0-b6f8-13f061b48a16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775581325, "uuid": "1578004e-7368-4c0b-af9a-8c988fb1e459", "value": "07-04-2026-O\u043f\u0438\u0441_\u043f\u0440\u043e\u0434\u0443\u043a\u0446\u0456\u0456\u0308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a37347-32d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775600577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600577, "uuid": "2cc3d33d-f82a-49e7-b412-1f7ddfe59722", "comment": "Malware payload", "value": "d5bf7469863096ff14e63cf462d4d1e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600577, "uuid": "cc31f083-6c0b-4749-824f-19d954411f87", "comment": "Malware payload", "value": "3a39371ec2159897202d4711af93d6fb8bc6512733aeb2891d5f08a35bfd76ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600577, "uuid": "7fd73f46-4ee3-4a3a-bf29-7d96c46fa90b", "comment": "Malware payload", "value": "ff59d9dd7d687ceba712da364b72912011fdc918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600577, "uuid": "e8f32480-9240-45fa-8b51-6d3343f454a2", "comment": "Malware payload", "value": "355cf08d2f9c8d3561006ac93c295eccfcf7826324ca6e7822ba26e8fe6bb08d5fb264e98a67816f7222be6530873209", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600577, "uuid": "0769a0f7-9889-4b33-84da-9a44e6dfe427", "value": "T157330A8ABC82851BCAE022B66B1F5288336346F5D2DB729BCC494F79575B54B0E37F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600577, "uuid": "8835b654-050d-449f-8ffa-9d5a1b569186", "value": "1536:ZdBNvYlX+7XLkJq6myu6v7/mqiWIHkB4JOWaryX+mu4zZX26zcgLseiJudZdWzRm:rUJf4QuNw936", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775600577, "uuid": "60b38b30-22a6-4cdb-abd0-ded2415564d1", "value": 54888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775600577, "uuid": "2340fe3f-f65d-462d-a3b4-9fd6d988f323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600577, "uuid": "944f465b-e1f9-46a7-b4bc-adbb3d4164db", "value": "zyre.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1debb43d-329e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775579011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775579011, "uuid": "88598c8c-95bf-4d09-894f-56e117b89eb2", "comment": "Malware payload", "value": "cc13e71a71ad78e2b225ad909bdbf719", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775579011, "uuid": "cdb08be3-95af-46fc-a9c9-c6fb2b593967", "comment": "Malware payload", "value": "3b839437e2566cd93a0d06fdc5b1cbb5c8f8ca85effb5c17b7ca5af412bdbc61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775579011, "uuid": "4e9f5e64-e5f5-4eba-b019-e5edaa8e3617", "comment": "Malware payload", "value": "d455d7b74d26f63e03ebc1fda9714ed7f8dd1faf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775579011, "uuid": "4b7a2d5c-a6f5-42bb-9d12-e78511a1bf0d", "comment": "Malware payload", "value": "6e6cd93a85e19ee2c846f659f45b8d7d0cf0b6dd9261905e550c3536b05fec663e8364690d6d213f1a40b410a3d7630c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775579011, "uuid": "ed8367d8-a32a-4635-ac46-dde5f5b0e23c", "value": "T19F23198ABC91C61BC6E022B76F2F9288331203F5C29B7657DC1A4B39666755B0F37B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775579011, "uuid": "3685f4a0-461f-4ff0-b5ac-8b153e2d3220", "value": "1536:etMB4LifaWb198SB7Jdogb5Yk5yZGleO1XLfTuiqJl5/2IXe9AWwvzRSmP6:Wu4S11exL9P6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775579011, "uuid": "495741fd-f6b1-4ca8-9ecc-7f634cb93e06", "value": 49200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775579011, "uuid": "cef45b51-d0b4-4a18-9653-27cfbe3d8064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775579011, "uuid": "21cd8f5c-7d92-47d0-996e-fd0b367fdb73", "value": "zyre.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b5663d-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553180, "uuid": "b66fe299-752d-463a-aa5a-b70017dd469b", "comment": "Malware payload (Mirai)", "value": "5aa8fb4f499c39be9c0350d6d7072b26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553180, "uuid": "fe2ef855-7f81-47e1-8839-6d6b7a936b84", "comment": "Malware payload (Mirai)", "value": "3c6fa61f90fb0ddfdd0459a845cc1c739dd64b0b6caf5771784ec2e3b96c98e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553180, "uuid": "525acd44-d4df-4c52-9ad7-6482a27d1896", "comment": "Malware payload (Mirai)", "value": "509376736083bc79ddf52bf30da8f4120ad754e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553180, "uuid": "b85db38a-5edc-403e-8d44-bcb823cba70b", "comment": "Malware payload (Mirai)", "value": "26aaf53cc8660034f5ef684ef10440c95f5fa3133846dd7b3160de4deece3d0d7da0ff0bb8ef0b8b734067dd91b1a52f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553180, "uuid": "abeb6a01-c900-4d13-8fa2-a99db8588e82", "value": "T18F234CC5A447D9FCEC190A752177EF319AF6E93F109CD983C398AD72E942602E5072AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553180, "uuid": "14accb84-b70f-4f88-94e4-59621c8d3c58", "value": "768:Ii+liNWE5NttVEi4Ws5BkbVTco8US7KwWfd/046SDZkVKI:IiK25NttVEi4WszsVTcIwWV/046OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553180, "uuid": "8bdf7b2e-b81d-4e0f-b05e-bb7703d0fec0", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553180, "uuid": "c1f6a9c7-80fc-43c6-a015-58a44b560505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553180, "uuid": "b9c1f052-c6c1-465b-98ef-131e762e78b5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e5ad48-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553169, "uuid": "623582f3-c0b7-41e6-a674-712ece4fa277", "comment": "Malware payload (Mirai)", "value": "0cb65c1a5d09f9bf3108a7392a38a564", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553169, "uuid": "ef303510-1c4b-46ca-95bd-3937e290912a", "comment": "Malware payload (Mirai)", "value": "3d6ca27624f5128baa479f83cd4516a67664b5c6180b06d0328cdcfb101e970e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553169, "uuid": "b4d508b5-b009-4712-916b-b8ff8d352865", "comment": "Malware payload (Mirai)", "value": "b5ee6d577a2cb21d1139c19783b2247193daf616", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553169, "uuid": "3f4293cf-6533-4ad6-9f51-80d8b7468b7b", "comment": "Malware payload (Mirai)", "value": "9d661f0ea06ee82f277d42cd2cf1d8fd4aae05c31187dbc0f3391923984f64698a00c1bc783a81ef8c28a25a3c038a61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553169, "uuid": "af73bc0c-1c21-4726-9b7c-cd13fcadda59", "value": "T1BD639209BF611FF7EC6FDC374AE92B4525DD641A21A83B397930D818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553169, "uuid": "9672dd45-0aae-4ac0-8c21-03728adda34b", "value": "768:CDScD5GY2naf8i2Sxt9yYExR15IaI5vTemle5Re5brvuX5XiANe1j9bE:CDSC5G9afb249FKDI5fl8RWb7Sq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553169, "uuid": "eb6a26fe-c076-4a90-a4cf-2901cd6a2776", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553169, "uuid": "d6f14a4c-0ee0-424a-aa6c-37908a13b49b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553169, "uuid": "4ce0fdf4-790d-40f4-a0ce-96cc4f8e4af7", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da140171-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554845, "uuid": "114ad031-68fe-4b3b-8417-cafd264e8960", "comment": "Malware payload (Mirai)", "value": "2d538695cb1d824307cb663f19d047d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554845, "uuid": "ff86bed7-8167-4320-8020-03ef608355b6", "comment": "Malware payload (Mirai)", "value": "3d9b580ea5ade122c84b78cf430ef0f7eaac90ef9460dac74012162dedbb965c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554845, "uuid": "de39a1f9-adf1-4f6a-93e9-fc4df695205d", "comment": "Malware payload (Mirai)", "value": "9f8c96dc0cf949d13bf99acd7cd209a37afca083", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554845, "uuid": "7bf200bb-b569-4f25-8a09-2b8130932f1f", "comment": "Malware payload (Mirai)", "value": "362b984641c2d1f2b2c2c0ff6c7a1e490265920621860260ac4db61d552a048510698366383265714610a2edf116c154", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554845, "uuid": "fa16246e-080f-4370-b311-a19eb65eb737", "value": "T18C633B02B31C0E47D16359F02A3F27E183BFA99121F4F689651EDB869276E325186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554845, "uuid": "cae434d6-cebf-4839-9605-1d16dd75958b", "value": "1536:9yJWBrmSTKrF/T2GwITdHQ7+uLxWDeIQS5A16BH17Qs/nXB/:04Ox/T2K1vDeIL5xrB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554845, "uuid": "d65c9fc0-4a05-4d73-b4c6-db0613bf551c", "value": 72700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554845, "uuid": "67bcc55a-149d-46c3-83a4-71fe01e3af97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554845, "uuid": "5ef2f99c-007d-4324-a5a5-e6003c33f105", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab25317d-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775562068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562068, "uuid": "9cd28138-ce02-486a-82bd-c406e341bf2f", "comment": "Malware payload (Mirai)", "value": "7332c9ccddf30d47c3978a896f3082cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562068, "uuid": "263adc3a-0c83-4251-9edd-7fd5f7c0b143", "comment": "Malware payload (Mirai)", "value": "3da527816c7464a2db2e65f8993378b695d914a98a98b9fc730397c2669417ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562068, "uuid": "2726e9a4-4399-44e1-a520-9e9b3a8cb213", "comment": "Malware payload (Mirai)", "value": "02137836b785c307f632c7ab39c229f0bc113307", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562068, "uuid": "b5965c2e-6b4d-4a0d-aacb-aefd464a39b2", "comment": "Malware payload (Mirai)", "value": "c56270b4f54d5b7a23b2ab0c28956c6c0de8ecf20ffc765d609e3952b18c03cbf5edc94a7a0eba94d8720fbd0e5aead4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562068, "uuid": "8d0d369f-1ddd-4309-a09c-7beddb8a8723", "value": "T1DB544413D9158895E5648CF222773285AC4783BB89E732E3ED5B49A1FF2141F42BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562068, "uuid": "c2e17e2d-2649-43ae-90cc-6f631c9b1768", "value": "1536:OYCsrwmXZnnBxR6odCif7AdUJ4C0jhGBHjHejTstmGbLcZNHjIYRB:OYCewmJsqCq864xhGBD+joCzIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562068, "uuid": "17fb8300-32aa-4e49-811c-f6dd01c808ee", "value": 291736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562068, "uuid": "9edb21fc-d55a-4fa4-9f95-5098db468de1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562068, "uuid": "f6e6d8d5-ac85-4edb-a1db-b84b6e4a7463", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea195aa-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553001, "uuid": "f7357015-a280-4982-901c-3aa75a01beb9", "comment": "Malware payload (Mirai)", "value": "1bd1c749b81530b1e110e2fa1eaccb1f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553001, "uuid": "1fab7058-3f59-40e7-b45a-a67453f657a5", "comment": "Malware payload (Mirai)", "value": "3e28ee17d8fe296bca2cb5929d25520f30d4e2fd3c965b8f2218fcd5a7e766bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553001, "uuid": "814b4700-7921-4ab9-a43d-8763a5dbd321", "comment": "Malware payload (Mirai)", "value": "c1871ce801095b185125ba9632195c6a47a3fd8e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553001, "uuid": "0cc4c69f-e217-4dd8-93d1-101dd3b44f61", "comment": "Malware payload (Mirai)", "value": "06aa8301da5d31283fef4eba51ecbf3d71bc9a83e9df4187f51e57c5d5d34e70122c27424f019395a82570192f28f383", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553001, "uuid": "89f9b644-f621-4909-8184-583c9001e6b6", "value": "T1EDB2E05113E61C63C7745C3F94ED90C863179DBD92AB79F266021BE8272923B2834BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553001, "uuid": "7527c501-84f5-4fc9-92b3-f08edf1e3050", "value": "768:JL9C9E+kqV8sMu6fLX9ya2NDdUVqbDs3Uoz9:JLM16fL9Nc+Guz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553001, "uuid": "fc82cc7a-45c4-4df8-8ac3-3b65ff91d1ea", "value": 25364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553001, "uuid": "7fb802bf-f041-4ca3-a4ca-b7d76f98cdd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553001, "uuid": "13036833-8012-499f-a0a4-c11968c63bcf", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7964df9c-3237-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775534926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775534926, "uuid": "a3d33fe0-1e60-4836-9359-49c3652bac9c", "comment": "Malware payload", "value": "f7275a722c4e0795f4ff9fbe08b9c47b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775534926, "uuid": "dcafe637-f174-49ff-9d3b-8d674dab1ec8", "comment": "Malware payload", "value": "3ec5bf88e94df0791164881e6f004a76b576021ead84ffda2629ade07444ba28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775534926, "uuid": "50d3a59e-fe03-4330-b358-9697c8d6bc26", "comment": "Malware payload", "value": "fb159633cb2dfd3d883dfbc374cabf24a5bbd951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775534926, "uuid": "73f410b5-5d74-487e-a036-baf2c55bd703", "comment": "Malware payload", "value": "15808e372bfcb1e2a12b1566159471e5acdb2227e69d23e0b79cf2baf0a8b71005d67472e9e40b4239497514fdc2d529", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775534926, "uuid": "003a5db5-c502-448f-83f6-3181cdb2aa75", "value": "T179155B42FB1C4523C9470EF0593F53D6F7257A4241F9922A370EAB672621E3ADAD3389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775534926, "uuid": "1dc30a9d-5cd0-4b2c-be45-e42b52c2a515", "value": "24576:aqRsSjGDH1Ozyu16jV2qIjZQb6dITRYh2FNU0t3:a0sSjGj1wxEjV6jab6WRYoFN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775534926, "uuid": "34836a9e-3db1-4685-97f2-4c9b3abafb2b", "value": 927852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775534926, "uuid": "70888e8d-3874-4ad5-9018-d6dfe652c25a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775534926, "uuid": "aae54325-dc74-4cab-be3d-077e33441384", "value": "clientppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b89c2b-3291-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775573654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775573654, "uuid": "5ce2b032-df9b-4bc4-a8d3-b457798b5dfa", "comment": "Malware payload", "value": "92e2fa47f9d1af27bfafaf175c8e469c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775573654, "uuid": "89c6151f-3d8a-47af-a67b-8941b67edd3c", "comment": "Malware payload", "value": "3f58cbca5a36bb29c75d4caf2dc72b096b1f99ad5c0c55dc960953345a5b31f6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775573654, "uuid": "2b1e1d11-cde9-4d30-af0b-8c88b93c06a2", "comment": "Malware payload", "value": "c64fc0006ec9923b973285f4b7a06cffb70a6398", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775573654, "uuid": "7e69c16f-c0a4-4dcb-b952-1d17487e7efb", "comment": "Malware payload", "value": "26f92a643d79369efb1cccf6deaf3f2293ea09381bd62ea3c2e9b89d98ae77025be53d6fa3e3cd4f3391cedbde699691", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775573654, "uuid": "425bd851-bf37-4dd8-bed2-69693d4d16a5", "value": "T1AE64BE11D7FD1108F5F26EA4AA7E59489976FE6B1D0ED1ED05420D0F0A72B0889EAF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775573654, "uuid": "c27d1449-c209-48ef-a116-19adb8585a06", "value": "6144:2pZFMwMnZFu/d+UHzHXRy48d9dbiMSPwiNk31XUhDCpAK2J0NDufSpe9N:2YFxUHzGdXbhSPs3WC2Pw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775573654, "uuid": "85cff737-05a7-4e24-a5b0-28a06c4f5a55", "value": 331078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775573654, "uuid": "a3d65cfe-904b-490d-84a4-33c4d3a1df15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775573654, "uuid": "74158da7-4ac6-447f-b008-23b056b8e8ad", "value": "SKM-493107475.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f83371-3275-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775561675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561675, "uuid": "cf8f2a7e-1598-4a1a-8517-4e689e5612a7", "comment": "Malware payload", "value": "7e697130d311f1050863c88f52afee91", "object_relation": "md5", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561675, "uuid": "e04846ce-c34c-476f-8bec-71701b067fb9", "comment": "Malware payload", "value": "3f83097c49ddc5280cc5d79c88e91e6385dfb85402278a1b9df4973cb0a161d2", "object_relation": "sha256", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561675, "uuid": "552844f5-2643-45a5-8284-0ae2b6421410", "comment": "Malware payload", "value": "0304bf425f19c092a9f3b8f2c1deea7db87c7850", "object_relation": "sha1", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561675, "uuid": "1030f13a-9133-4c16-a2ee-11ba1541562c", "comment": "Malware payload", "value": "871cd1477ab18112767031ca72be9ce3a3911299ed3a40bd4949e47dfb261ee0829bb3d0743f64d72e96421561b4e87a", "object_relation": "sha3-384", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561675, "uuid": "72b1bee0-4f1c-4daa-b070-1db3c466375e", "value": "T17165338EFA65A174C605B7F196520F48BB78DEF9D703105229EC79EE8CB2DC2D822C41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561675, "uuid": "59cc3d66-f8d4-4186-8f2e-86a12ee080e2", "value": "24576:+CaeC+O7ZWnHVDRb7ozvkk5QTDPQaFB1gChjgejzuD7AL9aPmnNVEmPEpA3QeXRK:+FZWnFRbnkUFbxjgUziAxaPmnMaEu3Ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561675, "uuid": "04654a15-151c-497e-bd7d-0fd46acf5d68", "value": 1462272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561675, "uuid": "b4602387-dda9-4bb7-8f91-6945c025400d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561675, "uuid": "1e704396-67d4-4556-92e2-a49b25c9f5f1", "value": "3f83097c49ddc5280cc5d79c88e91e6385dfb85402278a1b9df4973cb0a161d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7043a6a5-324d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775544360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544360, "uuid": "94fb667a-8009-4d32-b83b-6c0038718ae6", "comment": "Malware payload", "value": "b270010b8b4f60fbc8fd1b35a32f1b14", "object_relation": "md5", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "studiogioeli-it", "colour": "#3B13C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544360, "uuid": "165b0c40-5aa3-407a-98dc-e1dfdfc8bfa7", "comment": "Malware payload", "value": "3fa10b8d3a1f5b9821ad4dada3d29528e0918386916661f80ff747774964f319", "object_relation": "sha256", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "studiogioeli-it", "colour": "#3B13C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544360, "uuid": "14d0f8e2-1e0d-4d0e-8770-5b159d770f1b", "comment": "Malware payload", "value": "aef321a82df49d48c6e07860f46b3a6016e9b4d9", "object_relation": "sha1", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "studiogioeli-it", "colour": "#3B13C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544360, "uuid": "87bb802d-642a-4d92-8886-fd2ee58620c6", "comment": "Malware payload", "value": "2c5b92029915766700cca59601afa8be0e2c515b536c6f62c09d7d161cb0c6b60c25935e4058724fe654eeb2825b97a3", "object_relation": "sha3-384", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "studiogioeli-it", "colour": "#3B13C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544360, "uuid": "90da3de1-920e-4316-ad80-689897c1e7fc", "value": "T1DC8533BDC10CAFC58FA9B725CC189AC14EB04578E818AF518DDA9150BE990B75E3E783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544360, "uuid": "6a3d4ca7-9489-45f0-ab0f-1b61164ef6cf", "value": "49152:dKqJkLTpnZJwgCAKfNvbNNZbHM/X/DudrbBIRUFjoya+ZSS:dYNZJwgCfNvbNsP7udrbmRU9okZSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775544360, "uuid": "95acec07-80fc-4229-ae76-dd284f4623af", "value": 1844738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775544360, "uuid": "d4bd8997-7578-4aca-be17-32c637509681", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544360, "uuid": "18aec1ef-d8ba-44be-8ad5-ce42689be2a2", "value": "MSI_095306.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4048c685-3266-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775555017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555017, "uuid": "e63814c2-5097-432d-acc6-9e9205c13616", "comment": "Malware payload (Mirai)", "value": "d901523b5ec7bfed746b347f64014084", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555017, "uuid": "1f410b2e-8e24-4c6c-89d6-1bbe72820b3c", "comment": "Malware payload (Mirai)", "value": "411532d1bc84f5305ece817116fba6f6ef2c8d68e2e7c6e037dc74874f2414dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555017, "uuid": "8c78b242-9c5f-441f-a1b1-53afadecf3bc", "comment": "Malware payload (Mirai)", "value": "9ee258758ad679d52ed6b58b7537e92e3fb208ea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555017, "uuid": "6231563f-6175-4c2e-bc8d-e7b6b329ae7b", "comment": "Malware payload (Mirai)", "value": "1a04a7a334cb5e289245bf619d50865dbba4b07e99c9196700d4cdf2cb7ff932439bf5da3cf0c595ccd724822e397d11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555017, "uuid": "ed6e0c3c-e5e5-45f2-9b0b-d326e9e638af", "value": "T16724D70AAB610FFBD86FDD3702E9070139CC554722A52B367674D928F54B64B4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555017, "uuid": "9e28b6c3-5cf7-4fcb-90ee-62ebbb476dca", "value": "3072:ySVheAzYmWpR2l/m3Oil0MOOUmeBOW91nBIAX8oOSr1:ySLeAzon2lMOcOOSIW91BJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775555017, "uuid": "9037d809-7f03-4664-9387-edad09a3c215", "value": 227276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775555017, "uuid": "d82306ab-6f6d-4db1-861f-389ec0118808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555017, "uuid": "95b39c29-92fd-4cc5-828c-158600c6ef9f", "value": "rebirth.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec290fec-3273-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775560888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560888, "uuid": "f95e2a1d-13b4-42f9-9409-54526080932a", "comment": "Malware payload", "value": "5c92f0a474846a8df4aaff5c3b16af34", "object_relation": "md5", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560888, "uuid": "c5ff827a-c16e-4d7b-80cb-752b50a1a842", "comment": "Malware payload", "value": "42c3b9cad6c8383699eba4f82d51908c0d61e9ea454bc40447cf20475ce20ff0", "object_relation": "sha256", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560888, "uuid": "17e71285-8709-42e4-8023-cc9a80b9d854", "comment": "Malware payload", "value": "cad73d8b5710c0784d95edd6766b0bfdb0fd7382", "object_relation": "sha1", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560888, "uuid": "6bb1672b-e7e6-4d58-b863-3e9a74e7b3fb", "comment": "Malware payload", "value": "231933ed3f88ec32122f8f8b8aceed88dfda31aaa4ff8240dccc0ad2d59ca35ecf216d819710164e09e65124f78a0dc8", "object_relation": "sha3-384", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560888, "uuid": "c7f34895-9ab4-453e-80fe-3f2246258d17", "value": "T1EB557C5172423FFED7A06272F7FC6221075A2D100237A6CBA6C47F8A35768A37DAD461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560888, "uuid": "8c12ff32-3b28-4c43-b0c3-7c7189865eb2", "value": "24576:V4ow+nfLUoGKATCttcKYXd9vtfXIgTpCkt6G02mvR:tUTvItcbvtACt6x2m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775560888, "uuid": "264030f4-2409-4da1-a776-ce8cd926f5b4", "value": 1280946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775560888, "uuid": "04213bbd-345f-4c14-85c2-2bff8c68fe6f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560888, "uuid": "606a77dd-d687-4480-b0c0-8b5a0f6bd913", "value": "Information_Note_Elections_Republic_of_Kosovo_28_December_2025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f981d1-32a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775583396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775583396, "uuid": "1b484720-663e-4a63-9e1c-193bb6fe648c", "comment": "Malware payload (Mirai)", "value": "cce214e4814752db297c9a63f574d188", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775583396, "uuid": "b5a6974e-b59b-42a4-99c7-bcc51f6a5ef4", "comment": "Malware payload (Mirai)", "value": "43d75af7e645b2a3ead0008567729b59c2c628251880be53deaadfe95b5e2f6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775583396, "uuid": "0c45b3ce-fe12-4130-8c6f-2407fb177fcc", "comment": "Malware payload (Mirai)", "value": "bd7213a38b4e14c63d86eada7a5d459f16670b28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775583396, "uuid": "9353946f-8eaa-4062-8681-8b8245d03051", "comment": "Malware payload (Mirai)", "value": "b1db179acb39c10115b2ccb8f690782925eb720c44286f4b9f5415e3d2285398d04e241ae0417554eff4c6f24255427f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775583396, "uuid": "f15e15f4-1f38-4c21-be76-70c326d8da32", "value": "T1EC733C82AB03DAB3E95355B002B7AB326B31FD3B4931C586D764BDF3AD219D0621635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775583396, "uuid": "c486b5c4-532a-4ba1-b7ce-4b5a36b20815", "value": "1536:u9fYSkw2k7airCIVcsGOguDGmyHhvsYVPS44N7Oof8E3k7RZgi:kdkwX7XCXs9ehfb4R3fXAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775583396, "uuid": "07b37411-eb2f-4a17-9480-537b9e7cde5b", "value": 79916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775583396, "uuid": "28a74e70-c3e5-4c1c-b626-dd6a2b155506", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775583396, "uuid": "99a0bc58-294a-4fe9-8e33-cae67fd2fbb7", "value": "zyre.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f42de52-32c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775597669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775597669, "uuid": "b22fc054-390b-471c-a2eb-0b1a2a4790e0", "comment": "Malware payload", "value": "8e7acf2c1f69b732648a1a5124b67827", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775597669, "uuid": "d42b83eb-9671-4fb8-9f0c-579dddf82dda", "comment": "Malware payload", "value": "442ac74863b06548f0f42054169de1ac835f2082abfcc0698a0fe7acdce69d76", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775597669, "uuid": "866c8c5b-de2b-4ca3-bf6c-b2d19ff99622", "comment": "Malware payload", "value": "98fd17b5dbaeb99c29b1c78076bfcae69c669f16", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775597669, "uuid": "86414a6b-9db6-4d13-917c-7657fc64553a", "comment": "Malware payload", "value": "3c7102201e90425b0d157d8d3dcc0a501678924ace49c33e0aea3bd35eba86a15a76e94c0fe91c36f1caa91ee1e5f6a8", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775597669, "uuid": "f643c699-14b4-43cd-af20-ca12de36d4c4", "value": "T1446633106EB56CFAC67CC238946F0F1A6E615F958798E6DB03E215C74F6BB804C3B921", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775597669, "uuid": "ffec75dc-1e8f-4dca-9dae-e2bbafe4975d", "value": "16757a81cc3b4d9d6772492b84bb2f86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775597669, "uuid": "db54464f-9094-4f11-8c12-2dda2391d3aa", "value": "49152:jyzWmrPqtDEFcG8pWpvD+vHoItYrdZoOpdBjFfmmKAo1USe/6he8mChCIAmwrt4K:jG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775597669, "uuid": "ba86e55f-07a9-4dad-a1d9-a916407e1f28", "value": 7064576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775597669, "uuid": "b91f5297-d399-4d50-842e-4fd12a935322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775597669, "uuid": "0f4addcf-e0e6-4c11-b2b1-2c9c6470594c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b280f5-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553019, "uuid": "54a3fbe3-d23e-483a-8556-1c2fd0b1e80c", "comment": "Malware payload (Mirai)", "value": "9765a7668dc50fe91a11ef5cb5505f53", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553019, "uuid": "fa0917e1-6fa0-4582-b4bf-822eadf9a47b", "comment": "Malware payload (Mirai)", "value": "44c9a4585f04878df56e1b6debad07291b8a1dabe76103b29e2733c7eaa4da8c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553019, "uuid": "7a492b53-ab5d-4551-a27e-bb57fd77225c", "comment": "Malware payload (Mirai)", "value": "6ef05c7b916f217c97b9e50a740d19726002df58", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553019, "uuid": "d22b3617-d430-4c3f-9dc2-08efefb9687f", "comment": "Malware payload (Mirai)", "value": "d5791b5216de4373d8819bece5e399fc0969bdd2a2000cadfcae6a94687002a35550054eb17043fae765885469aadda0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553019, "uuid": "4c913120-368b-4b9c-a7f9-79a7469b1242", "value": "T1C2B2F11EFA848AAFC828D23C959D0F5DFD2A1465AF6B81A12400CE74C777216FD3597C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553019, "uuid": "73c05b8f-f752-4091-80d4-c2b86c4caf71", "value": "384:MXYwdbjcsRFyzxCbxn6NNW3JDTxMOjJ3vOwAFGNbwgMzHrwupNa99v1Rf:AYIbosXwYU2ZHh1ccwgaHcupef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553019, "uuid": "6eded9e0-4062-4a48-8c30-0bd3b1906319", "value": 24872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553019, "uuid": "05349f75-23ca-45ec-8dc1-a257d7b71c3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553019, "uuid": "7c8b7c68-040e-4594-ae51-378037f61cb5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b73d65-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554185, "uuid": "a8c2cd75-594f-41ab-9c5d-ddd84cc20d69", "comment": "Malware payload (Mirai)", "value": "2a0a17aea6477059dc05db5fb3edba44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554185, "uuid": "ded5af49-0381-49dc-856b-61932b6cdd9b", "comment": "Malware payload (Mirai)", "value": "44cf8a15273c5144695abe048ab3cba87d2c6ac22d06ff2b93da9f468b8abf99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554185, "uuid": "3b0046ef-52a2-43a3-94d2-1de2fc2f95a2", "comment": "Malware payload (Mirai)", "value": "0315f9701594ec00bf1606d085a476182bd85c5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554185, "uuid": "b4a48cd1-594c-49dc-90de-c204c7734a0a", "comment": "Malware payload (Mirai)", "value": "06061d0444d36ff718591e66875877159a63dd03052c639f63ae89fef96f325e5d25de8ffae68ba6dd0a7328f2189fbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554185, "uuid": "3a25ff7c-e4af-475b-b721-1b1919d0a5db", "value": "T12BF33A46F6418B13C0D61775BAEF420533239BA4E3DB73069928BFB43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554185, "uuid": "7f3da7ab-36f1-48a7-ab9e-e97ff8de70bc", "value": "3072:w0jlwv74BRae/xGPZ06v/mYp+C9T6MjoHDjyoM/9Rv03:w0jlwyRae/xGPd/z+cT6OoHDj1M/9V03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554185, "uuid": "65dfb514-da3d-4630-b7aa-e7e412476136", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554185, "uuid": "d1a6a224-1c19-48b4-a07e-3c511c18dd46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554185, "uuid": "e3bc50b7-b773-4311-997a-00eefb34bae0", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56838589-3240-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775538733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538733, "uuid": "e8e39814-4341-40bf-9096-6c5a9f540ded", "comment": "Malware payload (Mirai)", "value": "2a0c32580b8654decd9cf854658e9814", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538733, "uuid": "dfccad99-9df3-473b-94bd-d3aad1688c2b", "comment": "Malware payload (Mirai)", "value": "46643f1a9b858d57cb7a5c235c7f568ddf4cecffceedf72774712e6b7a095112", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538733, "uuid": "90629f83-9ebd-426f-b533-cb96eb6bf3a1", "comment": "Malware payload (Mirai)", "value": "13fc675373774aaf986af056bca39d298d2076e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538733, "uuid": "3a96946c-d8f1-47ff-977e-98f919bb8cba", "comment": "Malware payload (Mirai)", "value": "a808dbc0d1a8cbbc6922f89e720c8a0c7275b467f193cf8d5f3d763146fc76a0ab3113be639d3079e6e75804660575fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538733, "uuid": "9c68c843-c653-4cb0-a4cc-82e38e76df81", "value": "T1DC83F8829353D8B1E84318B001ABEB795970FE720534995BCF64FEFBDA339D26046768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538733, "uuid": "b8c5a6c4-84ba-4449-9f55-e4de6a0c9a23", "value": "1536:fhOfpPYxdEquID0+MsAFmYsv5TiIXJomTNSszkeCHixUxD31kcvo3HGZrV:pOhCruEgjxEdTI8keCr6/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775538733, "uuid": "3921486e-9419-4f3e-b70d-444f2c02c4fd", "value": 86384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775538733, "uuid": "c859cddd-0e85-404d-b709-d4d7e1e26beb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538733, "uuid": "958374be-d447-4746-a43c-07f20809548b", "value": "zyre.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8aa222-325f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775551952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551952, "uuid": "5cb0d2ea-79ed-40df-a7d7-3e39b6cd463f", "comment": "Malware payload", "value": "7b5362edb10f0b1a5f252fea4c5b2ca3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551952, "uuid": "ea7892df-3545-42d0-ac4b-e55745698417", "comment": "Malware payload", "value": "472d60a4002eb5a9f3e3b7125bfc5601035cfce229db00f620bb9b7f0e908e4e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551952, "uuid": "0d08f229-d37f-494c-b698-ca6fd482a2cf", "comment": "Malware payload", "value": "aca0c4f1a1eeebed86ba134d509ff3855cc0ff52", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551952, "uuid": "caf80356-8db9-4f05-a731-31d936c72edc", "comment": "Malware payload", "value": "b0e0f8b6ba922ca8df183018e583bd3576bb1079430ae6c2f27df31f703c7a4ab5d1908822473e22d9320a4aa8d42a75", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551952, "uuid": "6d6fec22-7034-49e1-a173-c8d24423940a", "value": "T1CA3166567C03CDDF436283AF251B01C591D8CDC19A9D84C2F118FC9878DA99D8387BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551952, "uuid": "ed6ad2c0-654e-4f14-bf71-441f98fbe3a2", "value": "24:4qhsB1dKL9yqlyqk6QwNlOMIl2u4fg6t682QTRQVDzRtWLfBAVPsV0Yf:WrsMqQqk6rlOJl2Lf2Q1QVptQZVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775551952, "uuid": "3eeb5088-7d6d-4573-9d13-8c64d6fada0b", "value": 1652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775551952, "uuid": "292afd86-b0fd-4fa3-b150-dd981ae60150", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551952, "uuid": "8d0c2949-f33f-4bdc-8266-6748bb3aa802", "value": "472d60a4002eb5a9f3e3b7125bfc5601035cfce229db00f620bb9b7f0e908e4e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0fb2e3-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554147, "uuid": "eff62439-cd32-4385-b329-812d8b50d980", "comment": "Malware payload (Mirai)", "value": "b6bc8a81ab52f6da23fbd362dfacbc53", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554147, "uuid": "1da8735d-7cab-4cef-8c31-5f7ec3c32242", "comment": "Malware payload (Mirai)", "value": "47562282bdd1f2fe80b3c3bff6083b2551f1664b4ab2b178bc8291983f7cd107", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554147, "uuid": "e0507bcf-d7e3-4839-b776-88f9edbeddab", "comment": "Malware payload (Mirai)", "value": "8bb5c8054a1f0b10626b902bcadb22a6e6312bf4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554147, "uuid": "bdfe9f09-45c2-4b4d-a0e2-d39b4ddda688", "comment": "Malware payload (Mirai)", "value": "2c08f5cabe5688a7c5525c7f8d4dd6117eea62967b94864bfb80fc99d69ab0535200db03c1593a0065a859f252eb8cf5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554147, "uuid": "f8dfb3b4-160e-4b16-b9e1-43ba34737822", "value": "T16003E13D4A0904F4E57BC17BE2ED47A07536079A5542CE062250F6A7E60ECBC78A2AEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554147, "uuid": "02bbbcf5-47ed-404b-a62f-25e5dafb2b04", "value": "768:cgN29x3ZpzZ5VjNuvtE54Fe7GbxBDbYsPs4P5owRJJgGlzDpbuR1JW:q9xJZZNKNFjBfRUMGA7VJuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554147, "uuid": "ca1e48b5-168d-42dd-aa76-87179eced1cd", "value": 38076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554147, "uuid": "5cdc36ee-3495-4d34-8ae1-8043ac7fe975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554147, "uuid": "82a13c18-8753-4860-9f34-91a7ce5886ec", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb5b93f-3266-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775555014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555014, "uuid": "73708acc-19a5-43c9-a2e3-2571a6cffa3d", "comment": "Malware payload (Mirai)", "value": "ce11ebc1f079276e425fe021257d522c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555014, "uuid": "6e311103-220f-4493-a74c-413ab3c19850", "comment": "Malware payload (Mirai)", "value": "476edcde32262376aca8b218e3d62515daa48974c116f3613709b6faee62446f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555014, "uuid": "db9ed27a-4639-4d57-aed8-a7d8f8938e6e", "comment": "Malware payload (Mirai)", "value": "82df7714cbc550005b3f492e4660ee156047de4c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555014, "uuid": "a7212ce1-b093-42f0-83aa-2d7bac167dec", "comment": "Malware payload (Mirai)", "value": "7f230443b52ae5db7ffe0ef2d5f3d02fc4d3b205ff15a69c36fe0841ea6ef8da44140a829fee610bd43e6885e6f233a9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555014, "uuid": "7537d529-50c6-47af-a890-de2e6c410203", "value": "T1E724A70E2E228F7DF268C73547B78A3597AD33D622E1D684D2ACD2151E6034E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555014, "uuid": "7bdf9f81-81e0-4e08-8543-9014a7a45215", "value": "3072:Wc6qANIMErR6ntbT/ESAgFPqhxMbscPLRH/AYCw0v1i6ftvGbG1Wplnz5Y:Wc6qzJrR6tXMSALxM7tCpVGsW/nzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775555014, "uuid": "3da92c64-d129-4af0-8bfe-8389737a2dc2", "value": 224300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775555014, "uuid": "7b81822f-2926-473f-b245-d499115d6061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555014, "uuid": "70bdb341-0251-424e-b5b4-c025328fdb8f", "value": "rebirth.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f72dc9-32d3-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775601929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601929, "uuid": "31802fec-5697-4cd6-b342-0187adebd108", "comment": "Malware payload (DCRat)", "value": "197388e701a8176640a9428773cbde32", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601929, "uuid": "0d77f94f-25ac-4a81-8ba3-8f3f7df728dc", "comment": "Malware payload (DCRat)", "value": "477e8922be3f9739af45f9a62278caf495bdf54abcd15521d913aa1f9ff44bc4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601929, "uuid": "74716078-9303-441b-91cc-9e949aa3ff3b", "comment": "Malware payload (DCRat)", "value": "add4dd601da2f309df2ddc5ac86cea3e160bd391", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601929, "uuid": "569fae55-ae45-4e25-93b8-765934d0e519", "comment": "Malware payload (DCRat)", "value": "94c109fc0ab4424fca3319f1d8acf2d64f4b7d70df899c40c549240b70036b4945be3bdfb2d72bc057a7f1a6e46e914a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601929, "uuid": "19da6a8e-3894-4a5b-bad2-d7d1697aa52f", "value": "T155355A027E44CE12F0191673C2AF450447B0EC516BA6E72B7EBA777E5912392BC1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601929, "uuid": "309a5073-a928-40e9-848a-9fdae5f651bc", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601929, "uuid": "3b4cedbb-ec01-4e50-b35b-82e743ec5369", "value": "24576:U2G/nvxW3Ww0tVj3lUxcDQimeXCyyWUMfg+Vpp:UbA30FrD1yyy/+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775601929, "uuid": "fa4aa03a-9ebc-4d6c-8d41-4951f8dfd4d6", "value": 1163894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775601929, "uuid": "0b757ef0-5679-46df-b5fe-0e866df6d003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601929, "uuid": "5dcb7e4b-c54b-4a61-87eb-60096c4ca1dc", "value": "197388e701a8176640a9428773cbde32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4986bd12-32b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775588962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588962, "uuid": "10c429bb-9f37-4ba1-a756-f4ab95772508", "comment": "Malware payload", "value": "f6116906a81aa2222098586b7d360c91", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588962, "uuid": "8687b9c6-f9b4-4541-a393-cd31ce13398f", "comment": "Malware payload", "value": "47a9df1e4996d85028c465e9d943f3718578a5e1630ac08598600f9b5db5cf42", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588962, "uuid": "e0f3a3f9-772b-4e45-976d-e1f7b9df7312", "comment": "Malware payload", "value": "d9d9605321a4230eb1ddcdf2fc2b73051fd9db24", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588962, "uuid": "6d7a652a-05df-4bdd-8d53-d72dcfcb5bd4", "comment": "Malware payload", "value": "3ada0157de3aed7cbe47a330cad51300474d23c729868f874636458d04e4fbc46d624fed9877e64d4a4c2509d3e6f69a", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588962, "uuid": "9c773c6e-c565-4155-ad39-ee0bceee5843", "value": "T11DA63318B9962A97E58DD2B096036B395A787D731B575331089CBCADCDBCFE782027C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588962, "uuid": "f6cfaf66-c2a8-458f-849b-5f695faad028", "value": "196608:+krdT/vHevSDFRszeFlBXMG1+hSHNHFcdjyIfDEWczcdHfWw3285dXIff7rA:Bfxko/XDqoOxjDEWczGP285dYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775588962, "uuid": "f524ab05-dce2-4ead-8435-0a2950cceadd", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775588962, "uuid": "81594ada-87be-4e9a-bd2d-b08b2992708e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588962, "uuid": "c3e44d17-4de0-4a42-baf0-dde5b73d6a5e", "value": "PGWXEIBP.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797582cc-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561985, "uuid": "b3cc3980-edbe-4e2e-ba9b-072d70670f7b", "comment": "Malware payload (Mirai)", "value": "233086bc4961ab9224482a07b48fa298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561985, "uuid": "4e0308ce-9742-40e3-9a5f-5f69da4ac930", "comment": "Malware payload (Mirai)", "value": "488a2e54e37d1d066e42ae8978172608434eb8fcab8d2ca990bbe4c8e87bb21f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561985, "uuid": "07a3871f-18d1-49e5-b13f-35b0eda16946", "comment": "Malware payload (Mirai)", "value": "188de691d82b53b1572407474e37bfc43e42ef97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561985, "uuid": "b874bc9b-5180-41bf-83c2-d3213f159f9c", "comment": "Malware payload (Mirai)", "value": "12810b04f6793587e317bc45d1a7bb758a4ad8c11c6354361a68f2a65067efe60f66b26eb339bcc00df6395e2a7f4654", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561985, "uuid": "c4aa481c-6691-41a2-8f51-d34c047f850e", "value": "T177830294D149B4A1CADA4E72F0C601D3DE5864C2B5B98FDCC7604AE4F714EAFB96E01C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561985, "uuid": "0c844669-8bd7-4a5c-babc-a025f97258c2", "value": "1536:Yd3Ogp3QlPOKHMexiFPZHvaH6dWQvUQhqJk0TwSXkxI7u1HvmnAxi3lbl:Yd3zEOcsJQ6dWQMoqJk0Tw8lu1Pm9Vbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561985, "uuid": "fdf9e909-6e40-4dc0-b566-6d2233609f1a", "value": 87216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561985, "uuid": "5382dea1-851e-4d01-a9c3-da17b651e88e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561985, "uuid": "71702aba-0968-44de-bfd8-721c5e9fde80", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bdc16c-329d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775578564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578564, "uuid": "d0a73133-649c-4c82-ab13-f9d81ac2dce2", "comment": "Malware payload (Mirai)", "value": "2a062b1f7d758918a9a7000ed72b4233", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578564, "uuid": "9aa830ed-1758-422c-8f2d-a44c9d9a75a2", "comment": "Malware payload (Mirai)", "value": "49dc960bc1ac0746d2f2b6879499c13b33eac3f6fc2c57c8850d437f5fcf4cae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578564, "uuid": "376b3d8f-8bdb-4d62-a40c-a1bc2714d6cc", "comment": "Malware payload (Mirai)", "value": "03725f29ed194a0b1edff8c5e657664a505e6aae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578564, "uuid": "23dc4ce3-d92c-44fb-9e48-9a962dcb6954", "comment": "Malware payload (Mirai)", "value": "a6293ccf496cf8ac2047603d36813253ad1972eaa96153a22e39f04f4f34748837c6191ec17ef8c39a3aec16b7ec13b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578564, "uuid": "458ad8fa-0daf-409c-bd5d-17a5c4dbcc29", "value": "T15CC3294ABD419B02D4D325FAFF6E414933136FB8E3FA3112DD249F64238699B0A7B611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578564, "uuid": "da51c93f-8744-4cbc-a1b0-9a2ecf82d2c0", "value": "3072:jTC4aYXGE95ciaK4zysAjppSkXmKa+0f1JI/Xb:x1GiaK0ysAjppSGmKy1JI/Xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775578564, "uuid": "e56261f7-5006-47ef-9c9a-fade0638d601", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775578564, "uuid": "42257615-3b89-4249-b8da-9961a9f10c5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578564, "uuid": "0be03393-4039-4d1f-9d57-4ed64e3bfe97", "value": "zyre.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14af165-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775562132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562132, "uuid": "210aebcf-df99-4a59-bf7a-c1577eab90f2", "comment": "Malware payload (Mirai)", "value": "8ddddef5df6204245a51d22bf95e2bfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562132, "uuid": "eb154317-ba1a-4fd7-828a-f9fc64fa0bba", "comment": "Malware payload (Mirai)", "value": "4a0a32258dc4d1b68a1db743b8f6443982d541548b02cfd2060e690a38b03faa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562132, "uuid": "61e1b13f-b99a-4d0f-81f6-ca3dc8af1380", "comment": "Malware payload (Mirai)", "value": "4985f68c478c6487aa994e26172c713c1e0c6c9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562132, "uuid": "e7110706-7095-441d-8dda-bab851cbf330", "comment": "Malware payload (Mirai)", "value": "d2f88df4bc168cb953120fac124f2c8560ec023ff6ead8dcc271896ad30c787b1a0974733ccde9b265c7f14652e09473", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562132, "uuid": "5f353f7b-971d-44a2-83d6-95d9b472dd0c", "value": "T18B94A6179D228A68F1248CB213773241AD4B53FB49E261D3EA6E8960BF2091F517FFD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562132, "uuid": "57720455-c583-452b-ab40-033e7086e841", "value": "3072:cZV9xTjtIF9GSYfyyu3rKmjlCUsdwnvMHmhP4tgaUTkpf+joCVQLr0B:K9x1IF9GSYfLuiddwvphP5aU82joYQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562132, "uuid": "e82dc0cf-5799-4d60-9fdf-b292bdaf008e", "value": 423588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562132, "uuid": "bb9f5a7c-b1d6-4f00-a413-a086cf0b755c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562132, "uuid": "7b3dbe1c-0b2a-47dc-8de2-4148028ab9d5", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a89479-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553121, "uuid": "04e76332-4197-4d59-86ab-b5b9bf303cdd", "comment": "Malware payload (Mirai)", "value": "3c43c4186d807c6cb172ac4c9d3e7567", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553121, "uuid": "9b63323a-1648-47a3-aca8-87e256a9cdae", "comment": "Malware payload (Mirai)", "value": "4a37578b2a75d15c977843e915ad8b03d67c782b9bfc10f0219534628d0ee54f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553121, "uuid": "4bf6ccfe-b0f7-4908-a2df-0af60f419ae8", "comment": "Malware payload (Mirai)", "value": "6fdc7cb265951dbbf20553e8d804ba8678d1b3f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553121, "uuid": "7cf9640e-be12-4cb3-af7a-4699e1629d53", "comment": "Malware payload (Mirai)", "value": "5da381b73c02a96ee982ff3b016062a6537fd204f88db6faa950689ddb210d9aa3f23027f08703e0ca1478e8a354ea5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553121, "uuid": "002567a2-7fdc-47ed-8921-249de63e7545", "value": "T10D53F946FC818A11C5C913BAFA2E118D33136378E2DF72529E106F5477CA96F0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553121, "uuid": "8b3cc948-e6e5-448b-b28a-18b3e6a2dc8b", "value": "1536:M5n9dQzsIw8K2QAwMiEhiBAapaczKxWRqV0uywXaLxIVi76yBZWA:sSwIiA5iwGANczKxFVAJ6yBZWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553121, "uuid": "064f8640-44b6-4eed-b6fe-7e06395ae174", "value": 63188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553121, "uuid": "4f6d534a-e832-4169-8f31-8f62503147ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553121, "uuid": "ed199969-5998-45f7-9612-96248c442b28", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908bb679-32d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775601107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601107, "uuid": "690a5123-8eb1-48f0-ad18-3696b9aca034", "comment": "Malware payload", "value": "54ccaa67a46c0c7a8486322e0b1cb6cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601107, "uuid": "861b1802-6b28-4c38-be57-7c512b7d133b", "comment": "Malware payload", "value": "4c297314c20b63cc9821f02a45a104759387d00ee27f2476f811213bd7504fdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601107, "uuid": "f47e9f0a-b4f6-472c-a084-2a7a86c27f17", "comment": "Malware payload", "value": "8a538f4d920b9632a85f743378e732cb3e6adeb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601107, "uuid": "e8b17167-9f9e-467e-b0c5-ce53e343adfd", "comment": "Malware payload", "value": "9aaa169a7b6ca47626a5f31d7ba6bd37084dfa159125ee4440b893f21d708c02b6770b4cdce9a1354cf03212f8745af0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601107, "uuid": "3dcef565-26e0-41f2-a633-060f169de6fd", "value": "T1A2473332B0259235EBF12973B825E9303D5C72286B65CA78E3D89D697D214C36F7720B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601107, "uuid": "151b6896-fcf9-4c77-aa48-bf890b79fa2b", "value": "e277f1464e7729ad9df5ec047611738a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601107, "uuid": "f040426a-8e99-4bda-bad9-bc3b5707340d", "value": "393216:ePbOgBp0y6mbBX/RtRPOmbplTiGUm+3la/htOFY9XU0022Tdlv6VAa/MNdtTML8s:ePCopN/rRPOSpBiGUmOg/7XU00PBNPap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775601107, "uuid": "83d64f3b-6fa1-455d-ac5e-ff206fc5a28e", "value": 24828534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775601107, "uuid": "c7792ebc-ddd9-441c-bb62-ccb10f6ced04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601107, "uuid": "c83cc4d5-390d-4346-9b42-06540b3647cc", "value": "Cyberduck-Installer-9.4.1.44384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc4ceb4-32d5-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775602821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602821, "uuid": "9ec91db5-45ed-41b9-a9b2-d43e6d2a1eea", "comment": "Malware payload (AsyncRAT)", "value": "118f6f175a840830421c090e05b15358", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602821, "uuid": "144038e4-8a0c-4514-a4ec-9d195c1aff0a", "comment": "Malware payload (AsyncRAT)", "value": "4c3b97c157d08ee298edb5d30fa86a3b90b04fedfbe517e7e0307b6013eacbf0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602821, "uuid": "5bd4718d-9151-4da4-9ba7-e8d722c76210", "comment": "Malware payload (AsyncRAT)", "value": "a510174c01bebb30f171d0af5faef65b31c441c8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602821, "uuid": "0bea6c2b-af48-42c2-b938-39209066ec11", "comment": "Malware payload (AsyncRAT)", "value": "858d69da8f7160f525c01d2f130e5cf7d5f91825ac44f97937406e7df3aab1c8cc8a00d83ade8faed63dc9aae0d134a2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602821, "uuid": "b793ef6e-0552-4a26-b557-86205f4288d2", "value": "T109233D003BED812BF2BE9F7499F22205867AF6673603D65A1CC441DB5613FC29A435EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602821, "uuid": "1632ed41-ce27-40e3-ac2f-67efa8583064", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602821, "uuid": "3e492a65-43d5-4be6-ac76-c530123b873a", "value": "768:iuCIZTdMRG6WUsyurmo2qrO5UiTuPIwk9LcI0bSwXD2Zo9P4FTY2jI73jDBDZEx:iuCIZTdSw275Xwk9LcjbSGV4BNj83BdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775602821, "uuid": "b9987447-b1d6-44f5-93d7-eb4ea6fac1cc", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775602821, "uuid": "ae280bcb-f21b-4e50-abb8-f3321fbbca02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602821, "uuid": "e3ff96ab-052f-4df2-a340-72121a8ffa8c", "value": "118f6f175a840830421c090e05b15358.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00197b48-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539877, "uuid": "1b27855d-38e4-47c0-8918-5acfb1a2eca7", "comment": "Malware payload (Mirai)", "value": "a4b5487cd9f7db2e495b0fc10cf428a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539877, "uuid": "87a11ecd-2275-4ce7-821a-c076f6e4bae1", "comment": "Malware payload (Mirai)", "value": "4ca1ee4c0acfce6e7044a9607312116c36cf1e3df57c396b5b6d8b23235c357c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539877, "uuid": "9e17b6a5-1347-4ed0-980c-cba2865e9490", "comment": "Malware payload (Mirai)", "value": "c336ab0d6099a73e86b33a98a8351170b903bf42", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539877, "uuid": "e19fd77f-aea7-4cc7-b236-2b9530dbb589", "comment": "Malware payload (Mirai)", "value": "b5fa5bbc1302c5b2f04a6d14d327abf21a43a8fd78e230d7ba6848878fe8b2e22ae9129478b3db21e273763efbb1f0e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539877, "uuid": "0f1f1dc2-00aa-42cc-8989-c294faf7bf3f", "value": "T172C3BE97F68B24A1CC6147F047C76B8D2E6362118E6BE9E76C0E763B097A1DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539877, "uuid": "88dbef1d-04a2-400d-90de-6fc24bc932d1", "value": "1536:H5LQvJrKIEcfzXZ3NB4BuLaLWqxIijGsueEoutC8xZJqKg0T/LWQ:H5LQv5gqrDqBuLetRGsZutCpKg0Tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539877, "uuid": "7762b755-7a74-4959-904d-45eb43404eff", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539877, "uuid": "f747270e-4539-48e0-b0eb-5f6d9fe5c2d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539877, "uuid": "92c6eae7-249c-4ea9-be27-7f8edd54869c", "value": "windy.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9176a82-3240-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775538952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538952, "uuid": "3cf31796-b4e0-426f-8d01-25a5a3c32805", "comment": "Malware payload (Mirai)", "value": "eed515b7526aeb79eed9f4f9204088f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538952, "uuid": "311d9325-e6c7-4463-bfb1-aad5b529c5ff", "comment": "Malware payload (Mirai)", "value": "4d69b085e44791e13d7955ffdb1b16155041a919a6151ec521a6cf5fd7ecb5a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538952, "uuid": "6b94940a-c1cd-4336-a589-8392a8f98d53", "comment": "Malware payload (Mirai)", "value": "1b788419526f5be01c1994ef3b5ffcc261e871a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538952, "uuid": "462651c7-6c62-45bb-8f4b-813e2cf1685c", "comment": "Malware payload (Mirai)", "value": "11a3acfc26ae613ddd6fc39a682408e390f0b2e0c1ce26c1030ff974a1d9f63659096cc1c04d6154ef5e867347040f8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538952, "uuid": "ce26c9c5-aa7f-4b62-ae04-d5f00cfcab2c", "value": "T198B32946BD819B02D4D721FAFFAF404933136BB8D3FA7102DD249F65238A9A70A77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538952, "uuid": "7d20ed3f-e843-4e92-b2d8-66bc2ffea5bf", "value": "3072:nzT+CWLlx7Jl2OT6XRIgaCmOkKxQh2bZ5uNS1cu573:MgWgaCmOkK22bZ5Ou573", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775538952, "uuid": "4f2f203d-ba67-4233-b748-a5f1ed6f4f2a", "value": 111524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775538952, "uuid": "9589e4f2-8246-43bf-9874-3bb083f0172c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538952, "uuid": "59a9f45d-8dee-423c-af76-4833a008f9b8", "value": "zyre.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ac172b-3276-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775561837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561837, "uuid": "2be43e66-bf3c-440e-9b89-426701333402", "comment": "Malware payload", "value": "25190c542db181ac6219119c19e7ba51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561837, "uuid": "0637bd2a-c185-4f1d-99d0-28ccc50dc0bb", "comment": "Malware payload", "value": "4e718cb2e0972cbf7667b699c0ead3a76bdc9d4a194159e4e5b315cec362f089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561837, "uuid": "ff630f89-7906-4fa2-be30-a9b1bde20bbf", "comment": "Malware payload", "value": "4b1fd68616d72981e5b8123b241910a3915d7e54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561837, "uuid": "4b62fc27-97db-43e1-86c4-9bb1e34ffc6e", "comment": "Malware payload", "value": "9f577bdf8a7e04e3517ecd66354859b5c5b4ac7a0b454bf65b1151d0e4f3e0c04e0efd0036beb89cb873a3966e8a36a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561837, "uuid": "f93b6c8b-17f6-431e-b0bc-3926d9924665", "value": "T183383312B3D9257AC8BE277202B2F22019FFB55E71A76E4237E4C58ECF941C05D29B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561837, "uuid": "4d8424c9-ab73-492f-9594-03db94a9b010", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561837, "uuid": "b96820a7-54a6-435f-8438-5ae4e4edf45f", "value": "3145728:JydUDMfez/rnCrU4KOq3lKmrkiU6wD2fsA9:2GHChKxsiUmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561837, "uuid": "fb0e1f26-3e63-46bd-a531-7f9cff374d0e", "value": 103207965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561837, "uuid": "c7e17978-ddfc-4b57-815e-3c04769b11b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561837, "uuid": "feed1ebb-490e-4d3c-b751-ddf7acba5c72", "value": "anydesk_v1.0_x64_win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9dd9967-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775562066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562066, "uuid": "c344f08e-c611-4d4f-92a8-3f9bf74c32a4", "comment": "Malware payload (Mirai)", "value": "cb61d3b9578b224e5abdbac2130740f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562066, "uuid": "1e4de220-7f25-4a88-a055-72f81d8da3a6", "comment": "Malware payload (Mirai)", "value": "4ee1c5a11b2debfda6d6b1ccaad829a4743a1e1b16a48687e123daf72a295a43", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562066, "uuid": "1e3d3176-f877-4fbf-b222-39c4e5823dbf", "comment": "Malware payload (Mirai)", "value": "bf0daaffa08695c1b744b7c57e1ec97aff43e458", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562066, "uuid": "eff6aff5-2db0-43d7-b0d1-f7e6b20533a1", "comment": "Malware payload (Mirai)", "value": "6e77e716ebd7963b67a086a0698769d0285215808ecc13f1980030f42a8595d7a54e5ba5f4d9631b07fffe7fefe0b51a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562066, "uuid": "8946cb30-0603-4201-8074-9bcfe2f2500b", "value": "T109E30802770D4F03D1432DF43B7B47E1836AAD6228F9E184750AFEC997B1AB1A506E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562066, "uuid": "ee20b503-a604-43ce-a22f-730d991d6700", "value": "1536:zGzblAdg107H0erPyf+JxU+DipU8qPMEiQe1R1vAju6t5U9Byv976WcL+vrOWrg8:eblsg1p0P2+JxxiyfiQCCjHx978Wr1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562066, "uuid": "e964b090-47fe-4b5f-8575-0fb20151eeca", "value": 155464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562066, "uuid": "7237391b-9625-4b81-9038-e48a93466bb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562066, "uuid": "1e9d5a76-c5e5-4424-bb72-42dc519cbe08", "value": "nppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685700ce-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554225, "uuid": "c2783a73-2e7d-46d5-85f2-bb463eb0a2d5", "comment": "Malware payload (Mirai)", "value": "39830deb86e8d800d4cacd932ed77883", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554225, "uuid": "e8ce8a7e-1da4-4243-b38f-1bf7a9cd0c96", "comment": "Malware payload (Mirai)", "value": "4f0fe61c25d1215a534b66f5d80e4565c2feb7cad9fd481074dc603c1e9e5f70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554225, "uuid": "bb66fe4b-306f-4ecf-8d99-b8c407b3f921", "comment": "Malware payload (Mirai)", "value": "9bee175ab2383b41a923c83073f15ed63b3ae116", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554225, "uuid": "8e926429-b0f1-430c-bc0c-7bbf46586016", "comment": "Malware payload (Mirai)", "value": "bc033b3163a51e0c38d8830e9f53fc2e80ab94a949c891d785cabcaa3e63f4aab545c0bec363ef00bfb503b5f224b38f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554225, "uuid": "7fe49762-3887-4b67-b80f-7025d9b97ac0", "value": "T128634BC9F983D4B6E897093010BBBF639DB3D6BE2168DA43C3A855369D12502F416E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554225, "uuid": "7c28b099-ebca-4a58-92a4-fb5390e6e559", "value": "1536:ltWizyApqj4PfWjF7lOvZOWsIyq3XkZSY/:ltFyA0j4HWBJOvwfIyqs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554225, "uuid": "df2585e4-d1e5-4269-9eb5-17d506de6413", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554225, "uuid": "6b0a98c9-c225-4543-b4a0-693bd92d2028", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554225, "uuid": "40cbf1b1-cdc9-4ec8-8a6c-00a398eab5a7", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5c9174-3273-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775560674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560674, "uuid": "3c0b6824-6c7d-4044-b993-b383ed7229fb", "comment": "Malware payload", "value": "0f9bf9bdfc6f9471345a6a64bb0e57da", "object_relation": "md5", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560674, "uuid": "f1816710-ff83-4490-937a-8dfac8c93ee6", "comment": "Malware payload", "value": "50746ddd81a5dbc5cec793209ab552125fff9c7184aa5bcfe22d6c3b267f67f1", "object_relation": "sha256", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560674, "uuid": "fdd2e51f-6a43-4523-9651-3e85e68b087d", "comment": "Malware payload", "value": "e34f1632b45fcff76e6c8e321e87e9e0d28cab59", "object_relation": "sha1", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560674, "uuid": "41cb4f1c-ef22-4d07-afae-d487bdd64dcc", "comment": "Malware payload", "value": "6805e0fde945a144d13e0b96cbc6b79388bb678d04b00726bad5f8fca7c4aa2ed7db13d34aefe177ad37eb93e571987b", "object_relation": "sha3-384", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560674, "uuid": "6d777128-a483-486f-be8a-f21803124ba8", "value": "T1C94574F2B9298890E815647CDB1B60B3D2E4EFB149B9FF85B524A8D143B06533B311DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560674, "uuid": "7d2b6462-5943-4d5d-8f07-0a132e26b12a", "value": "24576:BQxoah9YCjK1Uh4rNUS4rmdxKgG8oUh4ryNqlt8IzO8uAmaCiKb6BwWrV2YV4:BkoFUh4rNUS4rmdxKgG8oUh4ry8uA8i+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775560674, "uuid": "a2e9fd4b-ce44-4ea1-b58d-3c2a41493919", "value": 1218413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775560674, "uuid": "d9fde664-034c-474a-874f-44132cf44edf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560674, "uuid": "b5ab930b-9b19-4dad-bf45-f1edc6b99420", "value": "50746ddd81a5dbc5cec793209ab552125fff9c7184aa5bcfe22d6c3b267f67f1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bdf59d-3269-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775556417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556417, "uuid": "38bad718-6d76-4a5d-aeb7-756096530eac", "comment": "Malware payload", "value": "adcd3a8091834ca9f75e1788279f2d45", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556417, "uuid": "8a9f9e02-bf30-4626-b68a-e1dc4eba5420", "comment": "Malware payload", "value": "5087e50b304303f10e4d17c94d6fac000038a711017407086c02268b66181040", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556417, "uuid": "9e87e455-973c-4a0d-8065-85b01ec59a7e", "comment": "Malware payload", "value": "db6f1d723408f59686fa971a2cec7d84151dfacf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556417, "uuid": "a9c01421-9af6-41e8-8401-4e4de5e38c86", "comment": "Malware payload", "value": "5c599cd2b36220ef5b391a648597d0f47c1da71fa5d8589074aa15a4e4a742acfd0f6014610b3b13ec9a4843e89dd5b6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556417, "uuid": "9199c2e8-49d7-4628-97e6-54121bb81ecf", "value": "T177B54290D910EC81393340A0DBC3A5CED75F7D7D4FF6879E43096EA1128A3ABCDA9529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556417, "uuid": "5cd54112-5c7d-4a64-9bb4-66aaa8166a32", "value": "384:bzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz4:IsNbjKHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775556417, "uuid": "60747109-0495-4656-a56e-9d7540c688dd", "value": 2388486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775556417, "uuid": "c26c7a72-47b5-4dd5-a3be-b8cde15b3215", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556417, "uuid": "c0c2e766-8335-4719-a4c5-a901c5e6abd4", "value": "UPIT PENNY PLUS D.O.O. SARAJEVO 04022026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd5cbd3-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554237, "uuid": "b6e78bde-0f45-4e83-824d-cad1ad90cfa6", "comment": "Malware payload (Mirai)", "value": "130286876fd924283e6477633dabf4d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554237, "uuid": "afc9e073-c2ec-4dea-9461-e242457bbfda", "comment": "Malware payload (Mirai)", "value": "50ba431593a1c9bfc7316fcab84cbf42954a01f405954592a493ce3e0ec7a47b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554237, "uuid": "ee572cbe-3587-46b4-ad0b-e86dc9de6012", "comment": "Malware payload (Mirai)", "value": "57967779f050b4ef81c0bae928827eeb2f652c8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554237, "uuid": "24a8d846-af05-4b3d-85a9-6d7af6b3caa9", "comment": "Malware payload (Mirai)", "value": "2ff83385d8fb5e47938bee2d7f031851cf613307862685bbb236cdcaacb340a3282d60f05eddaa22e9d0b8d373278d8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554237, "uuid": "f4a3367a-5aa2-406a-a9a1-d3c596957e7f", "value": "T177735B41B3880D43C1970DB0363F2BD6D7AFE9D122E4FA852A5F9B4691B1A33154EEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554237, "uuid": "f66dea30-58b6-4684-99b0-4687e65e3019", "value": "1536:uJE+FvWG8T9mCFwUzQz4ln7IHl+94tCy/f7a6t:uJE+5x8TTRkg7IF+7gaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554237, "uuid": "3c72f8a5-f69a-4d89-b315-8b90581ddc38", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554237, "uuid": "c0576357-4781-454b-beb7-a6beb402e4f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554237, "uuid": "e776bd09-ac21-47f2-9011-cd93dd7e6846", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5320928a-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561920, "uuid": "a85e60b5-2a7f-4eb4-a778-c93a37914993", "comment": "Malware payload (Mirai)", "value": "b8d2e111b5e0a52aac1395c4bbd9525e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561920, "uuid": "8cc7e2e0-9c54-4db7-83f8-0080ad319174", "comment": "Malware payload (Mirai)", "value": "50c6ca3e750cca62b83fba081cfeee8131554cd3f8c2e25047497cca4e611ce9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561920, "uuid": "96f15567-f750-4903-bce8-ace8c5c5611f", "comment": "Malware payload (Mirai)", "value": "667b2e2d330c46ae84c700f90156e8fbb67d6eba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561920, "uuid": "506f3355-a431-4a74-81fd-fd4d2b492457", "comment": "Malware payload (Mirai)", "value": "391e51ca4e2d9f7a6e9c59ede59a5db8ebc9ed57d073bbd0b43e59fccab286ff17e4e6be544d11c6100ad86600fe1898", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561920, "uuid": "da47d1fa-6dd1-41d6-b83c-f041e01eaccb", "value": "T1BCE3E742BD428F13C6C725F7FB9E42983B166B6DD7EA3102D8257F50278A4DB0E36252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561920, "uuid": "077700a0-f601-4666-8744-c2089e793c8f", "value": "1536:ztnXf7Wo752bf4uP82vG64VR/hFDgbzPj+dilnNwywyIEJbSSRc3r91JECHbOQOG:zBXf712XP8m4X5FEnPSIbQZ17thR8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561920, "uuid": "9364b410-cd20-4863-95a1-77ef52052c07", "value": 151232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561920, "uuid": "fc2687c7-5d1a-4ebc-9198-9c04083d3ed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561920, "uuid": "0ac6bcb9-0877-4030-b9f8-24e7f3fbfbf7", "value": "narm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37947a1d-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554143, "uuid": "eb2ebf04-535d-4d9d-8929-b49074b9dc47", "comment": "Malware payload (Mirai)", "value": "3ac3b04a0f8951ec51d82e250af6cbf4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554143, "uuid": "13f97f35-5dc5-480d-949e-8857324c7e3d", "comment": "Malware payload (Mirai)", "value": "50ff1f0190856f9c8c0b4217c8350cca6879f21a2c420d393bd54982c9f6d209", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554143, "uuid": "43f61fbd-f7a6-4f04-a3e8-92aaf3c06782", "comment": "Malware payload (Mirai)", "value": "22aeab1ee0b180499620a98ed1630aa2830b4c93", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554143, "uuid": "69e6d727-bbf3-4332-ba59-15070ed10d82", "comment": "Malware payload (Mirai)", "value": "d53e2905720b8335f7a702ca092b30b1f54d126c09f0d0390131152fc09967aef7965bf6a88488723506c37fc27996da", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554143, "uuid": "b21aee8f-71a9-4618-a592-7e91db2b7de8", "value": "T1AA030207D45618D5D95880F29A67C0803AA59BE4F0FD729333508EF99CBB8AB25F8F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554143, "uuid": "8a3f54dd-dcfe-4237-a563-4841c5c14936", "value": "768:fWVVasPGxpBnekBYlk8i0fPkD+bk4nwx/RWUiQ5Ty22QrNi9q3UELy3:fWXasPGxplekBgTP654QwGhy22QZLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554143, "uuid": "d524636b-c731-4afc-ae9a-d992369baee7", "value": 40348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554143, "uuid": "6ec4caf2-a0f8-423d-9a7f-e9225c18105a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554143, "uuid": "9d818b12-0a8d-4ae7-aa0c-a846f860ecb8", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee141b0-32cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775599118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599118, "uuid": "6837f75c-cc1f-4f8b-b2bb-9aa399e9bf4c", "comment": "Malware payload", "value": "6393c5206d9ede00ae7bb4244f9c2259", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599118, "uuid": "df8d1d34-80da-4280-aa41-49536b9e9f38", "comment": "Malware payload", "value": "5128d054defbbdcdfc1a0554439a28f1add2baa18b1913e502e070ab451016a7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599118, "uuid": "05102c95-5eb8-49e9-ae4b-399e98a84b7e", "comment": "Malware payload", "value": "7ca8c68155b229fb68549e441cc2e21b912a20d3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599118, "uuid": "6e4ef247-3ccf-4e4d-b804-0b3ce37e66cc", "comment": "Malware payload", "value": "1fb584873babc81144a681c41aea4fa6e320130149e9f0a6ff8e2a312cc696d6bda59a60373f3f36226a8d6a913948a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599118, "uuid": "0872e90d-8975-4be1-afa2-dc959119df62", "value": "T154136D6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599118, "uuid": "d8705178-ac86-4eda-9652-3d0fd4d99b0a", "value": "768:bLXRWNGxVk9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bFlx7co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775599118, "uuid": "66e88ed0-b651-4bd9-9969-47fd00071310", "value": 45510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775599118, "uuid": "a40a7132-fa60-4185-a41a-a7faf22db3fb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599118, "uuid": "8b1a7adf-ecc6-4d46-aef2-3fc09906e450", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c5bf2f-32ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775599645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599645, "uuid": "071cda40-9420-482c-b638-4176d016d25f", "comment": "Malware payload (Mirai)", "value": "3920889e8bd514c3bf853dc36e068adf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599645, "uuid": "92f4b8bd-68a8-4578-ba5a-9f94d3379378", "comment": "Malware payload (Mirai)", "value": "51a9f4cce2454c7b20323181b042cc33c60820e639c9783b3bea4720162da753", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599645, "uuid": "6816e422-f0ef-47b5-8f01-2dc5e1729126", "comment": "Malware payload (Mirai)", "value": "298fa4d99a563f794623b958e6fc9d60dc0ee6c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599645, "uuid": "da76bfe2-b213-4bcf-8456-70ba2cfaf45d", "comment": "Malware payload (Mirai)", "value": "c280b6c2a05d8348f133a20fa48b859ff6277f62c2b923ca7ded3c304f053245905dd18ddb9a46fac2e49e8c1d132602", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599645, "uuid": "0cf68994-54e9-4f1f-a90c-6c4a4046c04e", "value": "T1D1A33A27BE724E27C4C2B1B551F30B34E5F5ABAA1C78851ABD622DCCAF241D031567E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599645, "uuid": "b75ab8c2-e828-4804-a1f2-1aac7455bb22", "value": "1536:z5PmKK1qYdOWGFbkLbkTQJl6U0xat9sOoD5W5Lt+JYkxF+C7U:IKKEB5oLoTQ9PLo9uq+CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775599645, "uuid": "80b9a2b0-ac15-4871-bf9d-1799567fc75c", "value": 103488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775599645, "uuid": "eb7da838-764a-431d-9be9-82965d6273cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599645, "uuid": "2e75dc40-1283-4e8d-9d20-8c5092d39909", "value": "zyre.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae721023-327a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563791, "uuid": "6fe43695-789d-4057-a69a-24bda12af1be", "comment": "Malware payload", "value": "6a143fa09c4c84d493793c6e5f0bc840", "object_relation": "md5", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563791, "uuid": "cc2d657f-280e-4a28-af95-774eb8adcc45", "comment": "Malware payload", "value": "5214cdfd704baf0c07ef238c0cfb477617fc0b28c7531dc36c5de8260504d667", "object_relation": "sha256", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563791, "uuid": "06eeb779-e1e6-48e6-9225-e1b56df7af6a", "comment": "Malware payload", "value": "692359d85a47af3b7261bf729b41499f554f9bc3", "object_relation": "sha1", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563791, "uuid": "15d14dba-f11f-4535-8703-f7480236fa23", "comment": "Malware payload", "value": "4a621d734550eafcbdc82f654cc455b7994679e7c5465aac6ef10484562d4b49e6d7f3a36fdd05a7f33f438bd3366928", "object_relation": "sha3-384", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563791, "uuid": "73831ef5-610b-47e4-8797-275bbffb1caa", "value": "T1F7137CA566853C24AA99893B1C7F2F0CB9A983E1310451DDBFCB3CF58C59ADCE218719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563791, "uuid": "136c5309-d97e-4f0c-85f7-727d34c75459", "value": "768:bxFWzZx5y9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bxkzlco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563791, "uuid": "54304020-b8e9-4ae9-a249-977c9db8f0bf", "value": 45530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563791, "uuid": "92f27ee0-924f-40ec-ab7f-b912a96ef357", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563791, "uuid": "e98c6c05-6f3d-4116-86c1-1b67ebb0a438", "value": "5214cdfd704baf0c07ef238c0cfb477617fc0b28c7531dc36c5de8260504d667.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbcaa23-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554662, "uuid": "8db6181f-c741-49cd-84b0-b80153d2c7b0", "comment": "Malware payload (Mirai)", "value": "4c27837366736f1d9777cb105ae66dc4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554662, "uuid": "d7ca1f1b-5891-4d58-b4dc-9e5c17035bb2", "comment": "Malware payload (Mirai)", "value": "52576a56e466972d8abbe2e2b76ff6391065544068717b2a8bcf8567bb271c83", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554662, "uuid": "9aae9aa2-0075-481f-a76c-96c442da6a6f", "comment": "Malware payload (Mirai)", "value": "3921b00579069dcdda8fff686ff8e50d068c7992", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554662, "uuid": "05f98268-a441-4113-ac43-cec6be6f5c52", "comment": "Malware payload (Mirai)", "value": "67fae01a2000d01e46db9e80971d298e915e76f2bcb2df80baaf45a17f72a7ccaf443c28c32a6f60c463274715978f95", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554662, "uuid": "99a6df91-c117-4fbc-9cf5-0e774e66c68e", "value": "T1EF735C32B9751D2BC4D0A87A61F30325F2F2478A25ACCA1A7D720D8EBF6565032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554662, "uuid": "b5669393-5c25-4423-a4b9-f9b01299d6d0", "value": "1536:jP+SbCGR18pspTH12DQ2tXXUN95s0xwlWptCMR8/pW:zf4yVopENP1x6MoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554662, "uuid": "123009a6-fc55-45dc-b1f3-6ff9ab80e7f4", "value": 78528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554662, "uuid": "a9325d9b-c8b2-4622-be4a-b0f9abbad1cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554662, "uuid": "74499c0f-9234-41cc-be6d-5375af57871e", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46561fa4-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561899, "uuid": "5e6d61ef-7e50-41d3-9b1f-ea14194b7915", "comment": "Malware payload (Mirai)", "value": "76d220c5cfff974952dbc5f77c673e0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561899, "uuid": "da6c6e7c-0e5b-418d-8aa5-50b54234c4e5", "comment": "Malware payload (Mirai)", "value": "532faf77dcbb9e3cd43614c4544ed05972fec084ba26d8c4a3c371f43241c4ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561899, "uuid": "ab25dbce-1f43-4de7-b049-985cccf8bfaa", "comment": "Malware payload (Mirai)", "value": "bca770bb619e71c08269248a76e8270cb2e1542b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561899, "uuid": "249ae1e4-f43a-43f4-891f-c299ce6f691f", "comment": "Malware payload (Mirai)", "value": "d7823938ce3204ee183365e4c2d267462e237b86ab264ca1bcc5c9a3fa7ec6a81960b063ded327fcf71caaf2fdcf7a68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561899, "uuid": "0ebd5869-0919-4395-88b3-eea8c3a01be4", "value": "T1BE830270F3B70DBD51308F786BE55F06AB2688F2ECF5E46202A04659DF966A13377206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561899, "uuid": "5215c7a4-c751-437d-82b1-d0d91f408fef", "value": "1536:a+Qil088jeYgFSYmxZDC20MGH9kUmaOSVBz7YwiRedfuYa7Tkcb8O5nDi:aKl01jHPHCtdH9ksOfwioETkKd5n2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561899, "uuid": "fecdd9d7-b6ce-4681-816a-87023aa57aee", "value": 87712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561899, "uuid": "9d1a3f57-3732-43f5-a48e-e412aaab209e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561899, "uuid": "abef6d51-d489-4862-b9d8-7c334acc9ca1", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341cc568-3252-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775546406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775546406, "uuid": "c1189e46-3433-4fd4-9d50-44307595ffbc", "comment": "Malware payload (Mirai)", "value": "7e1941e119e204a7fbdec9a58a796a9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775546406, "uuid": "df3e83d5-f2d4-43d6-888c-2b19446a04c0", "comment": "Malware payload (Mirai)", "value": "53c77b17d3a09959d3b865442387d2b4510fe7c9ad58bf1d7a7f43f5095ccaa5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775546406, "uuid": "9b96cebe-80cc-4268-b851-7543c7d8d6d7", "comment": "Malware payload (Mirai)", "value": "04315e900e32b33b41ec0ba5fb31833cea4df72b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775546406, "uuid": "2bfc5829-70fa-4723-ae05-d06c3d2a1bb2", "comment": "Malware payload (Mirai)", "value": "56068a139bc068439b729f344eb09e0ddc333ce2b0e2e1c44c7d66cfbbc2e47056639ac830dcf6b8bd0d00f68e19c4a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775546406, "uuid": "827fe3b9-1217-49e9-92d9-61eab2697f56", "value": "T1E3D44A56F8809F62C5D0257AFA5F8268331347B8C3DB72069A189B343BD786F4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775546406, "uuid": "25fdbec5-744e-454a-a15e-63ca7caa3da5", "value": "12288:lzPH4HLGWaEauI92biD9Ngpg+RRZ0KpEKlLcmX:JPH4Hqi02b6a/DpEcLcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775546406, "uuid": "26848e2a-2e67-4f17-b32a-078a4462d924", "value": 645748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775546406, "uuid": "b0e8d1d7-8294-445f-8a70-181ebc7685db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775546406, "uuid": "b4baa8c2-10a2-4682-b338-aa3ab28adb77", "value": "tciarmv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e9d635-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554147, "uuid": "0f1a17ed-ecf3-46df-bcca-8a794da8241c", "comment": "Malware payload (Mirai)", "value": "b8b9a1ff12cb112dd5cc159f802aba68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554147, "uuid": "42544d41-b61e-4b15-846e-91a5263d4ceb", "comment": "Malware payload (Mirai)", "value": "53da8cfb7ae70f813715d80ee69e98e1014761527e246f234cde590b8b57053f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554147, "uuid": "eeb3c7d2-3a01-4a33-8669-b6ee7d07a0d3", "comment": "Malware payload (Mirai)", "value": "b2988efe6571da07c4aff7a0d218bce3561674dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554147, "uuid": "4e12f55e-9d5d-45cc-81c2-7575206cc321", "comment": "Malware payload (Mirai)", "value": "4b4036361652a9ab0572cfc3759ef6f16a280d09b470eabde7a78ba1de215fb60a1c1806ccd1d30fabc541168c06d03e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554147, "uuid": "092a7bcf-948b-4ee0-b7fe-eb794efd1540", "value": "T1ECF2F2B1C0568B18E33C41FA89AD6E0D2844D85DEC0494F5EE8C7D738A15F94AEF1B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554147, "uuid": "3fc87c39-8c3d-4d9e-9ff2-a27d61e81b57", "value": "768:BW/zEpEYEgHE+Tc70R1cVC9owNnTAz9okfFmmnbcuyD7UHQRja:E4B1E+TcAYC9owuiYmmnouy8Hyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554147, "uuid": "1a03e855-ea2c-4fba-9fc6-e212c2306211", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554147, "uuid": "4cd3f0b9-bb5b-4f5a-8170-6f52e2a64c85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554147, "uuid": "a3afbf43-be1e-45dc-9290-82c6e425c2dd", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52cf18e-3267-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1775555750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555750, "uuid": "00a9f9fa-cad0-4105-84e2-f441fc96ecb6", "comment": "Malware payload (XWorm)", "value": "a7bb36e5b7ad4f36dd28a9ee929321a3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555750, "uuid": "7d1449e9-5820-411d-b1eb-b22821a190d5", "comment": "Malware payload (XWorm)", "value": "5455ce1c973fcdb55b30adb802ac031a76c60ac8c497d165dc0e8c9fd282b8d5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555750, "uuid": "ae01b2e2-fd52-4aa6-97f3-c2ad01364541", "comment": "Malware payload (XWorm)", "value": "68beecf2f8ff3047215f25992be176676e7e63c4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555750, "uuid": "8f0e97ba-5513-47e3-9917-116e29f949ab", "comment": "Malware payload (XWorm)", "value": "ac955e407cac6992cc468b1edb66790fa916c3161cf77e344b1d58af8c7f26b159252e19f602a98b345ff5fb0d6e2add", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555750, "uuid": "574a5d7e-7b74-4c22-be75-6d48f25e1be1", "value": "T15B639F2319C6C44A64F1165DFF1A792BF748D0F28BC4F68422AE86DD6058E2E57C738A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555750, "uuid": "d53cfa2f-36b2-4c95-852c-77976aab07f8", "value": "1536:wDEEODYEkkupNJuWzkNXynBN81T1Pr4bfJlQI1kMcUb5a07qnEKqV5vVoaQ:wwEYYEkkupNJuWzkNXynBNSTtAMI+MRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775555750, "uuid": "224b518d-b50a-4e41-88da-1aeff86ae90a", "value": 67505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775555750, "uuid": "84824ffc-8cab-47bd-a0e4-d2aaae109332", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555750, "uuid": "52ceb66d-a69e-41de-ab0f-1b329a310f7d", "value": "HGF9876567890-.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb58f18-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1775554291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554291, "uuid": "782879b6-0ef2-43c6-8e74-20db492d73b0", "comment": "Malware payload (SimpleHelp)", "value": "f646f0ddf276287c5071da5cd5eb0126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554291, "uuid": "1b5fc46e-409a-4ce9-b2dd-6f187344b196", "comment": "Malware payload (SimpleHelp)", "value": "54651d65f883cca647e607320b75277185342b15ed6e60e6cf34c298463f272f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554291, "uuid": "6bc9efbc-78cb-43c9-9390-e355d299b010", "comment": "Malware payload (SimpleHelp)", "value": "5a2a98ea077a8c457b4dd71665473ad20dc66f35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554291, "uuid": "1d783e78-10b1-4cb4-b5ef-ff55f33fd5e2", "comment": "Malware payload (SimpleHelp)", "value": "29117c63e824de8d6693707ce90a3caf8f2b2b8a40f16e4298e6248693a9b4aa2493bc229bfaeb78ddb6560920174863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554291, "uuid": "b15c6e8d-6831-47d0-bc21-2daa76946fab", "value": "T136B73321FAC1D57FD683C6B86447D1E7ED7A41A8B28D52230BE00499CA2CD8D4F26BDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554291, "uuid": "f6fa3e2f-c5f2-41bd-988b-3aba97d69e20", "value": "ec3d55528df9b48ff8e5d2ff74321ad6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554291, "uuid": "ba4efbac-684e-45be-9395-820df3124d3a", "value": "786432:yakCLaZV/Qlp2SX7j/32i82itlBaxaI0vOPuajOoI91oTdyNOkav7hMIeNQ:yRCL2e227aHzjmaI0mRI91owNQvReNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554291, "uuid": "80bbd0a1-092e-4c3b-92c3-f9d8fbebed7c", "value": 52476704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554291, "uuid": "b9bd1bf3-a347-46de-8fa8-846ca10ca133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554291, "uuid": "5c1a3ba5-2ad9-4d0c-8237-6442efd242c5", "value": "SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win64.Remsim.gen.9941.17077", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2033bcdc-329e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775579015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775579015, "uuid": "d7733fec-0c8c-4d13-a155-54e0da646677", "comment": "Malware payload", "value": "a9f60042f895a43eae6864f40588c950", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775579015, "uuid": "7ee8daba-4e18-40c1-890c-d574c2d2c1b3", "comment": "Malware payload", "value": "54656162cef9d6fe086f82d3bfb77a1d168821ffffc626f4c7d8eb26a081563f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775579015, "uuid": "463012b7-743d-424a-81c6-199dfeb93293", "comment": "Malware payload", "value": "d27efc930205ffd179314ea7eddfe5e2c788dd6e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775579015, "uuid": "0cac7d82-3597-449e-8081-c131b3c6b3d3", "comment": "Malware payload", "value": "1de5d6570d1704145650848bf923bb6bc2d32cb93a4b778628115f84123754c22ce87fc958f7dccbd8329b83184aa4aa", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775579015, "uuid": "533a45b4-3ac2-4f98-bc3b-dff48b5d3af5", "value": "T1F0D3EDCC489E98A08B1F64A8472F9C438BCDE627065DDD90BBDD9F443F526B074BA4E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775579015, "uuid": "f76f7186-4bea-43b9-be7b-d74bead5035b", "value": "1536:oix3mV7oUjNhkT6kt9AB299NTDAecaJhZ:oix3m1oUPk7TB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775579015, "uuid": "ef1204fe-6273-4d8a-92b4-580d80627eaa", "value": 138382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775579015, "uuid": "f43187b6-e37c-4a36-9893-f7a2ce217c31", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775579015, "uuid": "63d2cf25-6488-465c-8c34-1b379395d20e", "value": "Fusion_Logs_Germany_183.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1d31b2-32b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1775588321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588321, "uuid": "a201b8ba-eccf-4b5a-8996-f87bcc35ebb2", "comment": "Malware payload (Prometei)", "value": "082c81e699810b1090ecc88aae128760", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588321, "uuid": "707f380d-16ee-4e72-b424-a228b7084e25", "comment": "Malware payload (Prometei)", "value": "549386ddf72495c938c2e4da895cb69dc3712f315fd84a07c0f9b57bc7f5c0c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588321, "uuid": "12edc260-ff6f-40b0-9e4d-ba9a8210911e", "comment": "Malware payload (Prometei)", "value": "e0d34afcb68854288e9659844a3ff9631d8215d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588321, "uuid": "3f5d5841-8073-488c-b89c-b87008619625", "comment": "Malware payload (Prometei)", "value": "07bd5ee84adb2ebdcf1f03c7ad2bca31272bf0545d7b1d5c9d770f02ab8237ca4f5184feb1a63e58fc5d51386c98fe12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588321, "uuid": "d77e344b-cbac-46cc-b30f-8e54f1d0c103", "value": "T101166D6AB2B354BCC15BD03097AFC6636835B4B40131BC7B66809E352E73E605B6DF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588321, "uuid": "2989bca8-72b4-4ddd-a0c0-0429784d1943", "value": "98304:lrA146cUtZMiuJjkzCJ+b7lAn6h25Y12oYWm56cVA8ZVZ86:vTCR2oYWm56aZfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775588321, "uuid": "7a26aed8-423f-4d69-9a4f-9bbc821f2b54", "value": 4271984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775588321, "uuid": "c95e2e6c-dd23-4917-a242-dd4433a7eb7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588321, "uuid": "8324691c-c72d-47a3-a159-01acc222801d", "value": "cf30bc39e6ff51de9815492c5d87f98e651e6fdee9adad2a5f52d42d167d6d2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea247d5-329c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775578126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578126, "uuid": "2b0e2ac7-36c1-48dd-8718-f2d4f4ce388a", "comment": "Malware payload (Mirai)", "value": "c6c779756f5f2d07f7e46c17919b8b07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578126, "uuid": "0ca23d99-cb6d-4d94-aac1-2a3da969dbba", "comment": "Malware payload (Mirai)", "value": "55312ad840d43f760e7fdf791089e7fcea0e18cbd6e0c8960481bb1f097f3be2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578126, "uuid": "be4b5c00-9dc2-473b-92aa-b7d20d824da1", "comment": "Malware payload (Mirai)", "value": "5ab876869bcc9cd6fbd112404699ed978a6ac928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578126, "uuid": "50631136-6e74-4da0-95cd-1e19045e93e0", "comment": "Malware payload (Mirai)", "value": "d2833c82b7557e0ab645f4ffc5954d87f24b9b76f3fb84a586f5ea8bef3359bd99787de72a9757b9fcf8d027ba53ecf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578126, "uuid": "019431cf-a11c-4e8b-a156-12d9be027cab", "value": "T174831945FE87CAF7D40744B101E6B63E9A31ED2E0436C6AAFB617EB1C6235C0B216358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578126, "uuid": "9e99fda5-8b01-46e0-9396-e4f21493cb6b", "value": "1536:2WEns5Ay1hQ0L1KuIWw/HMcWmIxZJ1OiKMPQtOwRBtg:2s5z1hQS1BwSrF1OiKMYtOKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775578126, "uuid": "f2d7e106-adec-4dfd-9d3e-abf8b02cbfb2", "value": 82380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775578126, "uuid": "023827fc-5afe-478e-ac14-01f5f3a116ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578126, "uuid": "2f9f2611-1150-4fb2-9a78-81ae581b267a", "value": "zyre.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703e9564-3275-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775561540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561540, "uuid": "4f4930cc-6b38-4d00-b93d-7b33a333eca0", "comment": "Malware payload", "value": "21a354797687001cd2d728cf63e3814a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MobSoft-Co-Ltd", "colour": "#9E7492", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561540, "uuid": "525c6e63-4167-4814-ac9b-5d80bedfe737", "comment": "Malware payload", "value": "56541af54c5b4ad7de32560f780f0e606e5bf67170ad3bc241c9e2d75ea3f760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MobSoft-Co-Ltd", "colour": "#9E7492", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561540, "uuid": "fa93049c-5b0f-4a8b-b53c-3e6faa940790", "comment": "Malware payload", "value": "39cca155dbc660be609ae3928bb98db032697414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MobSoft-Co-Ltd", "colour": "#9E7492", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561540, "uuid": "4c7d087f-1a55-4392-994d-f7ff95d3292c", "comment": "Malware payload", "value": "22af6e2a16d8c7a079cc91b9da28a441a512576cfbb01095c07501d382ac639283adb480c2b8f3a93eac93ed79fa8206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MobSoft-Co-Ltd", "colour": "#9E7492", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561540, "uuid": "9e1f3117-4ffa-427a-870a-0e6ed5126663", "value": "T192E4E086F39856ACCABBD63DC512532FFB7074918314030B13A99A633F276796B2D316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561540, "uuid": "76629571-5ca4-429c-b64f-ebaa6644ec16", "value": "af18b23f8bd85b1fd557930d6522f233", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561540, "uuid": "e54076ee-c36d-431c-85b8-dde208abff79", "value": "12288:9Oxk6rqJreTbomJiuwdWxV+sOZqPBOCOGtY24GbxKfZ1+fVx:90rmIbLJiuwoxV+soqPttYxGbxKfZQff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561540, "uuid": "e472fc6f-12da-4dc5-939c-987bcfdce8e5", "value": 687904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561540, "uuid": "91530809-bc8a-444d-af57-b7d0f32a8f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561540, "uuid": "9e943d3c-9326-4f11-bbe2-d8cfc9ef448c", "value": "image20260407689.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bc86b7-3296-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775575910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775575910, "uuid": "021c9557-e143-42af-b18f-08db09cf68f8", "comment": "Malware payload (NetSupport)", "value": "4d7a84af06e14bd959a95602505cab67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775575910, "uuid": "896bca2e-96a7-458d-b9eb-66b9c3848ddf", "comment": "Malware payload (NetSupport)", "value": "577137ad2f239cadf7b85dc38d88c52ddc76f4b308e5d14e69b5c679a4e5fc1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775575910, "uuid": "784c340a-9982-4b85-a72a-5a9001a76d54", "comment": "Malware payload (NetSupport)", "value": "41bb43cfec9364ce8eb676cc6a49a28671f3baa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775575910, "uuid": "817d0cdd-81c5-4224-826b-d08391219c6f", "comment": "Malware payload (NetSupport)", "value": "880ee4bbfe3c5d1d7cf42867d59dc18a2626e84ba793b1072b8005d17885c12403a8a5a686242f7b653a81d94f9bdd76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775575910, "uuid": "0f3f6074-adb8-437b-9d12-e99cc64af7d1", "value": "T1E9F54B0BEDB98CE9C099E6348433A1177E60BC401B6163D72AD4B3692F737F09975B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775575910, "uuid": "bf1de016-53cb-4d3c-9f87-f74f81efa869", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775575910, "uuid": "0966a4e3-d696-4a62-8c71-4e46deeb1520", "value": "49152:0TDmUrdk++X4AtfInQU8PNDjLMzslAgFljDUCQclU6:0TxA4011nvFxmz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775575910, "uuid": "c1ca2d6e-537d-4684-a933-d105295aed94", "value": 3477640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775575910, "uuid": "796d942b-24e2-4ca4-812c-3544fed01bde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775575910, "uuid": "f094d477-1aa6-4021-a62f-aee29f881f7d", "value": "SecuriteInfo.com.Variant.Midie.177881.30497.25186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67589434-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561954, "uuid": "cac8134a-53cf-43f9-a678-7737666d1727", "comment": "Malware payload (Mirai)", "value": "e344428a7baab9e551f5fa95118dd9f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561954, "uuid": "a1131194-fcd3-46fc-aa58-e943208b283d", "comment": "Malware payload (Mirai)", "value": "5796f4bffeb94611c7fe23db14fd533820b4b50610cf7b23b50f81ba95525277", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561954, "uuid": "7450689d-80af-485f-b6de-ac9267b53fe0", "comment": "Malware payload (Mirai)", "value": "82335579ec0c93a64bd63a37bf174f7428188e6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561954, "uuid": "ce0271ad-c5c4-4973-8715-94176c37de61", "comment": "Malware payload (Mirai)", "value": "df3051a3422738656f62dfb8eb8c0464ed01873233b3b5ce21826e5066388c6f705bbd3664831eeaaf2cd510148c2fa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561954, "uuid": "f453a36e-41e3-4890-bbcd-7d32686d29ea", "value": "T1E8F30A06A991DF12D1C311BAFF5E414937133F78D3EE72029D246F60678A8EB0E7A616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561954, "uuid": "b07819f4-8ba9-444b-9ef6-228ee7705e0f", "value": "3072:9pH1OrtYohnl9T/lz3WnnXYUDhVSmOPhwCNxacLH6VIS2:9pH1GtYohvTlz3oXvVSphwCNxa4EIS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561954, "uuid": "f1107868-ab39-4707-aa6c-90bcbf1b45fa", "value": 159652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561954, "uuid": "98429fcd-3c4a-4b44-a488-accba291e8ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561954, "uuid": "5ae10af7-795f-433b-a381-3e0370b48160", "value": "narm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b0eb29-32c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775595766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775595766, "uuid": "f671a3a2-43df-4721-91c2-0c76d7af6341", "comment": "Malware payload", "value": "9e5ca0983ef68885927f7e89259a2e39", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775595766, "uuid": "e0231394-bfd0-4252-8e54-46958fb2171d", "comment": "Malware payload", "value": "579c2a167f31491cc43903ac9b18735413f459e3b50a027867f4bb4ff731fe64", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775595766, "uuid": "7bb984da-fee1-434d-b337-525fc0864be2", "comment": "Malware payload", "value": "839d40dfbd47ea2fb0688bd1e157d632691a7462", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775595766, "uuid": "960ab046-91e0-49c1-8ef7-24571132e81f", "comment": "Malware payload", "value": "7c714c35ddb3a0f501e5f9227973cf1e9162c5178e7de6c1bacf1a07980b2085da5975663c908ab30ee13c8620266eac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775595766, "uuid": "c419dfa4-2a50-4b98-9ae5-61bb06517ef4", "value": "T18972E7482B00EEFEE256947017CABE630AB51554B7C424E38ED6B4B10EF11D8E876F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775595766, "uuid": "a2d39e57-23d5-4e22-b99f-6f75e23cd4f5", "value": "5f0fea87784ee031fce766ff2c537800", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775595766, "uuid": "f406430f-a897-4919-8c64-4b52dd1764f1", "value": "192:wbm/XdpRbfkmmlmUU0YdV1ZaXtjxtdmM4rv5SSkUB3KgYhMe0PSoD:wbmvPml5G1499tAxSSkUB3KgYhMVPnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775595766, "uuid": "9a62edb1-5ed0-44c0-98e8-d4a37a64a739", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775595766, "uuid": "4bcd7f10-e801-4fe4-a248-d182c6e4daa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775595766, "uuid": "af853a34-93e6-48ee-83e7-374307fe67ac", "value": "msimg32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2ae5cb-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552674, "uuid": "8252a622-9145-482c-8565-9f374063ad08", "comment": "Malware payload (Mirai)", "value": "926bffee44be8f4487eefac6f8806487", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552674, "uuid": "4666d353-3fea-4352-995d-5af24e69f900", "comment": "Malware payload (Mirai)", "value": "5823398289f585cfe65d4eb6822227c90c2f0d26db8f8f9f5fd22e9bf3d47ce0", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552674, "uuid": "e6ea0971-cedd-4bfa-8e73-3f450c79f0e7", "comment": "Malware payload (Mirai)", "value": "5886e415e73e3b53f0ab50065660819cdd651ff5", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552674, "uuid": "bb4c7dfe-7b70-478a-aaac-db34574d1fcb", "comment": "Malware payload (Mirai)", "value": "c2b4ea2f4c3bd1942bb86f7cb4449b2d45e2f4ec205d7be65343091dbfd0530cc2baab344eee688ce531ae2465f75c6c", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552674, "uuid": "dec78f2b-231e-4be5-92ef-9fff82837e32", "value": "T11392C0327BD670B1CB60043ADEA4C2C727A717B4D1EB7212111C8CBC75D9B8A74B558E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552674, "uuid": "9c7ee370-3a45-48f9-a56a-311316ca8c7f", "value": "384:TFwe0a1AVNPT965Ezsq9nra7ZXQujhopaxkB/ouhymdGUop5hHt:W4Ui552YH16axGs3UozT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552674, "uuid": "0531deb4-eb1a-4482-9e5e-66a5374f2856", "value": 20876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552674, "uuid": "6be2b023-f232-4f93-ad60-354fdbb214b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552674, "uuid": "142e9bb1-04bf-40fc-99fb-c790ef1e369d", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd1f2e1-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554662, "uuid": "b8d5427b-4137-4a99-bd44-d7dd2fe92870", "comment": "Malware payload (Mirai)", "value": "39d45682494f6ce225a0649954426209", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554662, "uuid": "12c51c85-a7a5-4c0b-9d85-e81213e42e41", "comment": "Malware payload (Mirai)", "value": "58a02139c0d0511c5c84ebd4e7cd7316868e992796a7ea636bca4ed948b4de3d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554662, "uuid": "92b2f933-5b4b-4a35-b751-30989d419b0c", "comment": "Malware payload (Mirai)", "value": "a8e476bdfa3e1b61b2768dde1c039fec0fcd7453", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554662, "uuid": "fec99fc2-8bee-4b95-b670-d850ca6243a2", "comment": "Malware payload (Mirai)", "value": "2f743ad03562925c891102b215435bd8edd3897dad64c666776db0a3f4c02a325eb8ab5021925611b92170878837fdf4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554662, "uuid": "350bcf64-8977-4ff5-8a72-64d268e2100c", "value": "T136539C73C8296E54D19582B4B871CB781B63B48482471FFA5BD9C2BA9083DFCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554662, "uuid": "448488d1-6cf2-407d-b94a-edb667bce11a", "value": "1536:JaDwtqKcomlIFZCXaZMYfPkYP+gpK2mP5A/iabC0c/v38Bs/n8a:JwacomlITCXaZMYXkY2gQ2mgiabgXMla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554662, "uuid": "96321040-1837-471f-9fcf-67fc1232daa7", "value": 64464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554662, "uuid": "86f02f56-6717-49dd-b6a3-f162548d65fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554662, "uuid": "46372db6-c042-4cef-91bb-8ca10884f80b", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41822f1b-32a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775582077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582077, "uuid": "f165f98c-4e0d-4909-b8c3-92c1e2810344", "comment": "Malware payload (Mirai)", "value": "ae54e16b1ffdb56290904604f29e66f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582077, "uuid": "0e25485e-d943-4753-a169-e874acbdc68d", "comment": "Malware payload (Mirai)", "value": "597d3214af6f79bb6d197c921dd5dcf63a02a775b069462ef606473552ea1a2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582077, "uuid": "ff9cfe03-fe79-4a36-b88c-9602e606525c", "comment": "Malware payload (Mirai)", "value": "e26773c88cf45b0cd2eadc3a943902af6bed0731", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582077, "uuid": "0745dfee-ba7a-49b4-9dc3-fab448c80ebf", "comment": "Malware payload (Mirai)", "value": "772ad602df0b3b11476bf2c226cc5960e16e143fe8a2fbf9ebde6a1943c03e29eee9e02cffb4cb22b318fb2386308102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775582077, "uuid": "d5aefd1d-45e2-4fa6-b33e-8e84b7a94340", "value": "T1FD348D07AF454D5FC65EC3B01EEB5320C623F63A0723E78F6B606EA12E469D43E5A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775582077, "uuid": "4d13481a-ba28-4e0b-bf00-7df1f73a438e", "value": "6144:+lR9FbWT0rX8srAEjwsMfAuhJ4EVP7bkAsKO:QnNs0TOEbMfAoJ4EVP7bkAsKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775582077, "uuid": "a60a1e9d-486d-4d87-acaf-f1a5794200a2", "value": 244315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775582077, "uuid": "0de09a02-3674-4243-97db-4f914a1e1024", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775582077, "uuid": "37697d45-a39e-4c69-83ee-bd720f256928", "value": "zyre.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5d19cc-32ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775599653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599653, "uuid": "18e9dd34-9b86-420e-9575-b786e93a862c", "comment": "Malware payload (Mirai)", "value": "8294fb83120f6ff39d82bb7a84b18851", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599653, "uuid": "8187139e-eddc-4055-b1d9-00c368873afa", "comment": "Malware payload (Mirai)", "value": "5a9596683c81795db6460a46bf2815d5add974f9abf647886d8c3a8adaf2223c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599653, "uuid": "3e6fad95-64a4-4515-8d74-9230c249ceaa", "comment": "Malware payload (Mirai)", "value": "90a09e18b6f4c9f570d3a27f8ad7cbad668fa1dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599653, "uuid": "8abf5e4b-ca4b-4cf6-be3c-883b3c5a10ea", "comment": "Malware payload (Mirai)", "value": "c01efc6fa3333b050bee0c3b9fc949f9205587456f5fc7be56d66411a7d300f7b9d46546d5035435f30fc77cce01cf27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599653, "uuid": "bc3605b7-b431-4aaa-9e59-6ea5ef1d7b49", "value": "T12BC3194ABD419B02D4D225FAFF6E418933135BB8E3FB3112CD249F64238A9DB0A77615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599653, "uuid": "d4c7de7c-9cb9-48fa-9b81-858493e622b4", "value": "3072:wCQrETiNe94rl7l8L0ag947XIyRwXRtDFcwL7ZlJpb:iPhKoag27XIyRwBtDb7ZlJpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775599653, "uuid": "4603066f-be52-45cf-aa16-ac17a3a59084", "value": 128248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775599653, "uuid": "1eda805e-704e-42bd-8d77-3a068af0b4af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599653, "uuid": "c11a4cbe-3ce9-475e-b994-689d571902c4", "value": "zyre.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e90a36d-3266-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775555014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555014, "uuid": "fc69f608-65ea-4a6d-815e-04944a4a2e08", "comment": "Malware payload (Mirai)", "value": "77a8e0092dc971f4b3c30a09f4a7d5b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555014, "uuid": "80a34199-66ec-401a-a738-ea0082729b40", "comment": "Malware payload (Mirai)", "value": "5b44cb6c83c12221c0fa5b379524e99226bef2c59a742f2126871e932083a692", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555014, "uuid": "77ff8690-d282-41df-8608-98e2d08e855c", "comment": "Malware payload (Mirai)", "value": "c598d6e31fdc2420e4ad7193fddba946135372db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555014, "uuid": "1d5b2420-a1b9-43cd-a8b8-56d3e4538da2", "comment": "Malware payload (Mirai)", "value": "3e350c3faaabfa7b6a2aede775194d6f2e5ffe5965d2959d5d31fe6262a28f40912d208f8ceb479998d4f677895c0ee0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555014, "uuid": "ddd57014-d9e9-4196-886a-7de3d6c193da", "value": "T1C9041946F8819B15D5D112BAFF1E528E33131B7CE3DE72029D246F247BCA86B0E3A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555014, "uuid": "bea5451d-39ad-40ff-b8c0-43854331b60b", "value": "3072:ACbd1A3Tcm6VmymFHCbuVF3jXbNfuG0tea+TTc1EVhfMBC4y:Aiecm6V7mFHtV5XbN2PcaSwyfMBCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775555014, "uuid": "96f73633-08ec-41d5-b658-a8c24bb42d45", "value": 180956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775555014, "uuid": "2f5f6099-05f7-4456-ab59-18e2ef00e559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555014, "uuid": "87d2b786-b4a4-447c-b784-a52e8395f114", "value": "rebirth.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d51dfae-3221-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775525484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775525484, "uuid": "1b2c1db6-d3b8-4e18-aa17-963ac83aafbe", "comment": "Malware payload (ACRStealer)", "value": "785147a58a0042bc3502f68aa1f2042b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775525484, "uuid": "23708182-4de6-409d-97c7-5a74bd02cc1e", "comment": "Malware payload (ACRStealer)", "value": "5c829195264153eb1b2148b1e2cbc0a0d3fd1c18660449ea85b720c92b85cfe8", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775525484, "uuid": "a3463561-28e0-40ee-a7fe-bea037e2d9c9", "comment": "Malware payload (ACRStealer)", "value": "698f72db77244775043f1e9476217f2e2d7809b9", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775525484, "uuid": "f2abbdef-1883-46ce-b043-cb9fefa2d191", "comment": "Malware payload (ACRStealer)", "value": "f4a07c2611561b82bc2fb371430bdc61e6376bb0867076af429f0155141cc583c068324c86149c5a68a01d0543422e50", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775525484, "uuid": "a9bdf999-d5c0-4f70-a7b2-901eafa66ce5", "value": "T100063A0BECBD8DE9C4A9A23484336257BA6478405B3173D72BD0B2682F327F09D75B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775525484, "uuid": "7451eacf-496f-419b-b980-9d9be9fe63e7", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775525484, "uuid": "ed41e194-8d78-4ac4-8a87-4c7368d16008", "value": "49152:SCu2nEcNHSSMn99j+qNXjWARptxj7Qc1WyOnhYay:SUNYHG5yOnhY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775525484, "uuid": "f41aa487-b73d-415b-be7c-ac1547d5cf95", "value": 3743976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775525484, "uuid": "71c0c9a4-30cf-4cdc-98a0-77a523f822a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775525484, "uuid": "df896be4-0902-4804-a185-a0ab13e8ce9b", "value": "SecuriteInfo.com.Win64.MalwareX-gen.43916948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46958d41-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552880, "uuid": "040f7bae-aec4-4410-921f-f11091c8def4", "comment": "Malware payload (Mirai)", "value": "103a5bd8710cae5260a1e719a1196293", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552880, "uuid": "c1315bf3-45bb-4232-b2a2-a6e1fe67df46", "comment": "Malware payload (Mirai)", "value": "5ccdbbdcb876986fff64bc0552856e64c5118faed50655bb3c4b8554bde1c2a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552880, "uuid": "0af9650f-b646-4fbc-ada3-932a6f2b3df3", "comment": "Malware payload (Mirai)", "value": "807b02dcffb85c6232b03638223f067363db4c7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552880, "uuid": "f60e41d9-db4a-4513-ab6c-e9845426f6f5", "comment": "Malware payload (Mirai)", "value": "a44c31ae7e6ee8601bdd20e8f3bbee23fc50eacaee554addc3c4da9c297c3a80b3f8692f2f07ed86f600da2aa713163c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552880, "uuid": "fd45f685-5df7-42ed-9cbd-717aba2967c0", "value": "T1C2A3D91E6F21DFBDF269823147B78A21979833D627E1D685E19CD2005E6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552880, "uuid": "e6c2a185-34e4-4024-ab25-d954bf0ada32", "value": "1536:V4poNIjCa2V5c9mUpZrLNjkWQGjeuvFXz361d64m:rNIjn2V5cBhLdkWfjz25m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552880, "uuid": "e21622de-4ff7-4c70-8e48-8068a5458774", "value": 97912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552880, "uuid": "e8de3250-6a4a-4534-9197-1851e63a2a12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552880, "uuid": "ccb82fac-b873-4099-923a-a2c772eaf530", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a6cde5-3282-11f1-a769-42010a9c0008", "comment": "Malware payload (AmosStealer)", "timestamp": 1775567026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567026, "uuid": "95e94b06-de0c-40fc-bc3f-09fdb442792f", "comment": "Malware payload (AmosStealer)", "value": "c64e1ca801c6496deab1d82cd8adb0ef", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567026, "uuid": "1570d6d8-68cd-4911-bd51-406b628348f4", "comment": "Malware payload (AmosStealer)", "value": "5d52202388cde6395fbaaf19bc8119044653f1de8c0dac2325b1da606b9b3bf4", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567026, "uuid": "ae037c3e-e360-450b-bfe4-8454a376b47f", "comment": "Malware payload (AmosStealer)", "value": "f32343d596a21d629355f52157f19c72ac268f39", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567026, "uuid": "0c71ad88-5a21-46a7-bbd9-b2308693f811", "comment": "Malware payload (AmosStealer)", "value": "6c537e6a32514b0a5283b4ec5feb577cd4f16307f851e3a89620e61c29479617a906170edabbe00e076d3e96b2e8db45", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567026, "uuid": "7aa413c4-99c8-4a21-ac03-805f69edf7a8", "value": "T144F6711DFFE16F4BC55362BE8EAB429272BEC9C4AB43E35B8304731758117A545CE0A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567026, "uuid": "091e4db2-d826-4965-8d0e-7344d888d6e8", "value": "49152:u2Y/5MSwVuR1K8TT+ZWeaKe6fWVlejk4F4MJdeD5YmJmuKK+afCF+DUIlo8ZDDJC:u+B1ZzeaWTejLHkDCmJzu6m+DrnDDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775567026, "uuid": "33eb728b-5766-4e35-ad2a-036cf67fb4dc", "value": 15545496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775567026, "uuid": "651e5690-8022-45ec-985c-352ecf42dbdb", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567026, "uuid": "a5b0e4a1-c9a1-4525-9406-ec3b3dec82b7", "value": "helper", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4270789e-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552873, "uuid": "7923b4ad-ccb6-4f0d-80ae-eedb1d49d16b", "comment": "Malware payload (Mirai)", "value": "6a6307a025b843b0df2519a036f55319", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552873, "uuid": "cd418291-6ed9-4448-896f-60e8e15d20db", "comment": "Malware payload (Mirai)", "value": "5d868a49870a34a407a7642be30c7e85b46979deb501ca3b39d2a4755b15785c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552873, "uuid": "a0585d08-4d92-4190-8759-8ff35e1a89d9", "comment": "Malware payload (Mirai)", "value": "5cdb6dec89b546bd16ed8f640c1621c0b4df2b96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552873, "uuid": "07fd6d4e-1c61-4d1b-b39b-e729f80ad38e", "comment": "Malware payload (Mirai)", "value": "09dc3f73770b28f78d7db13660d1a1c5fc780a8e594a7825550ccf15ec3f0f57f8fcb44d7f4ca09b45b983563eb0f191", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552873, "uuid": "98cb1e7d-ea05-4449-a03a-e9171f971f49", "value": "T110A30709AB650FF7DC6FCD3706E9070635CC651A22F97B3A3634C918B60B64B5AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552873, "uuid": "ddd2a9d7-2e4e-4430-8a7a-a17cbf1ad0ea", "value": "1536:uJri55uEJPlFZLBCALbF88QUW/M1ms56XGZDQ+wbp4lx9LJxXY61d6cM:A+3uEJ93bxW/w6XGkmRxX1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552873, "uuid": "15073015-0c15-435d-b211-12ec0fc11924", "value": 99560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552873, "uuid": "f6ee8b0d-d5b7-4a09-b426-65888dd4077c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552873, "uuid": "6324d77d-a1d9-4acf-8375-4d0dfa9f6cfe", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0ba76f-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554203, "uuid": "d6f1cb9b-c2c3-40a1-9d9d-ab81182f0fb0", "comment": "Malware payload (Mirai)", "value": "186f2335977a316804b440537167ec15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554203, "uuid": "453503e7-bc2d-4a5f-af6a-6e00dcf2f452", "comment": "Malware payload (Mirai)", "value": "5f29d1ed932901b1f5f66fa4dd5b55c8c2fc77c60d7e8cda840cf0bc4a11ee53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554203, "uuid": "2a119334-1106-47f9-b908-f02bd9fb14a3", "comment": "Malware payload (Mirai)", "value": "38c1c43d7f58e5f2ff2f77f96e4ace1b1087f6c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554203, "uuid": "7c108500-8f25-474c-aef2-943273e7b9f8", "comment": "Malware payload (Mirai)", "value": "8383228f1e9b2598f653f682a053dd36de8d4fe10dd843c4e02878f8df20af0841669afdc7d5325efa890c6164148223", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554203, "uuid": "30293c85-fbc8-4b7e-b1f5-1b5af1bf5161", "value": "T1BC733985F987C6F2C407483042ABFB3FCB32D8A511B19B4DDF569F35DA33502AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554203, "uuid": "0737649f-b811-46dc-a17a-247d32170a84", "value": "1536:8A9Uqtm/qzBpeKm2XpQmj7qWSICRzBbkivom3aJ2/dLNn:8A9U7KBcKm2Xp3jnrCRzBbVvf/dLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554203, "uuid": "29753019-db37-4aab-a2ce-2ddb284acd0b", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554203, "uuid": "99fb138b-b968-4572-8c96-8d95e2edc7f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554203, "uuid": "8565fa7f-b8d8-4f59-8634-65961f9999ec", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68faf41-32b3-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775588313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588313, "uuid": "00e8a2f3-ce7c-421f-b750-5e2079cd846f", "comment": "Malware payload (RustyStealer)", "value": "4e446f752e27a58cea1e4aa601ec195e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588313, "uuid": "f0873b62-50dd-400d-b26c-3ce798898d1b", "comment": "Malware payload (RustyStealer)", "value": "63d81be212ebb69379fad022425480f7c4434ecfe4ce7ee3e3dd2c5d16bd4459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588313, "uuid": "4dc5716a-2919-4785-b9a9-3291fdf15da5", "comment": "Malware payload (RustyStealer)", "value": "a3888b9bd5c0158280177e9640d539be837cde80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588313, "uuid": "b9d19e3c-aa03-4d34-a782-3cefd12a1da4", "comment": "Malware payload (RustyStealer)", "value": "0aad5c0c10915e1818e20fa2b74fb5d83572ca20bd1e27a73d66076bea631b758033162e92e93f7aaef939dbcddb6cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588313, "uuid": "cf40242c-01de-4f15-988d-10388978c53a", "value": "T167C5E1836904A74CC61FA77C82FAAC3145EF3EDE6F1688AC71496643E736290579B01F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588313, "uuid": "4beeb8bd-095b-4fd7-aa69-db9cd2452460", "value": "eb3d37cae5b55ff788a6ad9ecd9d46f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588313, "uuid": "2f2bb9ef-ce37-4ddb-9f3d-5e6189d38c7b", "value": "49152:BmuVb3QbRkaThoWj/8aSedZEFBU1aXugGT4ZNoJ2j0eUjUE9PajIy:BmGbY/1SeD1G3GTgNaIAjUEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775588313, "uuid": "c2338b32-5e19-4f0a-a717-ec84c23782f9", "value": 2696192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775588313, "uuid": "b8371033-52f3-42b9-80f5-2c318530d5cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588313, "uuid": "1b8ba9a6-af4f-48ad-baa8-1fa06d33689c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b7bf4c-3261-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775553150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553150, "uuid": "9ea4b01e-c43c-456d-85cb-239e7d8417a5", "comment": "Malware payload", "value": "9f0784a631d143576bac18f31bca3a25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553150, "uuid": "195df8a2-06e9-49e7-b6cc-4d19dd5c11e9", "comment": "Malware payload", "value": "64793adbade0212092bdaf1d07ac6442c635fdeac45ac8e2ced9d8397e06a8ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553150, "uuid": "a214ce5d-960c-439f-acd0-54f9dee2b18a", "comment": "Malware payload", "value": "35f0b3e233a09ed4c3dffbc8254dda34c249b107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553150, "uuid": "de259bfe-bf45-4f76-96e1-441af48c3f59", "comment": "Malware payload", "value": "f5c0cb8dbee0e2098cad7d5008ac5ed8039eb770162296fb5e45e468b6c070d5c3502f94840fb839095d10f3d74735cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553150, "uuid": "2b19f634-a166-41fc-9732-e3556a3eb872", "value": "T1A4185B4ABA41CD8BF5619134D8938FE46376EC71CA71872332A83B2D7FFE2484DA1594", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553150, "uuid": "22435b5a-e285-421b-8f40-0bb1239c8b09", "value": "a5396d0e3a0b90f35cda230c0314ce27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553150, "uuid": "bce22e52-2bc1-462a-84c7-d4071fa98003", "value": "786432:6KS0huYvglTaQvXZ0uaMROe63unQXeNL+VerXl+9YKX2VGCrwNRlYSjR0vOJm:vSV/yuaMRP63unQOiYujgwNge0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553150, "uuid": "875fad91-e3c3-4b6f-b0c5-7383ee8f58ee", "value": 88632280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553150, "uuid": "ad84121f-dfd1-4476-8b9c-da236bbf63a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553150, "uuid": "f9fadba7-51be-4d48-a668-f2e160442ba7", "value": "install.3.2.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c582ac-3285-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775568236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568236, "uuid": "6831ef1f-37e8-4dfd-85f3-34f4fe5b5976", "comment": "Malware payload", "value": "5f430c966016fe681cbcbcb4498f0056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568236, "uuid": "ffd0a920-8fac-4fd2-b70c-f512ccbd353f", "comment": "Malware payload", "value": "647b19153ec08bf1f2614f7101f274aff72061ac519d354036bcd272286405ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568236, "uuid": "4340c93b-6a36-4884-b7f5-a293de1657de", "comment": "Malware payload", "value": "f8096616b630024185c220f3ec57d9935c724417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568236, "uuid": "587035d1-7eb6-4021-b0c3-c2ed5ea48677", "comment": "Malware payload", "value": "650a2b136938ebe80e96ecc373592b756791590eac811f425ba23c377a5463807485b0aca38951eba4dea4968f572583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568236, "uuid": "8d9fea4d-bb4b-4f6c-a7dd-30b6b64f0f75", "value": "T11E3723D741E687F9D3C34708514B03CEA5C0A59AD2DE9A3C39CB9802B664D5A82CBF77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568236, "uuid": "480398ba-38c5-4bce-a594-d460ece78733", "value": "a82f5e9623ef5a7e8899ce2c8ab68f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568236, "uuid": "4431c431-c7f4-43d5-83ae-5fd28f0d68e8", "value": "393216:gGqyOJHSVvYmB17PniIfBA6J17wgqMpqZfEPS:gB7HSVfvni27wgqMpqKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775568236, "uuid": "41a67b20-a3ad-4bbd-96d2-7f7059632c73", "value": 22859704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775568236, "uuid": "556dd6c7-6df9-4d4d-8bd0-b9ae46e78515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568236, "uuid": "80be8e80-2a6a-4224-910b-56ca0c6c8842", "value": "Cs2Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6781c1c6-3262-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775553364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553364, "uuid": "cfbe010c-3e82-499e-af6f-340cf81ccc0a", "comment": "Malware payload", "value": "f6a8a21c5cb01f4dd71bd21850f08858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553364, "uuid": "c8b4dd35-e4ec-4798-b7ca-ae064d394810", "comment": "Malware payload", "value": "6484f38379115886de33ddd0482278d1a00030c41dfe94bcd1e3d0cc02d6becc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553364, "uuid": "238631ca-f60e-4559-9499-136a68342351", "comment": "Malware payload", "value": "09976e638cd35602893ace46520ea87e6ebe41fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553364, "uuid": "536d2942-77c1-40fc-9637-3b0d9bc94840", "comment": "Malware payload", "value": "9684ecc44f145b3f614ced430857189d1f52d9b631510a2061c64ebf5e7c406ceaa7d6c879fd4f45ce6b741a63e70f88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553364, "uuid": "2c715141-a1a8-42aa-adb8-44ab1694cf58", "value": "T130067CCBB1AA52A9D4B3C13886A7D55BE6727C02CF2096DF125CB3085A736F05D3B358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553364, "uuid": "1419f677-0201-4402-beb9-59265474f36e", "value": "f52ca80f0cc32392621db9fffb0dc638", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553364, "uuid": "d32b3f77-a057-4399-a0bf-c2e02034c9ef", "value": "49152:hubkqh8nmTVDPiNURiLDcn/d6DpwdWnt0Tu/+QP2fjJsv6tWKFdu9CJPTvG7UmtW:N2YU8fh9WQkjJsv6tWKFdu9CJi4+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553364, "uuid": "05f6c443-e483-4e66-af96-fd5d284d7f38", "value": 3661312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553364, "uuid": "de1c5c1d-eb6b-4f8f-a69d-c5b531babd03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553364, "uuid": "58c311ed-46ff-4b15-9919-56a0fd2e8078", "value": "\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d00f61-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553006, "uuid": "745f0ac5-e3f1-42aa-9f69-2440094c9e48", "comment": "Malware payload (Mirai)", "value": "f1d676fd24e617b60f13e9a26a30d588", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553006, "uuid": "9c2804e1-e2a9-40ee-8d05-be1e560160c0", "comment": "Malware payload (Mirai)", "value": "64c61dde6c042fa3a3216dc5c55368d34f9a4685c71f34be343f94a45bbdd9d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553006, "uuid": "e4646bd1-a83b-40eb-af29-94c972f9bbe1", "comment": "Malware payload (Mirai)", "value": "5b2ae7f730aa8a9d8b2144be71fd9df69771cd97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553006, "uuid": "164a81f6-2a2e-4b8c-9666-faf63efc3aae", "comment": "Malware payload (Mirai)", "value": "5a389fe4494cb1854229cfd710a487048c5e83012297acf6bc85d4a39f5bdd9a77ae22149f02db357053804b75f75804", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553006, "uuid": "9045dfdd-d4dd-44fb-a1f3-b3184240455b", "value": "T1ADD2D13943666EB8E4600C31D829EBDBAFA25674D15674BB11C8427DCDE938322F43CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553006, "uuid": "72556b2a-5cb7-4233-95c6-4d16a64872b2", "value": "768:GihR5EPaiYrWJ/HGTBoLo31zwT9q3UELdt:G8RefpmTp31cSLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553006, "uuid": "09e1269c-14c1-4de6-9ebd-65653074eafa", "value": 30072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553006, "uuid": "f0610168-bbde-4aa7-b94e-693c3642e21c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553006, "uuid": "fa7d0415-f257-45c7-9968-8bf1f9b9176f", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a02b110-326f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775558979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558979, "uuid": "6318d1b4-2124-423f-8545-6c5d417ef862", "comment": "Malware payload", "value": "21bd206caa57b283da3921aa29f4bd45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558979, "uuid": "a8be264d-539f-4180-be7a-257de7b345c4", "comment": "Malware payload", "value": "6504beca0e9040c1e220db44d078f6bbdb7f7c2fcb7cd366408e915c174d15f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558979, "uuid": "1c6cb66d-adaa-4e17-bad8-5e90a9551f69", "comment": "Malware payload", "value": "2f736c0df06150026c7a85542170d522d594e8df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558979, "uuid": "07508ff6-65ed-45a0-b64a-29e01d25a9f5", "comment": "Malware payload", "value": "4b9dfd6dad4328234b53b2339446854a41616899e38b21ed142be40250f7c8575c91ef6722d8d8ef6205c492cc174553", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558979, "uuid": "ed1a3198-8bdd-4b01-a1bf-58b72ec0a421", "value": "T132A31959F880DB6186D138B9F64D06AC73034B7DD2EB7105DA256B343BEB8AB0B3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558979, "uuid": "4046740c-0494-4343-a007-c21bd686dce9", "value": "1536:ZxriQLJxA8XXJrhvDRIrtk6lz2HulBDYKIpVFDcqw/xlfYHMQXbUQGOT62qYUyoM:/rFLrNvCrYulUFm/xxAMQ5d2U+je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775558979, "uuid": "bc995e53-97ee-42b4-813a-2eb563ae9227", "value": 104026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775558979, "uuid": "8e337337-e884-4e3a-8db2-4c82b1430250", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558979, "uuid": "21c23cca-a659-49a6-9bbc-48a6ca71159f", "value": "siackarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bea829b-323f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775538178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538178, "uuid": "0c7a3e36-05f9-425d-8a96-bb38c69fa9f9", "comment": "Malware payload (Mirai)", "value": "f6c2d21fd98d6052868377f44ed4326f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538178, "uuid": "2386bed8-5e5c-4828-9f5b-81095144e6b9", "comment": "Malware payload (Mirai)", "value": "65412fae549a84301426b245ee48fe8e6a1a7c19d5f103375d5a9d668b51ab4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538178, "uuid": "bffdaade-d64d-4d15-8e6f-02f9111dcde2", "comment": "Malware payload (Mirai)", "value": "c7a0a35e2f6846d3231a7da21444cbe7d18fae2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538178, "uuid": "aa680b44-902a-427a-914c-c481d6431326", "comment": "Malware payload (Mirai)", "value": "536a39f8727b2b253c35f883c84921906ac754508cca1f53ecef69faacac3ccc3ff5c82094dd04cfb44dc508ab8121bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538178, "uuid": "cddce5db-89fa-4c66-8149-7be01c179a2b", "value": "T1EC833B27BE324F17C4C2B2B511F30B31E9F5ABAA2C78851ABD612DDD6B142D031577A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538178, "uuid": "bdd71e3d-7099-4edc-82bb-d0d2400c8af4", "value": "1536:BPVXN1BKL9ClVIy3K8rUIg37tmYo95UVwtdBZ:BVXN6owgKxTsYoPUVSBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775538178, "uuid": "91bd2708-8767-441d-8687-dfa60d4b53e7", "value": 87304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775538178, "uuid": "82bc150d-0869-4d0c-9a1e-a02a153f7d47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538178, "uuid": "1d638099-804c-4f5b-92ab-d00300dadd5d", "value": "zyre.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f91c09e-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552895, "uuid": "7c0a3ba6-2a44-4a76-8979-ae6a9160ffba", "comment": "Malware payload (Mirai)", "value": "c31fb9d56cb4797e77a91d9cabe29f2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552895, "uuid": "1164b082-628b-45f9-ac5f-781402916737", "comment": "Malware payload (Mirai)", "value": "67bbad33a7614b225afb3b1403279ed2a8ec4305fe3be4eb104b09b2c1491894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552895, "uuid": "f4349549-2a88-4768-98eb-34a47f36d60a", "comment": "Malware payload (Mirai)", "value": "172b175f933a54f26bf45c7a9d81cc295d83ca9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552895, "uuid": "97e11b0e-9d7c-4fba-8f18-f7c9a997838d", "comment": "Malware payload (Mirai)", "value": "1f385d3e99518e0b8d8663a9b5a34b1e00512cea0e1aa210923a5267926700f8e8c066037206241fd700bf52e4a0e454", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552895, "uuid": "015e77ee-ad37-48ba-b4aa-90e2bf9283f8", "value": "T1D7734B42731C0B47D0A35DF42E3F27D093BEAA9120E4FA85651E9B4692B5E331196FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552895, "uuid": "9ece0f6f-b1de-482d-be74-8c00e8e8cae1", "value": "1536:fzAs6AEpRS5XGAkwYJzXah14IN7w+08WKF2Bs561d6ER:ft4RHk14I6+Rut9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552895, "uuid": "3f150093-c53b-45f1-9b81-f2e7625b2fce", "value": 77412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552895, "uuid": "ca84a62e-ebf6-4ab8-8095-2429f860e97e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552895, "uuid": "cb088649-9dc4-41d3-adca-27a0bab86fb9", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ace564-326f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775559005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775559005, "uuid": "4e7fd6cb-02c7-4f06-8e1e-0dc90c756635", "comment": "Malware payload", "value": "e559c9488d0333578f896d793ec40e06", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775559005, "uuid": "656bc66d-8adb-4e2c-947e-019e2ad72087", "comment": "Malware payload", "value": "68829f1aaf370b9199d3b3ceb90ddb1516caef6582369aa4ca1740c7d617de70", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775559005, "uuid": "ab59ebfc-6da2-4364-b741-10f86c0ba06f", "comment": "Malware payload", "value": "30eacf48cd7bcf6c9ba59614b5a36896f721e59b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775559005, "uuid": "68ff5775-e02a-48e2-9227-59867961fa2a", "comment": "Malware payload", "value": "7181f8bf2a6a0cce6c974cec47b4dd1c03916fdc13050f36f7aa2abb8636052ab4566f94395c9313610e118c335020cc", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775559005, "uuid": "1459fbee-a719-4dd3-9b6b-599e2c0aea8f", "value": "T1EE125125DD648AC48A7FB7A049687C1AE185222383644D59FCCC548E3F3936EEF652CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775559005, "uuid": "87509e22-0558-4dcf-a5ff-fd0e16d5aaa0", "value": "96:bc35GMTm4mjaxDQ2L/IYMjv54mRXHjDwPXPtNQIGU/Gfp9LPtNQIGU/tfBDYPtNm:opTBJUayU/OyU/7EyU/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775559005, "uuid": "cd38c27b-afc2-40dc-90a0-9a61a5d66acb", "value": 9762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775559005, "uuid": "b5ecccb5-a48e-4a1a-a1e1-4ca9a82d8f92", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775559005, "uuid": "d6335703-1717-45bd-92da-2e8f7973bbad", "value": "Denvers_presentation-03.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533219d0-326c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775557625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557625, "uuid": "66fe068e-91cb-4622-8f37-53980c0ec75a", "comment": "Malware payload (NetSupport)", "value": "2c89cd01f443a82e0c897d5d2cc895ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557625, "uuid": "5107e3f4-4918-441d-8a4e-d44f333eb068", "comment": "Malware payload (NetSupport)", "value": "688d98d5c9bea350ebdd7550d1d927fe55baaa9daf2e139512a629c40deda1d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557625, "uuid": "89617647-25f7-47e5-a71d-a2ea4efb5ce8", "comment": "Malware payload (NetSupport)", "value": "0e5a7daf45c96b5045956c9f6c91c0eac9545aac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557625, "uuid": "293a9373-5860-4ee0-93d1-ef397fda9766", "comment": "Malware payload (NetSupport)", "value": "3699bb8ed70120801d7b237d7e9654ef237782663a05fdfa552168caf322c5f6605f920ae7b1b52730aeba596554c0a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557625, "uuid": "6e65f36c-765d-4ca1-be8b-b36bf7906e57", "value": "T184F55B0BEDB94CE9C0A5E1344473A516BE25B8401B2173E72BE4B3682F737F09976B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557625, "uuid": "b182365b-4363-4f00-bfc3-e10cb77ac87b", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557625, "uuid": "3ca4c1a1-0317-4d57-8d8b-b4dbf067b2df", "value": "49152:EOy8gBxMVfVA2S2QmZ9ljinwGtJPjdQclk9:E/4XjH2ny1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775557625, "uuid": "27a30286-f553-48fa-82f1-caf50ceae8bf", "value": 3495528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775557625, "uuid": "9797948c-f812-4b95-8b8d-586ff5ff1e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557625, "uuid": "4c7974a8-5035-4a83-a847-135e212bf118", "value": "SecuriteInfo.com.Win64.MalwareX-gen.15248466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960dbd1b-32d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775602405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602405, "uuid": "efe886e9-eec5-4c38-a909-91d75e35da40", "comment": "Malware payload (Mirai)", "value": "b5ebaa9bac238391137ca2a11b749961", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602405, "uuid": "40f82ee4-0016-49e7-8181-a47f5d0a0be6", "comment": "Malware payload (Mirai)", "value": "69e95ce0326e388457b3dd33562f76cbbd4a48af3ac7a577bacd5d3d7a1248a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602405, "uuid": "91f4d1ac-b540-44b2-81b4-74d25df5d51e", "comment": "Malware payload (Mirai)", "value": "0b5c34298ea937e80963c17b1786896cec665e37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602405, "uuid": "5d832b19-9a8c-4117-ae09-170649c01661", "comment": "Malware payload (Mirai)", "value": "089fd15ac21ea0c842f1a5638f55c2e430e8623b3c48f1201badef82e338f184132c06936739d8279a3894280143bedb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602405, "uuid": "66899080-28ce-4af0-bdac-189f2250772c", "value": "T16642C107DA3BE09EC0A27CB7514C136C19CC9BF4DE7529245686691787490EF097F84F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602405, "uuid": "31186b09-7bf6-46de-a8a6-b878a07c0ee9", "value": "192:EczJ6NpLdASO2hjhA18Vo/SD0U0cEA/zwJRxEaoRB4b5AxH6AwgNkDYnBjrW8TLs:V+LGSFhAZ/O0cEA/KEaoRC0ugOabHB+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775602405, "uuid": "d05e272f-41d3-424e-b403-ebaf2fca72f2", "value": 13032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775602405, "uuid": "d1dea26e-c233-4ea7-955e-95f1c5737a44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602405, "uuid": "bbef3446-3d2b-49b1-b180-e2825cd64956", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93e7a6e-3279-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563461, "uuid": "708c771c-79db-4f8c-b6a7-22dd388b13df", "comment": "Malware payload", "value": "bfc5ebe47864c33c1c707c3d5bafc771", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563461, "uuid": "db5d5c04-b3c1-4362-ae80-aa0bf05c1e72", "comment": "Malware payload", "value": "6ae294cb5c71118350342e6a26350d0e95ea23d0548125b09056efa0ea19bf45", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563461, "uuid": "7340dd20-d98b-453a-95d1-fe4ea07263cf", "comment": "Malware payload", "value": "0d894c8c8668d7c3a1e6c853547ab467d5d46b42", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563461, "uuid": "3d570ec3-1234-4201-89ce-814d76c00bcc", "comment": "Malware payload", "value": "11732adc0817c8cc31649980bdcb13db31a4fbf1ed678a44135d2d755f2b11c9263ab2a086d044129a55e6e1fd67936d", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563461, "uuid": "ae1b0ab4-98c3-4888-85d1-7bda6b30288c", "value": "T188524A4285641C03DE469DB0A2D8EF17A97D73832B5086D7276CC4006F937D2B77A2BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563461, "uuid": "b02a89a9-3c49-4fd1-b39e-3646fe0d7ed4", "value": "8f807f5d16a7d2b173533a187d77dfcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563461, "uuid": "d0ac47b4-10f8-4544-a79b-767b9ad9e9e7", "value": "192:GqMV7PghXDEwXEhYCfzqgS35IVnEy2sE9jBF0NynI:GqMVQyh3bnSJIVE8E9VF0NynI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563461, "uuid": "fdc4d5c7-a3f6-42cc-b1f3-e7b808bc11fa", "value": 14416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563461, "uuid": "531401d7-467d-456c-8ffa-2e6b7f7b24e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563461, "uuid": "66ceed28-c44a-4a8b-8066-87b0c1d7f37f", "value": "EtwTraceHook.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc62111-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561908, "uuid": "0b83224c-d744-4138-8527-56b1abeecf07", "comment": "Malware payload (Mirai)", "value": "e3a631ca6c08ee7cc27a0a96f9122873", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561908, "uuid": "02209ac8-8469-40fc-982e-32b87dacc656", "comment": "Malware payload (Mirai)", "value": "6b351c7b87eccc9d64db56547bedf0972480a77eb9bcb22f6703a361a610c56f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561908, "uuid": "fa55470a-32bf-4eec-b19f-767836ea74ea", "comment": "Malware payload (Mirai)", "value": "ab10a21078e7dc17b179b7ea99eddd31bb1a484f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561908, "uuid": "412c3e93-adc7-43e5-8571-47155e377f39", "comment": "Malware payload (Mirai)", "value": "52021394d77b7328027cf192b9e3e00d987d7e35c2ad1e203fab052ca47efc22b18f8c497c6afd909949878a9d64ec52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561908, "uuid": "702175b4-a830-423e-9e9b-b8cc4d743b45", "value": "T1C7E31802770D4F03D1533EF03B3B27E087AFEDA228B4A584655EBEC98271AB16545E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561908, "uuid": "8a485854-090f-4cb4-a479-92c6a2909f14", "value": "1536:1KqbIyDTVxAdExSoFlxBi6IvqRAIJLvA7WXAXU9J52drs6O5D+ReLC:9bIoTVxDSoFlxgZI27JS1KoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561908, "uuid": "5c771068-b89d-4cf5-9fbd-e98f67d98d02", "value": 155464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561908, "uuid": "7a8ae514-b5df-4040-96eb-d9fbd4b3b275", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561908, "uuid": "afca988e-9d3e-440e-9271-783a34caae2d", "value": "nppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2127e850-325f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775551958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551958, "uuid": "dab3c2c9-72bc-49e5-aa0f-1e76387ca5ce", "comment": "Malware payload", "value": "9503509c61f97eb02bae5a957405f7ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551958, "uuid": "353b3fe0-6859-478b-94af-3763c06c1137", "comment": "Malware payload", "value": "6b6661e8cb0dae1e6603aeb486a35f7a9dbb9822c5a6062bda567e22aa420dfc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551958, "uuid": "04a628eb-3731-48fd-9de7-8a7780e3b0b5", "comment": "Malware payload", "value": "c0af79f0dca83ad8d20ba1c13a6deab75bb83d78", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551958, "uuid": "fc368cf5-d92e-4855-959b-d49d78c6ad2b", "comment": "Malware payload", "value": "57ab010a23f9ee593d7b943ccb0937714fab4b7ee2ae29751f4cc2b971d9fa515105b941c8a0891fc235c331e2d1482f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551958, "uuid": "169049b3-4801-477d-9a07-35d6b95a1312", "value": "T1CC3166567C03C9DF83A283AF291701C591D8CDC19A9D84C2F118FC9878DA99D8387BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551958, "uuid": "588258aa-d521-4e6e-a0df-329f561635a5", "value": "24:4qhsB1dKL9yqlyqk6QwNlOMIl2u4fg6t682QTRQVDzRtWLfNEVPDV0Yf:WrsMqQqk6rlOJl2Lf2Q1QVptQGVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775551958, "uuid": "8924c9af-13b9-47d9-90bb-209311723ba8", "value": 1652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775551958, "uuid": "9d7b4cf1-b06c-4856-9fef-ba5fcd31b7aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551958, "uuid": "8180fca8-e3f4-43cf-a065-2d8c8c4e6e5b", "value": "6b6661e8cb0dae1e6603aeb486a35f7a9dbb9822c5a6062bda567e22aa420dfc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f26bc4d-32b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775587683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775587683, "uuid": "3d688853-c834-4f4c-98d6-913fc11a6098", "comment": "Malware payload", "value": "83bdc7e5599f277b84feac9764374327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775587683, "uuid": "d8ea9dbd-9c16-4c99-aece-e0107bfeb94c", "comment": "Malware payload", "value": "6c0fd2a8e40c7ea02e05bc7cba49eb48da4cdcb1132b6c63c2e126f549f59959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775587683, "uuid": "19697e1a-0846-4753-a47e-56ef02747f8a", "comment": "Malware payload", "value": "224fd785238d0d69746c678f8f5aa08d2d8c8940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775587683, "uuid": "01c7c2d4-239d-4a20-aac2-9d5badec7513", "comment": "Malware payload", "value": "1b291fdbcf5bef03b8be7a47aaf992bfc15ec37a82011f1eb059845aa15b05d9f5018217894a243c317ab55db50bbd5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775587683, "uuid": "f9387a02-6c1d-420f-9dbd-838be86b1cd8", "value": "T1EAE6BF07EC9515E9C4AEE234CA229253BA717C495B3173D72B90FB282F77BD06A79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775587683, "uuid": "0f4f9b47-0edf-45f1-82dd-98ce8e1c77dd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775587683, "uuid": "5f66c691-5446-4a86-8601-936d07e7b0f1", "value": "196608:XeNSE051muG/CNUJB0HXZ2ljM/eweFTc4CZ9LuSLuT8l9UMMh65W:XeNSr1gWSVygBc4CvuSLur4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775587683, "uuid": "822a9d01-c4e8-44e2-a753-c387c3c21949", "value": 14157312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775587683, "uuid": "c946c42f-49be-44d6-b903-55517e8c2d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775587683, "uuid": "1db97d1d-1e57-479f-8e94-d7ea85665f4e", "value": "AdoptMeScript.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79314b86-32d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775601068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601068, "uuid": "dc61c835-4665-4bb7-9dfc-b092e47ea308", "comment": "Malware payload", "value": "d681e3291ee4dbf1c8bd5a64bf6d94c9", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601068, "uuid": "5124c21d-9fd6-4f8d-8884-a61c4052d67b", "comment": "Malware payload", "value": "6d3fcf2c966e3657a9d5046b54076da1a6478d9c8147129f6d63463421b56bd1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601068, "uuid": "991c9070-be9d-4766-a239-8f5247baa016", "comment": "Malware payload", "value": "643ef97ebfe66966e6496e6f1bcd7bcf228e3aae", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601068, "uuid": "79ccb890-921e-4098-a43c-655350d9c3df", "comment": "Malware payload", "value": "4b67ef5c4b96f9aa2fae85b815ccb5bc78f7f644a308dad01501c1b818cf6170207f07e8789228cc1ad52154e31f80e1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601068, "uuid": "01b5e3b4-c89d-458b-87d1-9a86f1f66ab6", "value": "T15904BCD68DC989EC974F6064014F6C06D64E9223472DC594BAEE6E5ABF23DE070FB6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601068, "uuid": "f7359ad9-6155-417b-b3bc-ebd2a42c0653", "value": "1536:3CxxxH0rf0rF0rh0r0UxdTzeEzAGHg/WriQE3BKV9FrXwn+6uW2h7:YS3u9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775601068, "uuid": "8959a184-98cf-4540-a41b-766d7b6af158", "value": 178841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775601068, "uuid": "c847f13b-2a9c-48df-aa8f-c430504ea627", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601068, "uuid": "8482eda2-c418-4769-bce8-c06f6817b43e", "value": "X_Snapshot_Summer_7602.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f39f0c-324b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775543374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543374, "uuid": "7a5b9869-9de5-428f-b442-5a01a92e461d", "comment": "Malware payload (Formbook)", "value": "153cec9f7d46d86ace79ee67c2588b31", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-maxbotfinance-ru", "colour": "#3BD072", "exportable": true, "hide_tag": false }, { "name": "www-xg66s-sbs", "colour": "#423F2D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543374, "uuid": "c7fe90aa-1b57-49d8-b8ee-e636aea1c8b1", "comment": "Malware payload (Formbook)", "value": "6d43947b19ef37886ac6c729ee5ef213b7044c7b5e8aaba66239d88696a9be99", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-maxbotfinance-ru", "colour": "#3BD072", "exportable": true, "hide_tag": false }, { "name": "www-xg66s-sbs", "colour": "#423F2D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543374, "uuid": "a3b83729-3f0d-4432-ba77-a6f1d33ad2f6", "comment": "Malware payload (Formbook)", "value": "a2ac56df9bed65cd090a43d2be63aa5a9ff95c74", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-maxbotfinance-ru", "colour": "#3BD072", "exportable": true, "hide_tag": false }, { "name": "www-xg66s-sbs", "colour": "#423F2D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543374, "uuid": "48cc7855-db80-4b6d-aefb-78ff376c8747", "comment": "Malware payload (Formbook)", "value": "514b0fde858bfd1a4c8601589125541157449134161257b860e960c08df38f2cf49f854fa3e110eab47962213cc4d03a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-maxbotfinance-ru", "colour": "#3BD072", "exportable": true, "hide_tag": false }, { "name": "www-xg66s-sbs", "colour": "#423F2D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543374, "uuid": "cf7c92b4-2225-4d01-968e-67564179d0c7", "value": "T13B95025149C43FB5CF985A1D50FE160EE3B14E8AA01AA589FB73FD4BBFBB600511B098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543374, "uuid": "fd3fd56b-ca56-470d-96c4-e2455563ff37", "value": "24576:88DwDJWMw9w1gCT0tN8zJfAUelqrlJ0dbyckgU3js0coroLEJsHZHRdIwi3q:fMNH37TGiMmlUhxU3jzrQcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775543374, "uuid": "9ca06eec-0173-4007-ab77-4481fcd6ce34", "value": 1975683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775543374, "uuid": "12627342-6bb4-4c3f-910f-97be240e76e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543374, "uuid": "0e4f908d-16c5-4bb2-9148-8b29108a310f", "value": "Order Acceptance.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc9ac006-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775562124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562124, "uuid": "45010e5c-d06b-4fa1-8563-b6ede8e5256d", "comment": "Malware payload (Mirai)", "value": "7d3de077f62c9f7c89935edae52e49e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562124, "uuid": "583362df-4ded-4f87-ad14-785ec7dfa47d", "comment": "Malware payload (Mirai)", "value": "6db301aa5e53ed0a4a957df6efdc30bfbe7dcea81a1d1aaeefd0b1b1a987fe60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562124, "uuid": "5a7f7819-1d05-48eb-a97c-b9ef3fe2c1a4", "comment": "Malware payload (Mirai)", "value": "811d6c2cd50f0ecd9b145ca24b2f5d2a1b9d9860", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562124, "uuid": "4966794e-a205-41ab-93a7-435062fd41eb", "comment": "Malware payload (Mirai)", "value": "0d360aed192c25e5daf04ca819b8255b6f35808a2a491ce8bd89d41229b467ea36aae482e0ac607d9a992eeb07e706a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562124, "uuid": "a88e3acd-3f98-46b3-9a1a-1549f025e781", "value": "T13F94A713D9118991E0654CF2227B3245B94787BB8AE732D3ED1A4EB0BF2151F46BBEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562124, "uuid": "a05d8a32-5476-49eb-91fd-9cfa1ec59228", "value": "6144:1ZWGEO1Ybla1X56sO5W+Q64jov12IsM/9tIyT:1d1Ybla1X56sbdHjkvt/M0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562124, "uuid": "9a4bb8b3-c00a-4433-b729-ef5042dfa0a2", "value": 410214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562124, "uuid": "3d7b5c75-00cb-41db-b6e7-6e1296c2725e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562124, "uuid": "65f2ecea-1eb2-4737-a5ce-b8f382827e12", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e633844-323b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775536491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775536491, "uuid": "859ead84-0c59-4aeb-82ea-69cf9b78dc7b", "comment": "Malware payload (Mirai)", "value": "71a2946098c052d61ceb38643a8baa71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775536491, "uuid": "90bb0be3-80c4-4580-9b71-dc7b2b0a4432", "comment": "Malware payload (Mirai)", "value": "6e6a4673bdc231796796d11752086a0899d60b5818623df6b0254baab71f2e58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775536491, "uuid": "70de8bde-94f3-4bb5-8d24-80f84ffe6d76", "comment": "Malware payload (Mirai)", "value": "586214bd7f5f06ed4f9d31a02cf76fff8a92ca6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775536491, "uuid": "cf5d6410-b757-4b7a-a362-337dbc533fc5", "comment": "Malware payload (Mirai)", "value": "08a81a3e22a062ca34c6db0e6b663ba50db82ac03237051a257ede0116090b68e684762502abdd861c610de9ad157828", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775536491, "uuid": "72ab7574-9bf3-4832-b682-9ca2df6f4490", "value": "T187A3F602EF614FBBC86FDD7306B90A12398C6D5B36B927657974EC18B6161C70AE3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775536491, "uuid": "8f318123-ea6f-453d-9645-3a5c5cc5d027", "value": "1536:U9X6yJGq43hUw/r3MgZ5uEuffL3k+NG5CsbHrLrL2ybZtURGf3xBg0FyEMp:2X1GNjc0V/L2CL2A0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775536491, "uuid": "6a7cbf9a-6791-449f-9a8c-40e014d88e08", "value": 104348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775536491, "uuid": "d0c41efd-726d-4371-9974-ab052b5b0e96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775536491, "uuid": "bfcdf96d-587b-44fd-90eb-a8dfcd49f1b6", "value": "zyre.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee498c6-3232-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775532761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775532761, "uuid": "2ff62d65-02dc-42ca-817d-86e8b374c62a", "comment": "Malware payload (Smoke Loader)", "value": "5da1dbb725c25f177486838ca5f437a6", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775532761, "uuid": "61945098-d8ae-470b-b55f-eced53d823fb", "comment": "Malware payload (Smoke Loader)", "value": "6e9af975a383fd0377d120f73887661d13a9e24933e7ad2903e303b06e3a2571", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775532761, "uuid": "3dd38251-98ac-4ae5-ba77-fbacb2b3164d", "comment": "Malware payload (Smoke Loader)", "value": "0df3188b2be4e4f226e10e0f115a7c2c9f15e921", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775532761, "uuid": "62435db9-018a-413b-a9f0-367263584ab2", "comment": "Malware payload (Smoke Loader)", "value": "139bb7a8bbf7feb4be44750947826c4fdd59589ef7868db29813616a1791faf1810bda572759857badabe9f983467126", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775532761, "uuid": "c35e5f49-c90b-4e9f-8649-f8cd3c111cdb", "value": "T1FA75221927C412AAF1B10B3889E3536A17317EA10F61D7AF11447CB53E63BD0AE727DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775532761, "uuid": "dd77a96d-5b65-4f5c-ae10-9462e8f1c1b6", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775532761, "uuid": "e29323be-cc6e-4535-97fe-db34d6259297", "value": "24576:HLg1zEE0gSrO8Xs6oV5HolTptU67Y3HvpPj+1TdeUuMgbSsV+f1QA8LBc:2tSrzwJolTTUkoBLIJeUuM7s8fuA8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775532761, "uuid": "a8b2675e-cb12-455f-8152-cffa1863a784", "value": 1702912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775532761, "uuid": "e859f7bb-2787-42b3-8770-14305440ea22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775532761, "uuid": "8a999cf7-873d-440e-b937-2e0946a1e6a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad74f33d-327f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775565937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775565937, "uuid": "409ec284-de1b-436e-95a5-141eb30f6392", "comment": "Malware payload", "value": "d243515e1dd5f78ab125fccb44428dcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WILLIAM-LAWLER", "colour": "#9E7849", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775565937, "uuid": "9e088fd9-04e3-498e-9abd-8ee5b20c9db7", "comment": "Malware payload", "value": "6ebd717e08ccc4ebb89e22240ceec829266d3a2ea7ecfc4a0af11415dc7af302", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WILLIAM-LAWLER", "colour": "#9E7849", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775565937, "uuid": "1ec492a7-7504-47ca-aedc-c2d355f4991d", "comment": "Malware payload", "value": "c2fb9e71e65ddfed5580d9f8c4bcd476a40ae9ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WILLIAM-LAWLER", "colour": "#9E7849", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775565937, "uuid": "d3aa7e56-2ec5-49b3-9d24-975235e5fb88", "comment": "Malware payload", "value": "5de0562ba5ecc7686f0a9adaac444989db3cc3859e291626c98ac78a1f3dffedc02693b721c073a5519e47067afbe43a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WILLIAM-LAWLER", "colour": "#9E7849", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775565937, "uuid": "55a3fd9a-e783-4c97-8d7c-f6397c07d31c", "value": "T168083377728E2B3DF19E4A3909768160C43B5D64B9164E4E81F4BC5CCB39A60BE3A707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775565937, "uuid": "55ce54d2-8560-48bc-8f26-e3238939bf86", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775565937, "uuid": "05276d11-705a-4e46-b165-fc6b6b07159a", "value": "1572864:heQY6HPTG7qatWVyuy1bpbJYYYq8I8mSZtGlj5khTjAiP5eURXe:heiPTLs1bpbyYqwSPGYhTjAOeAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775565937, "uuid": "75d6f08f-f1c8-487c-9e1c-6d3aa0cf2582", "value": 79650664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775565937, "uuid": "84400376-b1c0-4e83-9449-463984b7ed2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775565937, "uuid": "6fdf3b10-a7b8-47e8-8c2e-596e8984ab08", "value": "6ebd717e08ccc4ebb89e22240ceec829266d3a2ea7ecfc4a0af11415dc7af302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c114150-3269-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775556352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556352, "uuid": "51842089-1bd0-4fc9-913f-ff8aab5584cf", "comment": "Malware payload", "value": "19908792a54416924ad1bce0d016d90d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556352, "uuid": "82aaedfd-6fa6-4c46-a4ac-d5024195e8cd", "comment": "Malware payload", "value": "6f07aef88c2bd73884fe7b3560cd9e2a7dd7f20612f7fc2087c8e253c841be4b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556352, "uuid": "d08a654d-a2f7-48d0-a763-b8fec521b06a", "comment": "Malware payload", "value": "2b52ac0808fe53a97e91aed4dfc68f6545d1a60c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556352, "uuid": "cce97c7d-0dae-4389-886c-2e8d18af0e89", "comment": "Malware payload", "value": "ffa2cd2aaf90aea0d953c5b966f1036767bf4386b1ed06615255e53c7ed1d52c08f13b2e20792c2dbcf323cfb96a1483", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556352, "uuid": "a819086f-7b76-408e-bfdd-2887575ac984", "value": "T1D854E10AF7EC3019B6F69FD1A9751494042FBD33291FA4CC07115CDD0A7AA89AAB3772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556352, "uuid": "7f06ccce-b596-49ed-95b3-c045edc478a5", "value": "6144:uaOyu0Cp4OJccMAezl3Wz1rPdRd/VZnDqsyEYjdmwzTyyb:uaOyu0xOJc+2l3klj/VhGN7mKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775556352, "uuid": "aeef43ec-dbdc-40a1-9c74-49071b0f2bd4", "value": 288062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775556352, "uuid": "93e6275b-d66a-4e38-9025-5ae70a662519", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556352, "uuid": "c124ccc0-ac85-404c-8807-6f3340a9e547", "value": "Purchase Order -April -0003766799809909027366600220091100553_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe481fb-329d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775578558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578558, "uuid": "4481f294-c307-4d25-a6a1-a28dd4f3fff0", "comment": "Malware payload (Mirai)", "value": "1493c50f594d12e61725ade7f6ead766", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578558, "uuid": "efeb1083-940c-4d05-bd82-17ae9ffbae28", "comment": "Malware payload (Mirai)", "value": "71c9dee67e3cfc57dfc8c2a3f9021aedbc9033602e7f18517fc50eb4ac57edbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578558, "uuid": "cdba40d1-0ee7-418b-ba7e-58007626fb8b", "comment": "Malware payload (Mirai)", "value": "04e77558580d4caabfc104bf7b556ebe67acd070", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578558, "uuid": "3e009c1c-3b15-4c78-b0fa-91a96627b552", "comment": "Malware payload (Mirai)", "value": "b3a71f0a3da473016037d3ecc9eea80f3810d5788ab8df418cc90c86fdf0bd78e0a75cb159551aaf97cd8c412b4406fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578558, "uuid": "df6beb1d-dc14-448a-8a98-365b175f3ff7", "value": "T1A7B3D94B7E218F6EF129C2304BF35E31965977D727E1C681E2ACE9411E202CD685FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578558, "uuid": "fad16450-b2d6-4f9d-927d-a3bf8703f686", "value": "1536:KWVhEvwommi9yAn7cxan5rWxxKVbkViay0aTsLeAPAX2Ux/XF:hLxmmBn7ZnBbbD0aTsTPY2UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775578558, "uuid": "4b2ed846-1809-4575-8b8f-2a8a9f988a06", "value": 116968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775578558, "uuid": "72e15a1b-359e-40ab-a002-6b542e7cb20a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578558, "uuid": "fd31ad69-b21a-433b-9db6-82822d38e647", "value": "zyre.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6817643a-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554654, "uuid": "e2e6a213-c042-4deb-b8ab-08229c81374f", "comment": "Malware payload (Mirai)", "value": "a0514b0e2ea0a26f66de707e9733996f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554654, "uuid": "c5becae5-d8db-4d87-833b-cdd34c786afb", "comment": "Malware payload (Mirai)", "value": "740045574b5ad8967ada3f569ac1211c1900e9821cef7b4566bb8b7b0223a0e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554654, "uuid": "87f2b31e-999b-4388-8101-d944135f6c7c", "comment": "Malware payload (Mirai)", "value": "7e8c87f92975e6ecdb48aa9585c62ffb472a34d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554654, "uuid": "c5b59817-5c1f-401f-a710-99b86bc7801b", "comment": "Malware payload (Mirai)", "value": "bc63bd0312fa887a96815702f46557b0f7abea63b60c7f4167a0023ee90f9e80beaf6a0aea758e77877115323200bd2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554654, "uuid": "2116aba6-fd8a-4eef-997a-277eba266e01", "value": "T1B0430281A0B58811CBD7083CF256F64D2ADE4EB4CC70F9F58D690283B5791A4A6A8C73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554654, "uuid": "3cb8f454-bcbb-4d95-951c-b023b593e7ff", "value": "1536:TLhCUrcAfElFNgHJj9qahgC7LW7YBbST2yDOgSz:TlFANgHHbp7LWNyyalz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554654, "uuid": "ba378bf5-3805-427a-8d61-2ac8e8fdabe2", "value": 60088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554654, "uuid": "db4ce89f-ff74-4276-9c83-39900027cb72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554654, "uuid": "6e4498f5-9a2f-4b6a-9042-0c9eaec29f77", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef98afb2-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552734, "uuid": "a4d0a6cd-4c54-4d9c-b78d-2aa29a33979e", "comment": "Malware payload (Mirai)", "value": "8048e3b574839876b6bfa597f1b0756c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552734, "uuid": "0f4f57ce-dfdb-4869-82c0-4608c85aabad", "comment": "Malware payload (Mirai)", "value": "742c63c5f44d8fc20703ac8baad1970954133631e3a60ea8daef01062ae37f6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552734, "uuid": "ccdca603-eb4e-4ecd-8a40-8f9ced6fdfe1", "comment": "Malware payload (Mirai)", "value": "0072dabad6fcc7e3d5af46947bd8257c1cb1f66e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552734, "uuid": "298382a3-69d2-41fa-9672-4e3b9a8d4e33", "comment": "Malware payload (Mirai)", "value": "404ed671691a591c88dea4867371cfa2931d1796666809abb9fe000ee25848cc03dba40fb3e988a417e8d476eda9f4e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552734, "uuid": "d62c03ee-cebb-448e-bafb-5d19e04343a4", "value": "T112832A95F8814B21D5D512BEFA1E118D7313177CE3DE72129E20AF20778B96B0E3BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552734, "uuid": "0197ec9c-eecd-4170-974b-60a798327d1d", "value": "1536:YwnnfgN/a+wa57STxZ13HaLspjpQ2M2iPAGJ3ic7hX5tYC61d6dPp:rKi+TO/13HaL7AGJ3ictX3as", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552734, "uuid": "966faf6c-a5aa-4842-b8ad-44044245bfa1", "value": 85492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552734, "uuid": "66ce22cd-2729-4723-802b-31e42deac479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552734, "uuid": "87ec0b0d-97dc-477d-b7ec-75609d2298fe", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c99636-327d-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775565168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775565168, "uuid": "908ac5fd-67cf-4293-a625-4f9bcef6b40d", "comment": "Malware payload (RustyStealer)", "value": "fa6ff24b3d1278c312efd13087d46571", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX13.file", "colour": "#114079", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775565168, "uuid": "e219ca7d-fa8d-477b-99a4-a384440011ae", "comment": "Malware payload (RustyStealer)", "value": "76e45f001e51832b72d6cde024ea41922e3ecdac6379caf1d6458a6c116b9837", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX13.file", "colour": "#114079", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775565168, "uuid": "7323e6c1-82bb-4341-849f-5f4cf1e496b2", "comment": "Malware payload (RustyStealer)", "value": "a89240246e2345299cbe02195feef7f5119a11b9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX13.file", "colour": "#114079", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775565168, "uuid": "ab217581-b50c-4501-95ad-16828d3e960f", "comment": "Malware payload (RustyStealer)", "value": "f663d4d05ccd74289fbf992fdb3a194ae30453179ded720d1e815b521447a2b39352c9a9ffd6d1989985f765cf5c9f4a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX13.file", "colour": "#114079", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775565168, "uuid": "8d11934b-5b34-4f62-b64a-be3c52f104ad", "value": "T160C501DC21FCAF9BD9A7453549CE094376DC4BB67FDE96C08628C8881A72983C3115AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775565168, "uuid": "118c1baf-8096-4fe9-9d15-407d729f3879", "value": "82fd9f56b5f7529d49a0f63b8ee9dd8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775565168, "uuid": "cb049bbf-688c-41e3-9ada-42b5af9cfecb", "value": "49152:qyd4xusLmCCMgIhOQdhu0DPfFdqgYt9kwaA6smYc+:Z+rqAgyhu0btdI9kwLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775565168, "uuid": "4074a053-686e-450c-ad5b-0929730cbeab", "value": 2700288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775565168, "uuid": "b1319351-c53b-4a95-9a59-7e9f9184431f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775565168, "uuid": "96d5f51e-67ca-46fb-8743-4bbb0e20be12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d639f947-3278-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775562999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562999, "uuid": "1165b33c-c71d-43e1-a1ac-60af1f427521", "comment": "Malware payload", "value": "678364353f964c8f4f2bfe767c8a3e41", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562999, "uuid": "54ff5f9f-42d3-4426-acb3-bb488035184b", "comment": "Malware payload", "value": "77507a11e22c4276f550c19e8ce4fcbeadb0cc1caf1f90d7a6a0d5c5ea9af9e6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562999, "uuid": "85628623-f274-4f4a-8e5d-cba0a687d75c", "comment": "Malware payload", "value": "36148f545415de4b6a13dcf6bd8a3f8f4cbea9e8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562999, "uuid": "b5f996d5-db15-4cb9-88fd-9ce8ec9a41c8", "comment": "Malware payload", "value": "cdf2e30ebe00717624d482ac992dafbe18e40e9977362d576b1d0da404a71a58f34f9afecaa34c0bffe60ddeca17aa3b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562999, "uuid": "dd664491-cd55-45d3-bbf6-4e891796b027", "value": "T1A5C4F11549D85FB9DBBC4A1C80FE1A1E93E04B8E552A798AF733BE06AFE754402070DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562999, "uuid": "49bb9be3-d56d-41ee-a530-60d41985a7f3", "value": "12288:w5Adw0Cvp+7EBo6x6LTHWQgVCmnWBZo6zNETN6rNrZ25gorYK:XwBRg6xUHWRCmnkpzaN6BZ2KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562999, "uuid": "db559949-048d-48ff-b81b-557caf9db0e8", "value": 556765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562999, "uuid": "5f300668-6898-4103-aceb-846f140985ef", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562999, "uuid": "d3d2e003-116f-41d3-9ed4-3022e722e301", "value": "RFQ New-Order 2026-01-04-BBD508.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0093b966-3275-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775561352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561352, "uuid": "7696c208-a123-4e8b-b222-5f7c24e74f03", "comment": "Malware payload", "value": "45380f7b88c5d95a74a811e71133663b", "object_relation": "md5", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561352, "uuid": "12823572-e7dd-49a3-b86f-9558578e528e", "comment": "Malware payload", "value": "77aa6f517d50889be72f5927dda37306c08c8c0f2e282a8634f5bf9685a5a3a0", "object_relation": "sha256", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561352, "uuid": "1e818635-5964-4cf7-a7b0-387612b5ee2b", "comment": "Malware payload", "value": "f733fd40fa830ef5d5c2243488402139f749e41c", "object_relation": "sha1", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561352, "uuid": "9682b8f0-2316-49a4-9a71-36ecc07204d5", "comment": "Malware payload", "value": "ac107c497a8b1d08492ddac0ab5f4ead20cb8d96236cbcff342e9e48964798291b16e50a9369535f69172de08cc408ab", "object_relation": "sha3-384", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561352, "uuid": "680ecf1d-1e07-44ac-a7a2-44bed5b32ba1", "value": "T19F137D6956817C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C59ADCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561352, "uuid": "245bb6a0-0e32-48c0-b779-8c1157077353", "value": "768:bu+D9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bu+Eco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561352, "uuid": "4c2da81a-c07b-43b4-a3ec-71ba0dcd704d", "value": 45506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561352, "uuid": "10b51be7-9af1-45d3-a5b0-d40c887fa6da", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561352, "uuid": "51fc686f-5dc8-4cc6-abf5-eb4efb6d1521", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d110aa9d-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552683, "uuid": "1643567f-1794-4eca-bf69-6994bbb60a8c", "comment": "Malware payload (Mirai)", "value": "66e76fa055fd4160b9f38ba8e249c95e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552683, "uuid": "175578a8-b002-48ac-9f23-5a3abe14a4ef", "comment": "Malware payload (Mirai)", "value": "77da7d07ea1690a66f7ba82386fa8651d509cb291efff4f8ae68d4ce02044976", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552683, "uuid": "f7087f4d-a9be-4252-b06b-d6b8a042f855", "comment": "Malware payload (Mirai)", "value": "69549f1e71c01cf7197f5382ac5f224158de73dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552683, "uuid": "68645a18-7ed7-4247-b7b6-bf6edf9614f6", "comment": "Malware payload (Mirai)", "value": "4af7bf597099af078a893a8a55a0d79de67a415903845bf75e9fc846f5c7f53caf229745b19e598c196c620da4bc38c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552683, "uuid": "c51d9619-406f-4c37-b27c-2080fee6041f", "value": "T1B9639EB3C9393E94D25541B4B830CA795B53B48481871FFA5A98C6FA4047EBCFA093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552683, "uuid": "44142359-b39a-466e-b506-54671e806f83", "value": "1536:sa9wtr82FLQgB9XHK9QATGRuzuCy2KNdwq61d6o:sib25QgDXq9sRuzu44q7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552683, "uuid": "cf13ebd9-b960-4f73-a47c-cde5c5c50f18", "value": 69116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552683, "uuid": "f00bf836-15f6-40bc-8155-ae13ba420808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552683, "uuid": "ac3e77d9-703a-4bd5-a092-55cf3ae96f8e", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3ed81b-325f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775552161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552161, "uuid": "0db60f93-7955-46a9-9222-1508958b0a94", "comment": "Malware payload", "value": "4afba3c28defd61207c9172a8ae0a59a", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552161, "uuid": "ed4f5ec6-4087-4c33-8ab0-843889824f80", "comment": "Malware payload", "value": "7830e9ac7404d1b70a0fd88bd86ddd12965c5a9d6158ced95b0126897e914526", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552161, "uuid": "b30bea8b-3418-4285-8c09-6944147bc4d9", "comment": "Malware payload", "value": "3a48214b940482e304bbb69cb03b3be5e32604b0", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552161, "uuid": "4bb8418e-4d6a-4abd-a321-620451b3c8fe", "comment": "Malware payload", "value": "7d037ba011fd4d83a5ae72a97e2d409040cecbb25d02624f22d51100bf7ffaf7f5bbba12debe2077d6246a9f901a4040", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552161, "uuid": "31dcd192-e245-4989-95cc-d5967435bd2e", "value": "T1046302B76F981C4CEB352F781260450239737D085EF5C2A7A56181ED7F9B3818A92BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552161, "uuid": "06b1dc50-a251-437b-baad-54c859cf2b67", "value": "7ca411b75593c37e3d6ed29ed4ec30d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552161, "uuid": "9cb665e4-c2f4-4800-a337-bac413cce009", "value": "1536:IxqeUYuj55kQVYcZ6KoUAjyXs5sUnTQx8AINHItGZ:IxRUxj7JVr1AGLeBArGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552161, "uuid": "d4a7931b-22eb-444f-8769-9ca4b3e1d1bf", "value": 66784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552161, "uuid": "05a76ca8-1b9b-4562-abac-2b90625ca80d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552161, "uuid": "f6c644b8-87e9-4c48-982f-4e5f462a9a56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d9f47b-3273-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775560631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560631, "uuid": "47c317ab-c105-4bfe-8c52-f5dfb8f66dad", "comment": "Malware payload", "value": "ddd5f542c15be47f9e1d8a52768a1b1a", "object_relation": "md5", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560631, "uuid": "c6ffa73a-dadd-4c67-955f-e8bcfda6c9b3", "comment": "Malware payload", "value": "784a914bd1878ad68a6cf3f693da5ddcc2f04b794204333098ad749b7e372fd4", "object_relation": "sha256", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560631, "uuid": "93759e43-814c-405e-97a5-1fdf9d66f57e", "comment": "Malware payload", "value": "bffb14c389ce70d00eff88e6fb151629d589efc6", "object_relation": "sha1", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560631, "uuid": "7b711732-3755-4087-998b-5e19dedb2e33", "comment": "Malware payload", "value": "6da77152fa5594c3f4c7f107d3dec74859fc43c13974c9c592645fe348d92ca39594e85bce9a13984c22bfd5db3a1470", "object_relation": "sha3-384", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560631, "uuid": "a48a0ef9-3f2c-4a49-b53f-47ccbf812d9d", "value": "T1CD659F55A128493CCBF9A335D7D8536023996D050A6B55DFA3ECBF822732883FFA6113", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560631, "uuid": "bf32ba4d-c4d7-44e5-af05-b66baf30eeec", "value": "24576:rD9Yz39Zimvrv692Cf8U3VIj+d47CuTwMuUjIgTpCkt6G02mvk:tYz39Zimvrv692Cf8U3yjlTwBCt6x2m8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775560631, "uuid": "601f262c-88a6-42f4-83aa-972ec535fb8d", "value": 1536886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775560631, "uuid": "5f31148b-f8d4-4fdf-865f-9731c2a424d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560631, "uuid": "f7e2bebd-557e-48d1-9ef2-1e12361ed30d", "value": "Concept_Note_2nd_Global_Buddhist_Summit_2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586b52b9-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552910, "uuid": "fb2c1ade-b830-49b0-9ef7-b3a0d3fc3300", "comment": "Malware payload (Mirai)", "value": "a2084c26caf078bbf3146a356f9aca8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552910, "uuid": "736da68b-82ec-419d-9f8a-1af110719887", "comment": "Malware payload (Mirai)", "value": "7939ad34f7f34d04dab1f6df389a2ff0b14f477c2d478074cd4d220990820ecf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552910, "uuid": "3de6912e-09de-4117-bac3-1f73f39d2d6c", "comment": "Malware payload (Mirai)", "value": "75ce502679630b324af3c7fb13429dc1d31afe51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552910, "uuid": "ce3e3566-a229-482a-bad7-662e05d8327f", "comment": "Malware payload (Mirai)", "value": "0be435158ebff41be799c0b91a7ec57ec67f95e7eb78a6114c39b17d729508740160ea3102fe608b40d03085b893d21b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552910, "uuid": "6bd502f5-b89c-4136-96cd-c7262ad0c700", "value": "T181535BC4A743D4F8F95605795133B3336B72E53610A9CA8BC3A8BA32BC53911EE1B25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552910, "uuid": "acb00e1b-19a1-4fb0-bb84-72915e7898b0", "value": "1536:iJ1cbpvrvokOkeu9MPQNqOr6delBvCBI9PyTCavNuMFVtKSSBdU:iJy1vrv9euuKqO/qC9SCwkMMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552910, "uuid": "f0374860-dfb7-4f11-8b2c-3fb3a994edcd", "value": 64592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552910, "uuid": "caffd70d-c849-4188-affc-e1b3a3c376e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552910, "uuid": "98799a32-e877-4125-bdb8-d84f5cfb83f2", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15f46e7-3267-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1775555663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555663, "uuid": "0c3606e8-5fa6-495a-bbf5-c2ac535166d1", "comment": "Malware payload (StrelaStealer)", "value": "8afa5d8082356ee8a5be3a59fc009710", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555663, "uuid": "a92c2ba6-fdaa-4cc1-9d16-de210af1cbd2", "comment": "Malware payload (StrelaStealer)", "value": "793d617a607320184ed03fc023ba41039b64fa79a520a539aeac8fa15ef03c94", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555663, "uuid": "0340b77c-997d-4970-a40c-abc025a87732", "comment": "Malware payload (StrelaStealer)", "value": "8f6e6ded0b1745eb7ca0615dcd6782b7d5335c77", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555663, "uuid": "578a05ab-f1f9-42a0-a9f4-4f778ddd4e56", "comment": "Malware payload (StrelaStealer)", "value": "5ea67403a09447f2f6e56e4ddc265de2b68a6571c1596c5619e68c8c57e91a286b9010e55d3f95e212c71faf04a0c380", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555663, "uuid": "c5f8e10b-f10c-43ff-8480-f7f93e766109", "value": "T181F78C22E3A40A26D1AEE330D4FF07A6637BFD055727435BA505BE2C2EB37480D95A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555663, "uuid": "888aaeda-01bc-4ce2-b25f-7011f75a90d0", "value": "12288:1UDuH/c8F3DcIFCZWCRJXeCnSmGLD9Nbf0sfdtRGXNJYXN:1bH/vFzNFiRJX1nZGLZNbf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775555663, "uuid": "6f540bef-dc86-488e-8c4b-92a758b1e1d3", "value": 71303168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775555663, "uuid": "929efcc9-2ee9-4b4c-8fd8-a5b22a0a1f1b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555663, "uuid": "858f6426-ed0f-49ce-8a21-716900104b83", "value": "PO#MAIN450000000227897_Sraco.vhdx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb6e661-3273-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775560599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560599, "uuid": "772c166a-1bfc-43f1-85dc-753aa8e95a4d", "comment": "Malware payload", "value": "65658848c424482eaa4bac6e53c25146", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560599, "uuid": "6c47eba5-4dcd-4fa8-b0d8-9ebba768fc0f", "comment": "Malware payload", "value": "795ad4789a185c3abc35b3ad82117db6b60a7b8ab857e41080873f070d4a06f0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560599, "uuid": "c349c1a0-a130-47e8-956f-5f2d9fc8899e", "comment": "Malware payload", "value": "1039ae50b6274c01510df396d962579828f025bf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560599, "uuid": "71621198-2b8f-4f72-8a8c-bdcddda53e60", "comment": "Malware payload", "value": "64eef56111bf7aaf16f1c8ae95832df1af8b902cca6bb35e49a7ecf6f20b3b465ad2780a88bb18c2a95dd80e02e8ea0c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560599, "uuid": "29c7f113-246a-4ef7-a340-806aa1f12731", "value": "T139441254BB59423FCA1C067914AF1B066AF9DE04467A14F7CFA4BF4E8BBCB112835293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560599, "uuid": "f99dc36a-0be0-434d-a63b-aa237ae547ac", "value": "ad418910d838a6276d9c898b9c97ea86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560599, "uuid": "30f45587-245a-430c-9447-61c5b1688ae1", "value": "6144:0Km/VNjM4HRP7x+8Ly1/4tje2uwvd+1e+iKXbhTm0RS:nGx+8y4tjeTe+1ehohT7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775560599, "uuid": "3c6a9158-76a3-4606-9d43-9c00b5f81eee", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775560599, "uuid": "8f03b5df-13d8-41ec-8d47-a38b0d409560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560599, "uuid": "ad117bd4-c836-4218-8f6b-ab37accd5551", "value": "795ad4789a185c3abc35b3ad82117db6b60a7b8ab857e41080873f070d4a06f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99d763b-3242-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539866, "uuid": "ccabeea0-f9b4-441f-8e97-873caa760531", "comment": "Malware payload (Mirai)", "value": "7ba0dcb4228a37cc74120f60dd223996", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539866, "uuid": "71c0f86a-6abb-47a9-abe1-17a88714ad13", "comment": "Malware payload (Mirai)", "value": "79ad367f9583e51c6ef06ef3d4ab9e0bce19b39813886e86b1fe6a00b4b7b12e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539866, "uuid": "619728fc-e7e6-4ccd-a9d3-c4415f50da69", "comment": "Malware payload (Mirai)", "value": "9e19627b66b3e4e647dba4befc476bfad910f663", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539866, "uuid": "ef81c960-093a-44e2-b55d-2c6d917b6f0c", "comment": "Malware payload (Mirai)", "value": "b36017fe793d4e9d4603202362f69ae10a8886981f7abd22f3426fe17a81d4fccf0c3a5f71bc35b6e3d62372dd3413e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539866, "uuid": "6dcce5c6-75a9-422a-a7ed-038302a6183d", "value": "T1CC23F16CBB441E27D6A97A3A63D34C7673C10C4720E4A88792EF933AB87573CBD49560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539866, "uuid": "f84df1bb-c685-4c88-b255-5c767e56ed3a", "value": "1536:kejzmYLQoZ2zOk3FofHYiXRKO1Yaqms5y:kee4bZ4Tof4iXRv0ms5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539866, "uuid": "9b7e9c30-49b2-47ed-b7fd-e5f2536ec9d8", "value": 49740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539866, "uuid": "8660df18-a90f-454d-82ae-1fe57deaac3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539866, "uuid": "affc4e33-7198-4599-9b14-3e7584a95278", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a345ce-328c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775571350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775571350, "uuid": "7ceb1a8d-9331-43ad-b547-9ffc487f8ca7", "comment": "Malware payload", "value": "e90f000c4afae8a1be04a78b18b59646", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775571350, "uuid": "72bd6f3a-0867-489e-a129-02f654974ebc", "comment": "Malware payload", "value": "7cd0b5035119c985bd9d6b9db6ae91a71a5e81dd8a3752a4c74d92398f1859b5", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775571350, "uuid": "594bf146-e0c0-4d87-8c26-d3d813e474cc", "comment": "Malware payload", "value": "27ab30253594ad7983af488520e46d8dd3539a43", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775571350, "uuid": "c08f5cbb-7d08-47ba-bcc1-fd4dd6a9ca7d", "comment": "Malware payload", "value": "b80d8c711af0c7b602cdbfbf1341ec74945517dee9d3cb76d2c1ea87a52141401f66502bd8eb94053ebec31c7373eb24", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775571350, "uuid": "b3a30e85-cf7c-4306-8786-78a5e5868ad9", "value": "T19AB4235A2EAD7BE7CD91A05411E132A82C1A89D8CA77EB059C5842F20477B14FE5F28F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775571350, "uuid": "f5567cd1-e16e-490a-95a8-08b7a860f20a", "value": "12288:Cyl/3BItd+3+uViRziobl9jcr91+rTY3rkCduvq39jP6Fe952/mC5s:R1+td40RLbl2rKY3ICVJPF9YXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775571350, "uuid": "42a69562-7f34-4eec-a0cd-846d2eb625a5", "value": 531063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775571350, "uuid": "83d7756d-7b54-451b-a414-cda6f6554f64", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775571350, "uuid": "98ca26e1-799a-4275-915c-d29000e70e75", "value": "register_codex_auto_v3.6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28232aab-3281-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775566573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775566573, "uuid": "cca00242-ee31-4b12-94b5-905c7f2d5dbf", "comment": "Malware payload (QuasarRAT)", "value": "5fae616f83c5c5341eb3b967d78fdebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775566573, "uuid": "d5b2ffc4-cc30-44a8-941f-41fe8d5b4ba5", "comment": "Malware payload (QuasarRAT)", "value": "7dd13cc4436b6ab1ca1a1ff321d11836f666e9e7bf0532db35833db799ffd336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775566573, "uuid": "a4b64dc7-0161-4557-84fc-7466d1d793c3", "comment": "Malware payload (QuasarRAT)", "value": "5c8f020ea76a8f74f97a4352f8bfce4943bd0a25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775566573, "uuid": "0d6648fb-3cdb-43f0-a79f-7cdf0fb501d2", "comment": "Malware payload (QuasarRAT)", "value": "76a2ae51454128076b0a568b6f453eb306d5aab6260d93c528c79c56d02660ad1f2a028c821f9f59ecf4efb0e71598ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775566573, "uuid": "753f7979-2382-4c32-828c-8dadf7a26122", "value": "T16195F064B3F9811AF1BF2BB9A8B714450B77B953EA36C74E1888609D1EB37809D50373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775566573, "uuid": "2f99dead-07e5-42ec-9c3c-83bdfc5a7e47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775566573, "uuid": "c0ac0f6b-5ad8-4fcc-a4bd-af1514897d99", "value": "49152:LcSNWnw7wRPirm2NnPTKKm77LrwCB6uana:LR0noZNn2Km77LrwkFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775566573, "uuid": "add0b813-9fe4-44f6-8f1f-e2acb3f6ffcd", "value": 2027008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775566573, "uuid": "c7d95b71-ac31-4ff1-8c8e-e23ea67c3c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775566573, "uuid": "de8fabca-c2a2-487b-98ea-06d2422b86fd", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc00f44-329c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775578205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578205, "uuid": "4f660feb-d86a-4b0e-bf58-ea239b2fcd94", "comment": "Malware payload", "value": "52dcc6391bc14b475d61125a9c767821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578205, "uuid": "80fabc22-4fe3-4ea2-b98a-10f1bcd370d2", "comment": "Malware payload", "value": "7e076c82e891f6cc0bff69929c87259a24380b2cfbd893330d68174140aab3a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578205, "uuid": "ae8f2c0e-9a59-4069-93b9-5e67a250ea05", "comment": "Malware payload", "value": "fce018cc7779ee24e45a835de553c455d729cc6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775578205, "uuid": "dd07c016-021e-46c4-9624-a5c59b40b36a", "comment": "Malware payload", "value": "57940c667d25523acfa5334004769759e7da772807296312e208bbf561c780f7d958ffb1bfcf8ac511ccb4c6fb07b881", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578205, "uuid": "2a502fcf-7da8-493f-affa-7927604f82e3", "value": "T1B3A6CF70A81CE20BFEF588E7EC0585F0643F36026A294977167E6C7A378B5AF0C6556C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578205, "uuid": "839398eb-76de-475a-9fad-addf622e303b", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578205, "uuid": "6d6620ed-1d91-4713-b219-2ba0c5700f76", "value": "196608:8EWhlLiHMqE9aBDHsvXRQ+s+Bb8Rrx0XY54dJ+vy:RSLTouXhF8L0X1YK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775578205, "uuid": "c2cb952e-2286-4bb6-8969-5f959c1727f2", "value": 9643008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775578205, "uuid": "f4c7b0ec-e9b8-4504-8f33-a0dfb49e7dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775578205, "uuid": "e832ece2-7e82-43a7-b7d4-4ddd638c3374", "value": "PulsarModified.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a84473-3241-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539181, "uuid": "19ea16c2-080e-4b8d-a4c4-e866465c1611", "comment": "Malware payload (Mirai)", "value": "99afea61796ce2609581da2492e99b8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539181, "uuid": "3875e255-7a6f-4e50-a6c2-fc7cfbaf2321", "comment": "Malware payload (Mirai)", "value": "802f78bcafbaccc3a920f2b4b2fed0f83c4023f0d2de0dc4cb53664101a53d05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539181, "uuid": "d08f8355-6e63-4723-b39b-8f5cd63875b9", "comment": "Malware payload (Mirai)", "value": "10a7fbe6970b0bd854e4a8a4412f1a37529091bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539181, "uuid": "aea5679a-0162-4bf8-829a-fe111316b425", "comment": "Malware payload (Mirai)", "value": "72f7fead32715fc72d51fcff06bbb510f7e3ad662f18742df1f296ff729dcc54f2382ea006f8511aeec8a399d3067446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539181, "uuid": "86d817e0-8212-4975-b353-d1fccd283795", "value": "T1CD930946BD428B13C5E322F3BBAF419837165BB9D2EB7142DD25AFA123464D70E3B610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539181, "uuid": "0f2cd328-8211-40f4-8313-36df16762c5a", "value": "1536:qz9nijl93rPDniU1ZjPB4O1Ebk4/nqqDN/VbDJqeDQDDzRSmeEavp9tQzJ7zqh1p:N4xYD9paveW9faAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539181, "uuid": "ef5e46da-f6bd-42c6-b6d4-13066b355fb8", "value": 90516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539181, "uuid": "4006ca70-2f31-4716-a37e-599ccb72f318", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539181, "uuid": "2f21dfed-39c2-49ae-8920-ff782b81fe54", "value": "zyre.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdf215a-3279-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563364, "uuid": "087408b4-bda5-4840-97f1-78c357b5acf5", "comment": "Malware payload", "value": "16637c59817df7e797d374aedfb04e30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563364, "uuid": "ed468c8f-b6ad-406c-bd4d-7810e0edb405", "comment": "Malware payload", "value": "810b5668912846d7d0f53dd8eafee0d6d8df0e797b5879e3a294b3618307ec0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563364, "uuid": "a9a41252-11e1-43a7-97b0-e5c2dfaa55c3", "comment": "Malware payload", "value": "b92133861a099345d85987eddfe3c2e1d52c0c6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563364, "uuid": "9b1aff73-4ff7-4f30-8326-214c30b8ae75", "comment": "Malware payload", "value": "3ed80c199f5816b00c86f0daf0e0d1f83c07b78a7a6be92a514f26ef3273bbaed2c6ca2926a98538f62b2643c1d27949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563364, "uuid": "6e4e26ac-03c9-459b-9bd5-10f50b1de381", "value": "T1AC64D011EAF59015F6B28F499F76244199BABEB26E0DD5EC02300E4C4B25F44E9B3B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563364, "uuid": "f1a0f69c-612b-4b22-8500-aa4f86fd8f1a", "value": "6144:aeYmgUkpJINEZai8sG0un/lN0S4UihaCSObLAO1ghJn:apJIigi8d/PRihpSObEggh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563364, "uuid": "eeb4b7f3-a013-4438-8e69-c9c64e72f7bc", "value": 309960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563364, "uuid": "fd68bd74-9665-4d3b-9c38-6dab3ce511aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563364, "uuid": "5a598e0d-4a6c-4223-b3f0-02252183f397", "value": "payment slip.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfe1718-325a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775549990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549990, "uuid": "285f8b66-d5d0-40da-b93e-81528fe336a3", "comment": "Malware payload", "value": "bea25767319d348c001a3ec40c7478c1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549990, "uuid": "be8b1fc3-5f6d-41ea-9ff1-7f3d7387b1cc", "comment": "Malware payload", "value": "81c9b7db01704961a30e9903e71cd147551bf206f26e54a8eabd91d3320136eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549990, "uuid": "b70e6a1d-03ad-4faa-9fb0-a1c38caa30cf", "comment": "Malware payload", "value": "dca2e71737bdd7dd6c0f3a18517c0454e50dfe79", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549990, "uuid": "eb2a5e29-b300-43ff-bc66-7168fcdfa263", "comment": "Malware payload", "value": "f8b46379b9e23083eb069a8f040714bea10c0ae9127051a3db53322b667bbc64833714b0667462dca33032f83b01bfb6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549990, "uuid": "6c98232f-d34b-4a58-a5dd-ab27571e66dc", "value": "T13A54C004D7FA021DF9F22F89EEF9A4520934BDB2560D48EC48864E9C4BB16855CE7B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549990, "uuid": "0bd25977-cc46-4a4a-a193-b944dac2c525", "value": "6144:t6o6IgzoZjfrbJmnVS0yeLczdCSjVN3+OUjM6I0WjNZQHcikVzcaUhf:AbzMjfr0nVz1cZ/3CjJW5mHchVYxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775549990, "uuid": "afb96f35-39e3-44fc-826d-0f4d175a9b64", "value": 304982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775549990, "uuid": "15344f1d-aed8-41d3-bdbb-95b9ddcf5fc6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549990, "uuid": "c682ddb9-82f4-4569-b0b8-d43edebec639", "value": "Purchase_Order_ARD_3797509-003.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ef9310-32d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775602007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602007, "uuid": "db26c3ee-f9e3-4f0b-afe7-f0fe6cea180e", "comment": "Malware payload (Mirai)", "value": "32bb5a17695879ae228d73f3c6b9489a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602007, "uuid": "dc8e13ca-f7bd-435d-b7ef-6f42e33b454b", "comment": "Malware payload (Mirai)", "value": "831743b8b8e86014ce0837f05e12210794426f0751744492b23bb3b27fb1abba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602007, "uuid": "7f9b6768-0a42-4467-9fbd-63d76a0fc18d", "comment": "Malware payload (Mirai)", "value": "df6a27b7a42eb9de1dfad21cf75f2a458acf9b6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602007, "uuid": "37fadc41-8ff5-4f20-b1f9-882fb029d2bc", "comment": "Malware payload (Mirai)", "value": "00879b27e41620d9e809b42dce95e02bffcc045484a078d03057381ab616ab08a00f3c8feef9eb935d18b50f948a3aaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602007, "uuid": "2da781ac-b432-4717-bfca-8a128823308c", "value": "T1C6449D077F8A49AFC26EC3F409DB6320CB27F5360716EB9F27546E652E0E6D86C84605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602007, "uuid": "89084f79-5022-4760-9803-3b8a72086a42", "value": "6144:ixh+/hZ190l6oc1p7EWc4KvyF66ca4JekVPhbkAaKO:ixkhjSlmVEWc4Gk66ca4JekVPhbkAaKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775602007, "uuid": "6760efa3-a7f4-4d93-908c-9d401de83d27", "value": 269616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775602007, "uuid": "b7852236-8d5f-41b9-9c9a-81f0a34757da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602007, "uuid": "9b628e2b-9b13-4206-ad65-ad1981b6ebed", "value": "zyre.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363bef5a-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554141, "uuid": "bc4b6c88-3dda-4476-92f1-400482b31435", "comment": "Malware payload (Mirai)", "value": "5fefbb3327a166c7efaec31a81c61bae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554141, "uuid": "32abdc86-0c2a-4bcd-b33e-385126cf3a6e", "comment": "Malware payload (Mirai)", "value": "83617ef9c6c6d4561a2fe2aa9cb78b2605e996a4d86424646bb11a29f2c0e61c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554141, "uuid": "6e5857e8-b8c4-438b-8297-a385bf55424b", "comment": "Malware payload (Mirai)", "value": "5e677f1d85b3a5042e02e425eb56c3a5bc652028", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554141, "uuid": "a7fa5611-27be-4290-94ae-0f3b19369386", "comment": "Malware payload (Mirai)", "value": "e88fc564f99d9b3d694afd4c5c8418b2b02528a97f4ba4e13838a2c37f6ebca6ed500c6917f5b069c67da739dc8eb868", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554141, "uuid": "4cd228b6-ac7c-42bd-bab3-c8e04c9de8a8", "value": "T1C592C070012B78B2C7513433A62FCA06895607FEC5F5317A236468E8CB9564E1EB998E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554141, "uuid": "858aaa1a-9c5f-4e4b-99e4-dbae58d8d43a", "value": "384:k93CFDMsFGg7EMUTmli2KvZw93KmQxPitrsnIns0t2dfNH8kwln7hymdGUop5hto:QCyEPgoKRwZGx04nIns0t2HwB7s3Uoz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554141, "uuid": "a959af34-68f8-407b-8a03-f7943199f3a2", "value": 20540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554141, "uuid": "6c86b2e3-a05e-475b-9464-e43f5ccb1cda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554141, "uuid": "a243cf30-0922-47c7-aca0-9cf9759079a9", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca58f410-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552671, "uuid": "73cc6cd7-7992-4b2c-a623-1ed36ea9edd9", "comment": "Malware payload (Mirai)", "value": "e3ae23a59a1dc426379a558e5e747b19", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552671, "uuid": "1cce27f7-6978-46d7-a342-f9276aeef865", "comment": "Malware payload (Mirai)", "value": "8388ced6d3423c26805b52efd4a00a6f62822a67d54f481d4cb6db6207c67a01", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552671, "uuid": "f1390eeb-72bb-4c9b-82c7-d83b5b28dfe3", "comment": "Malware payload (Mirai)", "value": "25d84b4cf3eb11263e75121b63df3494b7f59c9a", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552671, "uuid": "cefb1923-2286-4e8f-89ed-1a264b4c2ac9", "comment": "Malware payload (Mirai)", "value": "bb03fec9e21ff1e56f8298f72c2ccb1d60255386d6e564b841e5dccbb61b0ba63658d30ed5a9780ca11dc46c6bad8521", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552671, "uuid": "55a0cf05-5cdc-475a-b265-cd8333d71a30", "value": "T1DCF2F17491758C15C9D09C73CAA9CA01232E4AFDD4EE79EE36A09739538275720BC3AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552671, "uuid": "8d63b91f-47b3-4ec4-951e-c402308e197b", "value": "768:FEF2xBwNxZHfx+05Brxah/dHUOQqd4d0XOw9lRljNNvYNps3UozF:FEF1tfB5FxahlHLTd+0XOw97lRdzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552671, "uuid": "ea0c3e5e-91af-498b-835e-4abae84fca42", "value": 37500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552671, "uuid": "28fc1bb3-7523-4a49-b002-f2b79bd0da76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552671, "uuid": "63956ce1-3616-4b02-b4c9-58e0f8862e42", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa65af13-3273-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775560912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560912, "uuid": "46cccea2-db01-45cc-8f73-ffba7222bacb", "comment": "Malware payload", "value": "319e0fce4e637a5412e125d6c99348d7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560912, "uuid": "6199a8ec-6fbf-4095-91a7-802c7d45f76e", "comment": "Malware payload", "value": "843b22df66f87a587be77145da163f9615fe8164a5ea17f9e33562ff43894fbf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560912, "uuid": "1e86244b-786b-40f3-9ccd-2da9e480029d", "comment": "Malware payload", "value": "76e7ba416a8dda8e761c62ceb215ab9611ef5b6e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560912, "uuid": "019f736d-c843-4a0a-8a65-5a67c0f0307f", "comment": "Malware payload", "value": "191f375f55136ce1e7470d18e928b3271516a10aeecf17c02fe823ff7da97ba8baeb3567c34d09fa6a2114777592c52a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560912, "uuid": "565b8048-bf9b-4adc-aa34-991b72afb374", "value": "T15671531787806735C18A8378230B6A9399BA5C354FD609C78B1FDB15B9335F43E35D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560912, "uuid": "bf9f512d-6116-4b2b-8bd6-73e982c84140", "value": "48:vpgh91H4lfRJCjZj3DDzdpthOEeyXvphxBlIX8R:BSl4lJoHB/reEjHCMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775560912, "uuid": "826518e6-3e5e-4788-9693-dbc47e9fb369", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775560912, "uuid": "4fd048ad-ca08-4952-8f9c-db5702e928c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560912, "uuid": "a9335709-1900-4346-914c-6b2873cc9a81", "value": "843b22df66f87a587be77145da163f9615fe8164a5ea17f9e33562ff43894fbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0d95d4-32c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775595728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775595728, "uuid": "e2f409ae-50e8-46b4-80d6-6409a167df6e", "comment": "Malware payload", "value": "8caca3b0f2c7074e1b7d238f183f3513", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775595728, "uuid": "974ec236-34bf-4e14-8289-a061e92ff3e2", "comment": "Malware payload", "value": "845a5d8d36408aa760c29e3c5feda7edd0e9b2c1c541abb15d8ab9a8fae726b0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775595728, "uuid": "cad2cb19-6f1b-4ab8-8431-c8abc2f97ce5", "comment": "Malware payload", "value": "4bf66f5caf38a740ee4aa566e0b48e6dc94f16be", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775595728, "uuid": "7c5de28b-ef69-4a5f-beb0-37edbff10e1b", "comment": "Malware payload", "value": "3589eb623e8898e33be6f5130d946120b204f2c2caa1662c8f3b55a86ec078209083143fbd4a202526414cd813c2358b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775595728, "uuid": "c6c9028a-827b-4866-80bd-dc41ac168a20", "value": "T131863346E3F34534E6B51D36A87ACC71AFB378650CE6B4143CB1D20D28B66D19D3A782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775595728, "uuid": "05505e60-2d40-4b15-a7cc-857d30714d87", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775595728, "uuid": "04639017-50b6-4e4f-9aad-2f007bd223b0", "value": "196608:l5O2zZlEGhXTc0r3/3Fb44YZ7EPM1qfFTYGhYL2d:lwre3Fs47E1qfeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775595728, "uuid": "2f624a05-422d-4f0c-b689-38e322c66db2", "value": 8347351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775595728, "uuid": "8ce8ee24-2879-416a-a23f-c1b97b9fa1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775595728, "uuid": "fccc102f-75c2-4750-81fa-dcc92e8df06a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad1f25d-32a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775582549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582549, "uuid": "0b34671e-5f59-43c1-b184-bdd0ac258964", "comment": "Malware payload", "value": "57775f162f28e4727c36503b038d48be", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582549, "uuid": "6970534c-063f-4c66-b960-8715dad61a8c", "comment": "Malware payload", "value": "84ae7b478909fe9c3a0ebb340ab8b54399c978eba1ee503b67965cba2b08c23d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582549, "uuid": "47f5fd0e-d6d6-4aef-8a31-9960c15bc31a", "comment": "Malware payload", "value": "d7317c63d7cb99ed36d3c0f36a935048a29a844b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582549, "uuid": "5c0b8d0c-a141-406e-b85f-aa6cd8a5ccf2", "comment": "Malware payload", "value": "4a179a584a66497ccbae52965c4101162169812cda055604f5a758bf48c456dc875a133fdc443daabdd373e71393784e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775582549, "uuid": "e143e076-c63f-4db4-a382-3d191a9de17b", "value": "T1DF210ED90152A283C67BDD1C7A75C9446222E0C3A5CB2E3EDCD418ADCCCA76AB215BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775582549, "uuid": "908a4e78-302a-43eb-ab3d-993c7ed67e21", "value": "24:opqRgpQ0QagpbHgpUHxgpexgpUOUYgpadaSgplVgpco0gpqOqNIjZgpWeygpJnJp:opqKpQ0Q3pbApyqpeqpUOU9pgeplOpcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775582549, "uuid": "604d9fbf-72fa-44e1-ba59-b18073cebb3d", "value": 1343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775582549, "uuid": "da661ddb-096f-42d1-aeb6-dea4127a66cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775582549, "uuid": "14677732-4170-4a80-85c3-e70583a4cd61", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a93705-326d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775557977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557977, "uuid": "c06b3f30-e8d2-42ad-884b-e5129f9446a6", "comment": "Malware payload (Mirai)", "value": "6bc88ee1712d4e4447cd764dbeaee0fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557977, "uuid": "45320e2c-df94-4091-8114-d355944550c3", "comment": "Malware payload (Mirai)", "value": "85043261e18d21e381971d77a7a6033b1eab8b19f7c760087c14d03f34dd4cac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557977, "uuid": "53a6b6d7-4731-46ab-aaf2-8595180b88c1", "comment": "Malware payload (Mirai)", "value": "8d6d1885d9643a495c815cbbb181b4f1175fe6e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557977, "uuid": "9e3715c3-8714-470c-a1b3-31585743cb1b", "comment": "Malware payload (Mirai)", "value": "e431d92f6c44437d7a320445ffeec12974eb9380cf3192ffdcc62d6dc43d8efa5b5ad49c4ee60eb29d83033386070081", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557977, "uuid": "3a74b1a9-1ed4-45fc-a44f-99829a6e30d8", "value": "T15B517CC562644F302877AB66E7B6813CB08791921CE1AFE9DDC8BBF446CED243241793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557977, "uuid": "10d21ea9-5952-4af0-a31f-9c3ec35f60d4", "value": "48:v3+7M+7N7h3+d+6G3+g1+zP3+t+KW3+b+oU3+7b+7o7U3+fu+3b3+8+9R3+v+cgN:v3+7M+7N7h3+d+6G3+g1+zP3+t+KW3+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775557977, "uuid": "2f8fe0c2-bba1-4a37-b2ae-ac4333f66e06", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775557977, "uuid": "d754fd00-f6b5-4250-8fa9-a0f9b14854c8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557977, "uuid": "24b09117-ca88-49d4-b880-9fe417b56a4d", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016a8268-3280-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775566078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775566078, "uuid": "3041f15d-24bf-4b10-8159-2daeb18ec712", "comment": "Malware payload", "value": "2a9cfae1039fcc214433222a5cc7d4c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MobSoft-Co-Ltd", "colour": "#9E7492", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775566078, "uuid": "fc2866da-9803-48bc-9498-f1a8c13b1950", "comment": "Malware payload", "value": "85113d10061110c755626eec419703a57e82afebaf95064c83cf5d4c5c55193a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MobSoft-Co-Ltd", "colour": "#9E7492", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775566078, "uuid": "8801456f-b30e-4c69-81ae-480604b5c9f1", "comment": "Malware payload", "value": "fab36ed43bc619c6e7afd03e7a51b2d956afb9e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MobSoft-Co-Ltd", "colour": "#9E7492", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775566078, "uuid": "ac2fdc16-e02d-450d-bcba-22451662822e", "comment": "Malware payload", "value": "2c627a5d2ff5fd20c5a719fb46227a2c64d36c7a2c336a684f1b11a4fbe5aad1d4ebcb66cefa50cb74f800ff4d4689a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MobSoft-Co-Ltd", "colour": "#9E7492", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775566078, "uuid": "fe6f13b9-2cd1-4b3c-b796-d5666e3181a5", "value": "T1E6E4E086F39452EDC6ABE638C91A532FFB7178865714530B13E58A233F671746B2E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775566078, "uuid": "236e0b2a-6d5a-417c-b7b2-51e72bfa21f5", "value": "af18b23f8bd85b1fd557930d6522f233", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775566078, "uuid": "fdb6bffb-c7f2-4602-ad94-e155f8fe6fd9", "value": "12288:qnPStLQ9M3uhM4fu3BwBMOsiGzfERRQ9vSdy7oUut0mdiFV4:OSOthM4mRqsJssApFt0mdiFV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775566078, "uuid": "6d852e38-5523-4dd7-a503-95842314270a", "value": 688416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775566078, "uuid": "11a2e91f-c350-4441-bceb-984f3df284cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775566078, "uuid": "e7aebb2f-b7cd-4808-9827-21b4a00dbe63", "value": "85113d10061110c755626eec419703a57e82afebaf95064c83cf5d4c5c55193a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce1c385-32b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775588136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588136, "uuid": "630ef3c3-6da3-4d8e-b7d7-5f402131567e", "comment": "Malware payload", "value": "ec085b68de1cb68bf2d8d25929555c1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588136, "uuid": "bfeea570-a993-4968-9174-c8a48ae3b7ea", "comment": "Malware payload", "value": "8556a91421bc4aa07aac7f2d937d06da610cdb4ca5fa7f4011146c466940a836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588136, "uuid": "7a51adf2-32fa-41f8-a240-ae03494267fc", "comment": "Malware payload", "value": "17a3b603dea10a4f83c43bf4ec43e3ab0c68a8e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588136, "uuid": "2c92af6d-4eb1-4913-8226-de23d10a91ad", "comment": "Malware payload", "value": "77242457f5f446861a01fbaf763b027c7932e86a0e75278b01e45cac1b7a5f6076d40d33910b8e47e7df00e6fe059733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588136, "uuid": "73a709f9-8adf-4127-9040-ab9a861d551d", "value": "T1DAE6BF07EC9515E9C4AED234CA629253BA717C492B3173D72BA0F7282F77BD06A79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588136, "uuid": "894e7d99-4b35-468c-a52f-d0eb225c88d0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588136, "uuid": "13193176-5ac8-4b73-9d21-2ee2a9e007d2", "value": "196608:XeNSE051muG/hNUJB0HXZ2kpMw7WEYZt1goaxAbzZsAkP/zMVvuETr3KKAGMPj:XeNSr1gfSVkpMNFt1gMsP/oVWc2zNPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775588136, "uuid": "c0e3e9e5-e733-47b0-971c-35d2252ab806", "value": 14157312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775588136, "uuid": "79c945ea-eca2-451e-8d9c-411ba6d87775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588136, "uuid": "a80a1aca-a9bc-40e3-b2a8-43b3a965e29c", "value": "clean_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737348e5-323c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775537064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537064, "uuid": "3b9f4175-6043-412f-885b-34564352bd86", "comment": "Malware payload (Mirai)", "value": "9904d429776fbe7cac5e8c5edd8c5201", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537064, "uuid": "bef4a120-ccce-4a86-8a92-f88a3d40353d", "comment": "Malware payload (Mirai)", "value": "86187dbf150d19fa3860c32744637283b1a308ace35d1e6e09495a3b981cfae4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537064, "uuid": "f9f6b069-b540-4445-bf33-e1ed395e7f78", "comment": "Malware payload (Mirai)", "value": "330cffbf969468b85c8fd0bdfc15e2a47797b9ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537064, "uuid": "658a0bdd-6fa0-4efb-8e67-4f847460bdbf", "comment": "Malware payload (Mirai)", "value": "f190eb94039b924250a1393c8cedc9021eeb740f70317c4fe76e859460b26d8b2ea62e0824ba946155d07fb3032c85ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537064, "uuid": "64d3b250-dd38-419b-b068-f1eef74ca94f", "value": "T12C733A03ED2A5F4AD187A4F022F68E715F12FCA549572EF5B462DEE5A103ED872023B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537064, "uuid": "482e52af-da1f-4ecd-a849-3cae95456dbf", "value": "768:qKjViPnDWbPY4ohakXY3XsS2n/wCWpKTFmW1aTcomfJnR+7CxXZVmfMrOtia57ns:jbwxxYNK/8KTFmb/mhR+7Cxpfahe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775537064, "uuid": "23b17b7e-011a-42a7-a366-aeef4f34e640", "value": 75216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775537064, "uuid": "15274458-7cb3-4e43-92d3-8c1693ac6664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537064, "uuid": "4d3c69b2-d4a0-444e-aab2-0c6529377365", "value": "zyre.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69eb0775-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561958, "uuid": "3246a99a-a14f-4a91-9d7d-90102b34a782", "comment": "Malware payload (Mirai)", "value": "4aef731abf050fd09a4eccbc34672a2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561958, "uuid": "15909b61-a137-44a7-b53f-ea3aaeabff4d", "comment": "Malware payload (Mirai)", "value": "861ebd01c2a94ac8310237f7408a0d3ba1d63bb815ff7c82f493e7173a631ae4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561958, "uuid": "37e81ad8-05c2-4635-8585-948a743f09aa", "comment": "Malware payload (Mirai)", "value": "1b00c824949d8dd58a94a0cdcc09f112121debc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561958, "uuid": "29e7e1ec-a4ab-4574-89da-ebc6ec269ed4", "comment": "Malware payload (Mirai)", "value": "3ea1c0aa17515d7f2b3207d126c1999794a2e23a6b7625271c88f124ac5cd1349641c6a0cb6ea8c0b0e3e235b293cf5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561958, "uuid": "285a6cc5-5e53-41d0-ae1c-703f78f8ea53", "value": "T1DD8312F372FBAEBDC530F6B851095358AC6114AC70FB8B6BC35A166E961ECD84431D50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561958, "uuid": "dff999c1-9a57-44d2-9c5a-ad15a3475623", "value": "1536:b5dCkw+u7FfgmRAJzZcgVxvAN2+MAPMb3xRNiZdqZ9/+PXm:b5kT7FfgfZV8zPMDvNi2vUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561958, "uuid": "c95b29a7-e49c-40e0-b02e-648ac56a3e07", "value": 82964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561958, "uuid": "8bdab5bb-378e-4e1e-8c41-afda89e78b8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561958, "uuid": "e17dde9b-e048-4c49-a910-3fa16f321fc1", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a399ec0c-327a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563773, "uuid": "d791944a-405f-4790-ad0d-9f0a303338e1", "comment": "Malware payload", "value": "bf5231eae1f22e8eb2ce949d7951a15c", "object_relation": "md5", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563773, "uuid": "820c3e52-b858-4939-89dd-08be05834229", "comment": "Malware payload", "value": "871c9e5980b064189dab10cd57cfeb00848006335e6dda8a989752e577ac73d3", "object_relation": "sha256", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563773, "uuid": "ddbc512e-3570-42ac-b270-f438daa3f1de", "comment": "Malware payload", "value": "a6f9a8b49f8d39cdb0af85e5d2fd29a334f783c3", "object_relation": "sha1", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563773, "uuid": "94e85de9-29e3-4501-8900-d3a67115ac08", "comment": "Malware payload", "value": "4f5fad99ee04f8050f921967af40d90b908d0a1173efdbbad9340085c5751062caa10b26c73b0e762a4ed702eaaeb4fc", "object_relation": "sha3-384", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563773, "uuid": "ce2fe47f-f6ec-447a-af94-6504d86a0678", "value": "T1F7E26C5904443C5DBDD98D7E5D2CAB0C98B8C3D2301561E9BFAD39F2CE2A99CD12C26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563773, "uuid": "435797da-49e7-4fa2-a820-e56c532f182b", "value": "768:bzR6uQprPBP1d3WHgVdq7a+jpzLLLYbWHgVdq7a+jpzLLLYM:bd8/GHgV8dcaHgV8dcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563773, "uuid": "b7b8f830-0fc7-421b-a43c-352ba3038cc9", "value": 31786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563773, "uuid": "06fe0941-c338-4283-a555-b03ac94040a7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563773, "uuid": "0c4e95ca-3fb9-4c16-985d-052f8b7c847f", "value": "871c9e5980b064189dab10cd57cfeb00848006335e6dda8a989752e577ac73d3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8a69b3-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552385, "uuid": "9fdebc4a-211e-48ba-977e-d0083d355ec4", "comment": "Malware payload (Mirai)", "value": "442195f4e5eeb2310cf0fd68e0361351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552385, "uuid": "7856999f-df79-48ea-9d12-5fa925974219", "comment": "Malware payload (Mirai)", "value": "878ab14208d58751e4904f9a0b0ffcff2b284d4807e8fee2d05c281356555ab7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552385, "uuid": "38039a4b-1b08-4557-a53f-bd3788b24cdc", "comment": "Malware payload (Mirai)", "value": "194ea64702c612a64dfe9d0f6add169385c14936", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552385, "uuid": "cdc01965-d2e0-4801-b54e-dbc4397d99b5", "comment": "Malware payload (Mirai)", "value": "aa90bacca3ab5f90ebd4101a29d3d45ea45ec3ed62afa705903ad0b53b42c854ab4e64282fc6c75bf157ae46ecdbc3dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552385, "uuid": "b1d68e17-e2ed-45db-bfba-b36d64a3e129", "value": "T1D5336B22E9391E2BC0D0F87A62F78728B2F5070E25A88B4E7D620E4EFF215D0555B1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552385, "uuid": "40dda8f9-eada-40e5-adfb-6f6249379e88", "value": "768:M7U+SjoHq9+scN2wNxyxnu3Vt71SqIL9uO+hhQSLF29:0U+Sj2S+scNNxyxnKT71Ychu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552385, "uuid": "eed1be4c-9bf8-45c0-938f-0cfa30654866", "value": 54724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552385, "uuid": "45746fd1-3a4b-4696-8433-bc217d7f4996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552385, "uuid": "e3f91b1b-03bd-4324-9afe-07412a879e8f", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08495e50-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539890, "uuid": "3ea0d9c8-4e09-4e49-86e6-903adef92309", "comment": "Malware payload (Mirai)", "value": "1e8a210c44667fdfe8426dcf52542cae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539890, "uuid": "71c08849-d575-4eba-9827-b568a9e5023e", "comment": "Malware payload (Mirai)", "value": "881c1149eccd4873c708162c1fd8c4aaefce5969dbc52f5d2468d62745fb2011", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539890, "uuid": "8740397a-35eb-4ae2-82ba-84024d35942e", "comment": "Malware payload (Mirai)", "value": "9158bc6e49346dbab62bdd029fa1b13c82732c2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539890, "uuid": "c5fc2d09-06b1-4abb-b75a-b80d6a87e2f4", "comment": "Malware payload (Mirai)", "value": "58cae7d2d66a5bfe083efbbf7f4a0413b42655fce95ec90320873e1f265df1500f47e508a95328a18380b4a6d6a2354e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539890, "uuid": "38f156a5-edf8-4c77-9a1b-d90f211d273f", "value": "T1D0935C22B4391A3BC4E4947722F35326F1F6438A10A88B1E7E710E8EBF156D0364B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539890, "uuid": "417d7caf-354e-4c1b-9682-3786ad518769", "value": "1536:Ol5GrqkdLdA0rfQzYeR9nShcUvytX5Ym5ngP5gYtGGJ:RnvA5l0FaB5YOgAGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539890, "uuid": "7ff6b5ac-a40b-4073-b255-91aaac66c6a5", "value": 91984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539890, "uuid": "886a217a-3fd2-4b26-9e94-d2f22a55354e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539890, "uuid": "0c2b917e-516f-4c29-86d1-c0e730fcb0c8", "value": "windy.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383f9857-3255-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775547702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775547702, "uuid": "97896aee-c40c-4688-8e28-2634f5239419", "comment": "Malware payload", "value": "2c33906737bd399ea9d28097d745595f", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775547702, "uuid": "7e017e1f-d717-4d57-969f-461656d49bc2", "comment": "Malware payload", "value": "89264b90f16b03b8f3f5bbc05fe0910e2c87a10704c91f9ef2f4930d70f0a520", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775547702, "uuid": "7fc45e09-b6a8-4fc0-a5fc-5d8022e5d229", "comment": "Malware payload", "value": "d2712a976cb3d7f6b2008dae7bc3c9ad2bbd9cba", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775547702, "uuid": "e8590157-e282-426f-8540-4cbcfcaf67b5", "comment": "Malware payload", "value": "2b4bfdf75cb9424c1b2d1c5085e323023060c5808724e0849b8f2c2b5d8a15f03fecaea3d8302c577d0410410a517504", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775547702, "uuid": "5994f30d-5ec0-48b4-abd0-f39bf059660f", "value": "T1AA67E046F20CD92BC9FAB07C9D8B07E7B8116C555B10C28B2925B60DBFB37D49A127E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775547702, "uuid": "cc6adfee-3b85-4ec1-a788-76183938dd2f", "value": "393216:2ljwvt1bcrVbYkm2Wv3DtsqyCUvuic1+U6PXKOrqtzyFZppxRrQxCuKrW701QCF1:xttchdxRDc1Z6COEzaZppxRcFv4zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775547702, "uuid": "b6fc3178-829d-4a87-a609-1533b9cf5cd3", "value": 30556894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775547702, "uuid": "9835ffd2-1799-4d48-a6ac-b620e7dc607f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775547702, "uuid": "eb42de36-4c80-4220-bd1c-afc55a9a698f", "value": "Fast+SMS+Messages_1.2.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc4b332-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (SimpleHelp)", "timestamp": 1775554286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554286, "uuid": "8eeb3e29-50d2-4fec-8309-5a4919635d23", "comment": "Malware payload (SimpleHelp)", "value": "f397db3f6a015184a139ff193b510cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554286, "uuid": "84f0221e-7c81-46fa-863e-a73e12dbd979", "comment": "Malware payload (SimpleHelp)", "value": "89662ed21fae3d22da2d58b87fa495392ed3f8f30c5f6cf402f85ab6448399d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554286, "uuid": "81dc42eb-b2f7-41ec-b69f-776166786057", "comment": "Malware payload (SimpleHelp)", "value": "8f78976b46d07b84a6c9af4c9bd3a53159360f71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554286, "uuid": "192881d9-afc5-4653-b9cc-21f17a4aa9d2", "comment": "Malware payload (SimpleHelp)", "value": "d3ee590d42b4ae9190ff67472271bfcdb8662ddaf9e37c5547236b159699852c6b90851503fc4e7c22e724fde0af23e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554286, "uuid": "f750e762-4e60-413f-a4f5-ee7d1e0f7aec", "value": "T110B73321FAC1D57FD683C6B86447D1E7ED7A41A8B28D52230BE00499CA2CD8D4F26BDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554286, "uuid": "dd628090-d02a-4ac7-a59d-7536d3524118", "value": "ec3d55528df9b48ff8e5d2ff74321ad6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554286, "uuid": "6b54d3e6-3393-46bb-934b-e03b21b310ac", "value": "786432:yakCLaZV/Qlp2SX7j/32i82itlBaxaI0vOPuajOoI91oTdyNOkav7hMIeNP:yRCL2e227aHzjmaI0mRI91owNQvReNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554286, "uuid": "ee913bd0-d631-4b18-9ea8-5ef26d29b9ff", "value": 52476704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554286, "uuid": "edee01a9-1b09-438f-b903-e9be7c690d7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554286, "uuid": "b450e7e3-db9e-4053-a5e4-c8ddce5cbe39", "value": "SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win64.Remsim.gen.12083.18892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c04cacd-3285-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775568297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568297, "uuid": "7b25d6a0-ad36-496e-ba8c-9a3839ee7b1c", "comment": "Malware payload", "value": "19614f170ef128ea693af3208ddf7a70", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568297, "uuid": "1a77abb0-1cf9-4a16-9af5-22d90212a47d", "comment": "Malware payload", "value": "89d492b7539b5552445764907a96b517d08d448f8ff0e3e7a93958df82d3df58", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568297, "uuid": "d26354ef-e2d4-4ada-ac06-da00c4d1b54e", "comment": "Malware payload", "value": "d44d920ad34177c10458cb8dfaa6ace9ddfb927c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568297, "uuid": "f13d4565-78ab-43d7-b7dc-e098e0d8c70c", "comment": "Malware payload", "value": "5fa177374f074c62f6af4a075c06090647f0840b7b6b2b08ed3b75040f935fc107ec1d3197f6d1b02f432881c8dfbc65", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568297, "uuid": "f181aa6a-44ff-44aa-b623-c16bff364598", "value": "T1463523EBC36A4AEEF10D2638FDCA36605DF73052243112D41C20996B7B679693D867B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568297, "uuid": "b7cef1a7-43ad-4cf8-89d7-1303396ea6e7", "value": "12288:MlOFtJanj9yZMPJlsXlOFtJanj9yZMPJlspaS0laS0uaS0PaS0caS0lIF1EgP+GD:kOFjjOFjSS0QS03S0iS0FS061XPvoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775568297, "uuid": "2eea8829-b82e-4e68-955e-b0eaf0ba5e6e", "value": 1103057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775568297, "uuid": "11062853-1332-4074-9e14-b7602e3bdbf8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568297, "uuid": "a6d37a56-c7cb-405a-adb8-eb269ead3b61", "value": "base (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f680d658-3242-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775539861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539861, "uuid": "b389c236-d844-4a7e-a71b-971a61a67ace", "comment": "Malware payload", "value": "38e4b31b0c53e1345d7c54c5b9026746", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539861, "uuid": "b63519b3-316f-40c3-a806-236ed4e45cbb", "comment": "Malware payload", "value": "8a3d3eefa162dbc0c25c823c5b5463e8d923436eb8f3d8e13222c833d85c1a23", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539861, "uuid": "3733cd54-c1fc-4c2f-8d94-dee061fd43bf", "comment": "Malware payload", "value": "d7f6ed9000b1a015243f3d384c70300876f9faea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539861, "uuid": "b8138ee6-f717-40a7-9c2e-679bd3f82e8c", "comment": "Malware payload", "value": "c429afa19bb8d263d33a88ad17b362e5358badedd21eb76deb6e0553805d589a75d85e662a56c36a349b30adf33b0d49", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539861, "uuid": "3c1df2d3-6c84-4a56-bd90-5939bf7ec93d", "value": "T1D4F049FC179611A98F00D9776740B6DCBDC110CB6E614606E4684FE89BFCFA87318509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539861, "uuid": "f571f155-0d3a-4384-872f-ff07d4ecf49f", "value": "12:ox14eyCWdxHdM3YWOay5zE2BQ8dJzG62sW2q8trPWDX+Cv:I1GCIxHG8Q8iVsBqGOuCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539861, "uuid": "e94e788b-cc34-4306-9760-e06827567f4e", "value": 643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539861, "uuid": "21ae7b7f-4820-452d-ba94-002f4e38cef6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539861, "uuid": "20ca7d0a-ee98-432b-a9e7-078013de9b45", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1e3bcf-32d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775602924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602924, "uuid": "06b0f3ea-fc51-4b28-ad70-461ef6e75395", "comment": "Malware payload", "value": "5d6cb2bf977bc91dfeb22dba13aa5a9d", "object_relation": "md5", "Tag": [ { "name": "104-249-10-197", "colour": "#477903", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "sg.plantaalagoas-al-gov-br", "colour": "#025018", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602924, "uuid": "1506ac7b-a9d6-480b-82de-753da7575292", "comment": "Malware payload", "value": "8aae82dfe337761e498f8509c66b54f7ffb59896606869739f22f6b8a07ab64c", "object_relation": "sha256", "Tag": [ { "name": "104-249-10-197", "colour": "#477903", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "sg.plantaalagoas-al-gov-br", "colour": "#025018", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602924, "uuid": "03826239-5b25-4eb7-a9a4-e16825608b7e", "comment": "Malware payload", "value": "382714d4fee0668bf257f7b5c028c18879354f37", "object_relation": "sha1", "Tag": [ { "name": "104-249-10-197", "colour": "#477903", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "sg.plantaalagoas-al-gov-br", "colour": "#025018", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602924, "uuid": "9b6c5f69-c6fd-4fe4-a981-b9adda68b45c", "comment": "Malware payload", "value": "2710587a5a79e024b9bbf1e494e2dda9e4e2139cba4f1e5de0e9b43ed4d2cd1e310a585ccb30beb4e75683172cd3d229", "object_relation": "sha3-384", "Tag": [ { "name": "104-249-10-197", "colour": "#477903", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "kak-is", "colour": "#BA873F", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "sg.plantaalagoas-al-gov-br", "colour": "#025018", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602924, "uuid": "cf53ac83-f5f0-411e-bcea-c978b9e34a1e", "value": "T137C42354A0852F6DFBFD59726128395A4FF9A2A31ED532F4122E5EB788C4E24C093F07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602924, "uuid": "a4d041de-f187-4e4c-8ba4-66926054fb85", "value": "12288:hTwrQP5MAb4zv/zAhu/J/3FTPntJ0Le5BUb6cGZiNS:h76AMzvzJ1TPtJ0Le/zCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775602924, "uuid": "b4f61d52-2e14-4a3e-93f7-3f39d189f8b2", "value": 584213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775602924, "uuid": "e7400ea5-d7d5-49f3-b0b6-09387e1e8c97", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602924, "uuid": "b941645b-2482-42f6-b2de-9dc92eacb7f4", "value": "8aae82dfe337761e498f8509c66b54f7ffb59896606869739f22f6b8a07ab64c.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc61aa8-32cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775600108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600108, "uuid": "dde50e7b-d77c-4b2e-9a85-c6524f740142", "comment": "Malware payload (Mirai)", "value": "11d6eaf581210e4417322ec764dd3734", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600108, "uuid": "f592743f-a032-495a-a337-1f898e177f15", "comment": "Malware payload (Mirai)", "value": "8b20f7796ccace087779e32e7b76d010fc216419f48cda872b7f21e51f961e07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600108, "uuid": "a7005258-d1a1-4153-be51-4bc99d4b728b", "comment": "Malware payload (Mirai)", "value": "90799ef886fec7d666d3da5041c7f47b4e574efa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600108, "uuid": "7bae225a-22e6-4d7c-b114-72f9782727ed", "comment": "Malware payload (Mirai)", "value": "0278ed5a1cea00db9921552a91848c2589b5674a38b32fa4b4d627c8461546193b50d81ea97a8a2a5a741db08508ad05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600108, "uuid": "b0d21476-92de-4cb7-b803-75fd6aebb77c", "value": "T16AB30AA3F910DE7AF40BE7B38093081D7130FB754E53DAA276267897AE351D52826F06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600108, "uuid": "65eb8ce9-fcca-4b39-b4aa-e0fc58892144", "value": "3072:xUJOe2r5+FBMS+mhRBIOpDy0mkaeEzssVMORyOS:NAgGy0XaxAs3RyOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775600108, "uuid": "05fae88a-7398-49af-94bc-6192f5e3c616", "value": 108812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775600108, "uuid": "62100c49-9090-40f7-8646-c5576391db0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600108, "uuid": "3d816ee9-474f-465c-9a4e-f368959d543b", "value": "zyre.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bf9c94-3278-11f1-a769-42010a9c0008", "comment": "Malware payload (TinyNuke)", "timestamp": 1775562948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562948, "uuid": "3ed1123d-0cc9-43ca-8e55-761356d0022e", "comment": "Malware payload (TinyNuke)", "value": "54ef6d6c538080947dd46292a0f13669", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562948, "uuid": "16ad6cc7-d08e-47cb-b6dd-da64b708136a", "comment": "Malware payload (TinyNuke)", "value": "8c2038acd8c3a160c470cb6bea3d33b284818bfe148b2a3de0c160e79268feda", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562948, "uuid": "0f88a112-c15d-4510-88b7-d6dfffa8e77d", "comment": "Malware payload (TinyNuke)", "value": "948a4375e949d25a6efb0d69c38fbf3c6ee8b9df", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562948, "uuid": "be85b192-79e4-4957-a224-41e00f20e495", "comment": "Malware payload (TinyNuke)", "value": "3e5df573fa8a034d5ca1e2053f07ee75e7a53a7dbeac488a03bdf5885dafb72a14a3bba6e3d340533cb9c248831a2d15", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562948, "uuid": "122c0c54-065d-4993-9601-c7aa509c2b3b", "value": "T1FCA6D019A3E401B5E96BC734CA56C733DAB1BC925734C50F0158F2162F73EA29B6F226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562948, "uuid": "13a30bc9-4206-4690-a274-d1136ce5d33e", "value": "2eabe46c02a6772ffbc0545cddd275e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562948, "uuid": "00277879-29c7-4f2e-b7d2-111df765c68a", "value": "196608:2QF820ZxqsQfEn/nEEEEEEEEy7GRTBZ66z24VZbsr3l/3yKXuNuyzJeXODpD:zFlEqskEa6RTI4KXl8eXODpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562948, "uuid": "01d49646-688b-41d8-9451-492b1817cc46", "value": 10393561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562948, "uuid": "32da5998-f422-4f19-9e8c-d16f5662d6a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562948, "uuid": "e967a841-5ef5-450f-8014-7f7d98d8269f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8bc96b-327a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563733, "uuid": "e326e180-5d8c-4393-91da-524741f3863f", "comment": "Malware payload", "value": "71051651177c6b4f273843486fbe6094", "object_relation": "md5", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563733, "uuid": "521bb143-d30f-42be-b000-233b944e5a9b", "comment": "Malware payload", "value": "8d0888e72f906dee19b20784cd849444b5bc1971f8e20ad25dd452cf36043b36", "object_relation": "sha256", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563733, "uuid": "6c088732-5cda-40dd-9f39-cbd9925d6512", "comment": "Malware payload", "value": "6dc11afa347713ab40dbdd2b06afb115f09796d7", "object_relation": "sha1", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563733, "uuid": "79dca138-9f0a-45ed-a349-8be8c7bba5e5", "comment": "Malware payload", "value": "e70cc6392447902cbf5f5942302b3fd89150bd6f991b1664b84dc7d519dc6261f154550cf5139967482a3a47a6e6d82b", "object_relation": "sha3-384", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563733, "uuid": "2165cfd0-1e72-4a2e-8987-24f151526f9d", "value": "T1C2C080F6D12649283DCC733D307DD000C6DA5477402E177441CA7D55805D30D1234B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563733, "uuid": "10e23fd8-b038-45fc-9f3a-2557958edaa9", "value": "3:NFSjmJLguhtyqW+luTAZ+2Q8czy+luTAZ+2Q/29:ijmquryz3V58cu3V5/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563733, "uuid": "eb2d4ca0-ad02-46f9-8744-21d092ec8e78", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563733, "uuid": "a2d98c26-2d4d-4ce2-85dd-199682862677", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563733, "uuid": "78d2c5cf-c130-4504-beed-10683f68554e", "value": "8d0888e72f906dee19b20784cd849444b5bc1971f8e20ad25dd452cf36043b36.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5c9795-327b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775564357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564357, "uuid": "594fdf33-e58d-4ab8-95ae-fba285ddfbf8", "comment": "Malware payload", "value": "a924b85101f5ec277a12f26d917116d5", "object_relation": "md5", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564357, "uuid": "68a7a351-ad75-419e-b60a-7324cb8dd19d", "comment": "Malware payload", "value": "8e7853de5f4598a30e7aef9a79b88c10e31acd74a1a378bcc78d747a66c53e88", "object_relation": "sha256", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564357, "uuid": "f7e89d27-8b44-47a4-8d8a-03d3e04fbe11", "comment": "Malware payload", "value": "5db8061a97570e4aebd7aa24e3c786942fa5d1fa", "object_relation": "sha1", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564357, "uuid": "3f166040-3024-4fe6-bfbf-f165c8e9beca", "comment": "Malware payload", "value": "5a4af6e43da28338c7106e965447bdcb3e7d862f6074e1cb68b6652ac72cdee4b45b8ba47e843dbc36290e73049f4431", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-fibrasanchez-com", "colour": "#CA3013", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564357, "uuid": "252bb778-aa8a-43b2-95c4-d4e908d8038d", "value": "T12523DFD8C78BA6FBC402F37544088CFD897205D5C71E865ECA591AEF2A56E3A41F13B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564357, "uuid": "18bf3ea5-ea94-4ada-881b-57dbe87bd869", "value": "768:vI7/E9BCog7hoybOCQdJ6HZJe6LjFyvMQEG+zO4cyZlx4xnw:vI7/E3CD7SBr65I6LZ24cikxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775564357, "uuid": "35f8853d-d33d-45ca-8ba7-94c0135239ec", "value": 48180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775564357, "uuid": "5d19ab4b-d048-4111-93eb-5e738e328d30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564357, "uuid": "6e916a95-2d43-4133-91fe-a4493f49692a", "value": "Conferma d'ordine e di consegna.BZ2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25dde09-3275-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775561677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561677, "uuid": "0ac757b7-4159-4107-b5d2-bc0fec000248", "comment": "Malware payload", "value": "f1bc44c21eaf0e7d4ac642a0b6b79c51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WILLIAM-LAWLER", "colour": "#9E7849", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561677, "uuid": "f08364f9-fe2d-41f0-b37a-b2f53b379e69", "comment": "Malware payload", "value": "8f18c0411cea16c7b037582ec485ccb8cb8afbb48ba71608761fe1f4bb98433e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WILLIAM-LAWLER", "colour": "#9E7849", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561677, "uuid": "af678c8c-ea99-4e83-85a1-6358fe50e666", "comment": "Malware payload", "value": "4f8170d94d3f6e43e8e473d0514a587d69ddbde2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WILLIAM-LAWLER", "colour": "#9E7849", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561677, "uuid": "5d6547f7-908d-4bda-ba49-206ba9429aae", "comment": "Malware payload", "value": "14afdb0c7d8ab0eebdf284ff8fe15bf102c58d944cfd6396c02bd265897ced7ad69a1d6514cae1c08181211a56a48868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WILLIAM-LAWLER", "colour": "#9E7849", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561677, "uuid": "abfb0c18-a12f-49cb-bb15-0d86fbb1af91", "value": "T1A4E7333F659F693AE46E49763A32B550843F76A150034C1AABF8C90CEF550B06E3E3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561677, "uuid": "e4ec36ea-c413-4426-a9ed-7d92913298df", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561677, "uuid": "5d429a2b-774b-448b-a3e8-9051dfdeb8ce", "value": "1572864:mO9YbNtgX7HY173vfnv6GFkC6XZPAFMWqrb+:m3tWkv6rCYWAv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561677, "uuid": "fefbdff9-6e96-4019-bb43-532fc2099a7a", "value": 64803120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561677, "uuid": "3c377b9e-bfed-4fef-941a-c0bbc92c67ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561677, "uuid": "e3254c22-6439-425e-8ad9-12ec478ee317", "value": "ms_x64_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b133207-3251-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1775546015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775546015, "uuid": "d34c7fde-11ec-4ab5-a2b7-533bf523c270", "comment": "Malware payload (OffLoader)", "value": "56863dae26d0d3acc2a69c664fa10452", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775546015, "uuid": "ae1fb7e1-f863-4147-8866-6e28bcfd8ea2", "comment": "Malware payload (OffLoader)", "value": "8f2724b39ec89c54673cfedc088c18a591fad5eb263dd1cf5ccea0d574b1bdac", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775546015, "uuid": "ad5893cf-7280-492a-a5db-0fb6c4fbbd23", "comment": "Malware payload (OffLoader)", "value": "00138b6a170c1c4b1e41a696fc0f140cda705624", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775546015, "uuid": "12cea053-a68c-417b-ab45-eea28309b2c4", "comment": "Malware payload (OffLoader)", "value": "f0e1ab8f0a1a90e1bd30cfdd6437499b8696544369f15c4a3bc92302c65f4b8008365d70a62a882582f036adf92d6f10", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775546015, "uuid": "051fc8a2-93cd-4d99-b222-02c9cb450cc4", "value": "T15A561237B24E633DE06D5A3B59B2D2605C3BBE10A41F8C469AF44C5CDF2A1A01E3E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775546015, "uuid": "6c06cea2-56da-4b3e-8964-e8b9ab989911", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775546015, "uuid": "d6cce686-9636-4217-8fba-b1e51fcd22e4", "value": "98304:/N66CepHb0sRsAnYpv9Hp8CxzZjQvLNYI0ckRt5q5asRLf:HFrYhRqCfj8kH5If", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775546015, "uuid": "35003532-4bf2-4fca-b075-23acdb4fdd5e", "value": 6351680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775546015, "uuid": "f1cc6237-ba76-4bb2-8b81-02f347370e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775546015, "uuid": "e817c85f-a5f0-437c-a401-997c0e122e40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7a5ba3-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539926, "uuid": "4aa47bd8-bbeb-461e-a097-fcfc5bdbc746", "comment": "Malware payload (Mirai)", "value": "8e8a74a09fbf30dce5aeb56972a1be35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539926, "uuid": "78f24d2b-10b0-4cb1-be5e-f213220518d4", "comment": "Malware payload (Mirai)", "value": "8f5872518563ecacad13c9ab7c6bc7c288f178122654ab9fcf3a8ba7420ccea6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539926, "uuid": "9ff62663-b4c2-4db3-8551-366893240a28", "comment": "Malware payload (Mirai)", "value": "12ba8b0a0e7c4e5ab1d65a10d12a366b24adc26a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539926, "uuid": "84be19ce-1adb-4978-a7f5-106e859ed291", "comment": "Malware payload (Mirai)", "value": "3dbf75415a5d6781c19d4a7f082998570e2f69e152e7ab600d74a7a961e6855c4eb770625d604d4900951eaada66eda1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539926, "uuid": "4091f81e-a3d3-4a5d-ba5e-a60f4d41ce57", "value": "T180834B02B3580D43D1671EF02A3F37E5D3AFD59122E4FA89250E9A4A41B6EF3154AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539926, "uuid": "ead0957b-7ee3-47b1-8f3f-dff23014bf5d", "value": "1536:Vcdl8usQeNWNhNtoaeF++Qma+4a619tL2J:VcBsJW9WFcmn6x2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539926, "uuid": "957f25a0-f8cf-4025-825f-abeb7a48afb0", "value": 87744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539926, "uuid": "a495c43b-150d-4da3-99c8-1bd68b1c22ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539926, "uuid": "fa345e5e-943b-4b4e-a62f-51fa202f0130", "value": "windy.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f27c61d-326f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775558880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558880, "uuid": "b886ba3c-5a07-4b14-9e8e-03a4c90c4c23", "comment": "Malware payload", "value": "b489c3c39ceb143f4cb95dd73232229c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558880, "uuid": "4afa1b58-af20-427b-8cb4-5970ce06053a", "comment": "Malware payload", "value": "8fb1899795d8475dde4702f404a9b1682d1cbe9157cb44bf1d7221d727352e5c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558880, "uuid": "6d524743-51f3-4a24-afce-cffc2910d4ab", "comment": "Malware payload", "value": "02b5cc506fc95a7b996fc17d747b7f08eb6e05ca", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558880, "uuid": "8abf3ebf-673e-4d6c-b72a-f4bcd5fc872b", "comment": "Malware payload", "value": "d49ad45e50be6e8dcfd3f5f98c98ce60a168e699694d4a12029e990c2599d824c83ab4a7a0cbfff2161ad05a6b9eda26", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558880, "uuid": "fadb910b-fa48-4811-a68a-06f3613849eb", "value": "T16191C04677014BF9B71D15E1E1788902607396FE962ABC0CB8807B6FE85BA1BE5EC304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558880, "uuid": "5ccc647c-b130-449c-a939-6f133ffc3852", "value": "48:tIszKU48jv53wyth4uy44Oqtz3/TEt+SYIcTaIhD9NAjvHU7BM7urSlI1bRC7:+4ttgyth4ur45tz3/TEPeDf2f2d1bs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775558880, "uuid": "5a0104e7-2b7f-420e-bfc7-11f66ada7b6f", "value": 4448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775558880, "uuid": "deed79a1-6d8c-459e-9a06-0e4b62bab6f6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558880, "uuid": "b2dd6205-8062-4ca3-8543-846c0b76b39a", "value": "d.o.c-07401.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8862c5ed-32b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775588209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588209, "uuid": "2584e247-fffa-4bcb-8379-2cd2420ababf", "comment": "Malware payload", "value": "60ab217949eaa5872b4581601c03af74", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588209, "uuid": "ecfa8bc6-a4a9-4318-b968-2a6b9bc2127e", "comment": "Malware payload", "value": "8fd411d30ce27d8692db5eb1d99cbba517d990700624112f78c37e553ae6e4ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588209, "uuid": "d2c88e56-0474-46e6-a968-34d7c84e04d6", "comment": "Malware payload", "value": "117bf74ea2265156704810bb77c4373842a782fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588209, "uuid": "e7bab48f-7163-4c02-b123-daa22f0eda8a", "comment": "Malware payload", "value": "f94610628f2fa824ce619df58156ebb80a709f3c1b21081c82c33c19bb81c856fa439b9f350dfa3d90891df2821b3ddb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588209, "uuid": "82da2658-1997-46a5-985f-85504caed729", "value": "T1D2F50857E59550E4C0EED174C626A223BAA13C89073433E36FA1A7B11F76FE46ABC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588209, "uuid": "db651181-4f91-4cc3-966c-c0f85f47d26d", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQn:cqYUQuVDt0Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775588209, "uuid": "9fdc730e-e656-491f-a8a7-69e7fe40a0dd", "value": 3473408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775588209, "uuid": "2ffe1464-4e74-412b-b900-4741098706d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588209, "uuid": "711cb2c4-758d-4b66-b300-1b1d6fbaf41e", "value": "8fd411d30ce27d8692db5eb1d99cbba517d990700624112f78c37e553ae6e4ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323e7619-3246-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775541249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541249, "uuid": "b314c5b5-7451-47a4-a983-1d0209168888", "comment": "Malware payload (AgentTesla)", "value": "82d384f6b48c130edd99418b7047fb52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541249, "uuid": "4328e04b-8bd8-4a07-a411-073ba292aa2a", "comment": "Malware payload (AgentTesla)", "value": "9013f0b59bb96a3d12a6e00fc2713df6fadeb163c3efa394a1dc321c7e8beea3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541249, "uuid": "ee1a5005-5cd8-4d03-9c16-d41d504dfb97", "comment": "Malware payload (AgentTesla)", "value": "4fcb6f123f926cc16f44da70aa8e8f61c5db86c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541249, "uuid": "5f872f4c-60c0-4d89-8311-a64e6ca16a11", "comment": "Malware payload (AgentTesla)", "value": "34052afa9a2446c17afec324cff9903719b3f2eb761bad3ce91b426614c4e0c85ed869c9ec6194f6ff849e876b906cae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541249, "uuid": "a7e3f446-26a8-4774-af3b-b26b5718b93d", "value": "T12B94BD037D50F37AC79206F07A6DAD9252727EB0786FA6CEE3C1769B56B2D8144382C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541249, "uuid": "dbc4dc6c-21dd-41bb-b063-8437d37af397", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541249, "uuid": "581cd7ea-13ca-4d12-9b22-d618e971538b", "value": "6144:jR+xXQQwnYELJu52keg/wC2ka0aa1N69nDHrGqk8RIVMo:dswnbL8ICd2djnOTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775541249, "uuid": "9d2236a6-845b-4507-84fd-88fb7b9fd606", "value": 438003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775541249, "uuid": "88dee4b9-f09e-4234-bd20-8ff7f625774d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541249, "uuid": "45d383da-46fd-46b7-ad3b-d73ba4328429", "value": "Ordine di acquisto.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f4468c-3247-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775541705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541705, "uuid": "6f8341d7-3cd4-45f3-bc02-2baee2086c7e", "comment": "Malware payload (LummaStealer)", "value": "1740031c54455eaee3c3dadb66fd3935", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541705, "uuid": "96035278-be1f-483a-bf16-a5da6b1f3c5c", "comment": "Malware payload (LummaStealer)", "value": "9022822d6fec2947acbca51a9509c18293ecd1538ede58bd8a8f20ab60060cc2", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541705, "uuid": "edf80642-2917-4747-9d97-a5ec185c2c95", "comment": "Malware payload (LummaStealer)", "value": "cd96d5b9b70d77c7755ecc20fbba6e030d9e5c96", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541705, "uuid": "9ea86a76-c61c-4325-891f-dab6174f3b18", "comment": "Malware payload (LummaStealer)", "value": "66ad9e68f755b4741a293775a3db73527162b4037131985fe12868ce5b66af692228ee759e74e1c9f15ee6373f187857", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541705, "uuid": "fab510cd-c4f4-4164-b5e3-7ccdac65ffbc", "value": "T1DB656D00FDC745B6E426133259F762AF3736AC094F32AB87EA047639FA776D11822356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541705, "uuid": "645d1569-ece1-4282-b72f-a287c7ab43fd", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541705, "uuid": "76feb750-86b7-4b5a-98c0-cafb89a2ee36", "value": "24576:kZIN6r7YKJQvL6HL+4p97BUu9O5PceFe5vxaQAc1gWoCGqJ4f5PubGSoH68yxPH:k0qH62IuUM125PVSkQNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775541705, "uuid": "e81d52c3-6cba-4874-9ca1-d37b4e9da1da", "value": 1525248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775541705, "uuid": "15b03d74-9408-4924-a21c-8d5e7d5490d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541705, "uuid": "e0da7f63-5ea9-4074-abd7-8ea58f06e515", "value": "file_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac6f43c-323a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775536324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775536324, "uuid": "291dd58a-58ee-417c-8e2f-453611df7941", "comment": "Malware payload (Formbook)", "value": "2bf923fdf29f928430ff2fcd09b7553a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775536324, "uuid": "372db5ec-753f-40d8-a6a3-717d01201d8c", "comment": "Malware payload (Formbook)", "value": "9029bab7100d209fa33c32f5450d0fc7a5661d4e481069aec127adc719f7308c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775536324, "uuid": "77a14a03-8ecd-44dd-a09b-832f2d406898", "comment": "Malware payload (Formbook)", "value": "36864a2be19fd2048a2447be097fc53284092001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775536324, "uuid": "c03b1bd3-bad0-4bd3-8aff-8247be7609c1", "comment": "Malware payload (Formbook)", "value": "9283a6700df9807bdf652d67d62e24776001941856cf106748abdc783c102b0b22630abf75fad335a36ca399c9c509fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775536324, "uuid": "7b149478-0c01-4eae-9d5b-42fd626c1fbf", "value": "T1FE45F0413A1FE992F8A80F701A65FA7487663EE9B410C2065EE4BEE77BF27553425303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775536324, "uuid": "ec67cb40-313d-4030-adeb-c7e86ca15b57", "value": "24576:VYN8+v9KvWJJUUWSQUhddFj+3A0ljXwrgrNiey+Bjksyx:GPvaMSwHdl+3FjXFNEsyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775536324, "uuid": "14c50057-b2b5-46de-9b5c-888184437d23", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775536324, "uuid": "52fc30bc-5df5-4e85-8ce9-0644fc83a089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775536324, "uuid": "cfd6d2f3-46e8-46e7-a255-478edceadfd0", "value": "SecuriteInfo.com.Win64.MalwareX-gen.19538.15568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa2d05e-325e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775551625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551625, "uuid": "d5bd4463-fb58-4534-8099-30e810845548", "comment": "Malware payload", "value": "063a7532e88d40f3d8773d3c00b3d3bd", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551625, "uuid": "f1c734b5-c938-413a-a5e8-eb1b1a253c8f", "comment": "Malware payload", "value": "905a82789988a28d0369c98bf00e150ecbff27d576a6a6add5bd99359f2092d3", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551625, "uuid": "64a768a0-1fdf-46d5-b20b-f605ad7574e1", "comment": "Malware payload", "value": "38dc4bee8675064341e72b88e5e60e3df3b5b7df", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551625, "uuid": "611bc822-ae22-4dd1-9e59-f42fa553d9e5", "comment": "Malware payload", "value": "a10f4ea91561b6522a8218a2f07789fb1006c25b9b10c06199a844d9757a2a10e3ee714a7f9b5e320d1f2a236af59093", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551625, "uuid": "792af877-27f3-4fc1-9d66-15add66cfa79", "value": "T1DD5285E660D3E8D296610289A94E894BDEB7237B01D81D91F93CEC441BEC99DF2D40DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551625, "uuid": "8e29e008-57e5-437f-b726-be696a45e80a", "value": "384:f3YumuQ58OitSbvdatVbiuoUnX+Yqmzb3CGNBvw+wc+BSj+6wwQOC9:f3tmuQ5CjsSjhQOC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775551625, "uuid": "c346740f-abf3-4e88-875a-3d4e20a37777", "value": 13742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775551625, "uuid": "1f7e981a-b047-4685-bd33-d57dc872ff22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551625, "uuid": "9d5810ff-6c36-44ce-8f4f-e0471741e1b9", "value": "905a82789988a28d0369c98bf00e150ecbff27d576a6a6add5bd99359f2092d3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725bdd14-327a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563691, "uuid": "139b3730-f405-4971-9512-77b1ea80606f", "comment": "Malware payload", "value": "22dec6091fb508bcd9fda8c68aff6155", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563691, "uuid": "93d1a349-ddd8-4ed7-9d3b-6c79939d6ecd", "comment": "Malware payload", "value": "90ed9e6f9e39e44317ab56a606efbeff70553cf9c9be40aa781d684e18936c77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563691, "uuid": "fc5905d0-e398-47b4-a81b-8e26284d9d33", "comment": "Malware payload", "value": "063514a115d7b65b252c799828076f868875e581", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563691, "uuid": "d167e4b7-4e47-49e3-b434-2ffa15d0b588", "comment": "Malware payload", "value": "308eee653f9a224b1cd2222a32d19f054215c0f6b5f919e6b39fd47afb240ebc3605aa001289ad419b8ad50fb81bdc0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563691, "uuid": "eedf4578-8f80-4dc4-9f57-99b4398b79ef", "value": "T11064D005E3E89854B5B36F555ABD1880083A7A611E1F8CFD5B280E8C4672D4EE9F3E37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563691, "uuid": "baeef6ef-97da-44b3-a25e-44d55caa146d", "value": "6144:TLoSJDD0lAQ764t+n98AgXx6gp3f8MU797q3ga4g0ZFx93NT5:TLTutxAgXxtv8L9mwtlZzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563691, "uuid": "b8017058-ca12-4daa-85f2-240cc57b7721", "value": 321410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563691, "uuid": "c86f4af2-952f-462c-99b6-46fe2802d11d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563691, "uuid": "83f5b4fd-93fd-4012-964f-46c554b59172", "value": "SKM-BKS485103720.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e053fb02-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554856, "uuid": "29b1e8bf-fbe7-4a54-9dcc-a5f6d6426e19", "comment": "Malware payload (Mirai)", "value": "7575be386665f0304d661b48828c21cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554856, "uuid": "46b7acbe-4ed2-4d72-8a26-b130bd13979e", "comment": "Malware payload (Mirai)", "value": "9164db5a23b56ef88c946b4cc3ef0d59540e1dd6303769c6a4587ce2be782e1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554856, "uuid": "2e284a35-3794-489a-a15e-c4ae495f1f95", "comment": "Malware payload (Mirai)", "value": "150eae51851198273d1f6587af74c231d06d4ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554856, "uuid": "9e9fe4aa-75b8-4a75-8fe7-2afd8c0918db", "comment": "Malware payload (Mirai)", "value": "27beae9f39736a7ecad5b95573143fdd66f674f452dc1e830601f1478d493a019c42c6c29599997860da7dc0777b0d65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554856, "uuid": "441a33b5-842f-4ea0-bc89-16c522918d97", "value": "T192535BC5AA47D8F6FD5602711173E7378632F13A1129DA87C7A9ED32BC52900EA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554856, "uuid": "10e27e79-4bf5-4257-9495-4488ac39e75e", "value": "1536:ahZerRy3lVDKvfb9IZG4R9bdx6jQ9P++CMq32UFSTGhk15uJnaroXf:ahqo3lVDKbd4b5P+zf2UMT2M5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554856, "uuid": "b33ea753-2cb0-46e3-9037-c5bff5bcf541", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554856, "uuid": "8bc83769-a8d0-4f48-8372-a8f002729b8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554856, "uuid": "a51e319e-b917-4472-a66f-8230bbc62ffe", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7c132f-326a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775556945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556945, "uuid": "fa20a1b0-2545-4221-8109-0070c29ce7d9", "comment": "Malware payload (Mirai)", "value": "ccf778ef80ab5744c890d3b54ecdfe40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556945, "uuid": "fc715043-acbc-451f-baec-3739e9b86c99", "comment": "Malware payload (Mirai)", "value": "91cab2503c02d5f11f63944b0bf7bc27ac7e2ae397efc1068a80595809156392", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556945, "uuid": "a4bd4c85-acbf-4654-bae5-156a5056e340", "comment": "Malware payload (Mirai)", "value": "7ce59b2072b9cde648f33f07aef2180738095f56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556945, "uuid": "dd645b2b-4abe-48ff-93ac-8b54ba48ecda", "comment": "Malware payload (Mirai)", "value": "af54974d63a4a7ccbab38c4b3a2d2b62b015274e0689f45950ff94d0ea1b15168997e45161f547b14d00aa4c864667ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556945, "uuid": "1dc474af-e616-4dea-bf48-77b359f0e7dd", "value": "T151836DC5EAC3C8F5E92209301172FB675AB3D13E2268EA83C3A9D975EC125C0F55679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556945, "uuid": "f0e503a5-d2fc-4768-8dd2-8f31eb7a3b99", "value": "1536:+ZtH7MIlsW4yoARFnmfWz3tAjw19KHVd1YQRFBP:+vHzlsW5b3nIWbti+9oYQHBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775556945, "uuid": "1641e374-eef6-42a7-ab71-46535ca4e246", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775556945, "uuid": "518db6d0-4ea1-4e85-81aa-b453c9f83894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556945, "uuid": "07b027f5-afe9-4913-9591-ba5e89c8f08f", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289978be-32d4-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1775602222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602222, "uuid": "76c8deaf-5b09-4693-9b8a-416a0391e0b3", "comment": "Malware payload (RatonRAT)", "value": "3f7e48cd9458b0153c58c191e29f8b4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602222, "uuid": "c945c8f9-0d6c-44a0-82bd-0db43ea67de7", "comment": "Malware payload (RatonRAT)", "value": "95ca1ad664de98c14a5d157e6bb7d5bc395fd859b59f1842047a937b984e987b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602222, "uuid": "a3a27145-b6d0-4ba8-964f-b1a702e70c3f", "comment": "Malware payload (RatonRAT)", "value": "7a1e9bc0a143d6095d4bb6f5dd352b1ebed65d75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775602222, "uuid": "6e83dadb-63fa-4255-a508-77585990b706", "comment": "Malware payload (RatonRAT)", "value": "3986fd09a992776e30071cbd332feeb1ab558724cb173d658f5db1bf9fdcabe9076b6cf4bb5732c00563d1c6b507d2de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602222, "uuid": "31d0b90b-1967-4ca6-b5aa-5e5f482a5880", "value": "T1DED4121473FD3A16FBBE8F7E19F050580E7272934E20D24C4E8794AD1A75B829924FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602222, "uuid": "32d55f40-8190-4b53-800b-6b0399a4de35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602222, "uuid": "48aab56e-2f87-4fd1-977f-d37b47553c57", "value": "12288:xlBR3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piI9f:vL4kkA7lXkXDDuAOFhWSApi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775602222, "uuid": "afb54011-b0e2-4d8f-8ccf-a719b0d6aba0", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775602222, "uuid": "79815bcc-41ec-45cd-b1cf-64c097f4e65c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775602222, "uuid": "ada4e5a7-3bdd-410c-8b15-5a4db4b4018a", "value": "ex1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55419399-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554193, "uuid": "0fdea33f-967f-422a-b164-70c209e4a9d4", "comment": "Malware payload (Mirai)", "value": "0700d47484be4368e07e893d7b0dea63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554193, "uuid": "e22e1c1a-dc3c-44b4-8c3a-b3c19eebdfba", "comment": "Malware payload (Mirai)", "value": "96392e30ec629a3dac13d544e5f73fa17d0e530c45ac274547bd2fb4b2b8a9aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554193, "uuid": "6b607837-31a7-4f28-bbb8-70ad64dfa5b2", "comment": "Malware payload (Mirai)", "value": "4736f83f537a4137e283e9c061e48d3646800930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554193, "uuid": "e6d14277-4f40-4735-b3a0-fa7db5c8d71f", "comment": "Malware payload (Mirai)", "value": "8a0508e57842bbd7534326032bf4b42fdafceafb361490a3fa8d67fca7f93643967b40bdc6e992b3702aeeadce1da3d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554193, "uuid": "7650d548-0074-4066-a810-7ce25fc316b1", "value": "T19A83285AF9814B11D4C5127AFA1E164E371347F8E3DE72239E24AF3037CA52B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554193, "uuid": "f25333de-2713-4944-8c2e-6bfae98203dc", "value": "1536:Gpn2EgaNGvcV+2sE/7iMPUNBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYtp:BVE+2dmTEZCSHYMactW4Bi9gnS4V0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554193, "uuid": "9ee24862-f347-44e4-b6a3-5900fc51b9fa", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554193, "uuid": "5d9b012a-de27-4051-b873-10f8553faeb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554193, "uuid": "70f7b772-e7f5-484b-ae33-ad072d323990", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97421c5f-32c2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775594676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775594676, "uuid": "21fa7428-49e2-4cc6-9619-b334a2910d8c", "comment": "Malware payload", "value": "ec66f157a75fba34713d84cde921f557", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775594676, "uuid": "25629f2a-e859-46ea-a529-923fa97390dd", "comment": "Malware payload", "value": "96872632f698e339cbf83a54551991cd035dceac21fe5553dde2d0d793099570", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775594676, "uuid": "bf422f57-eed1-44bc-bb71-902f21e4d150", "comment": "Malware payload", "value": "97650a4d453ffb9e4eb5f2c71926a84ecab0d8a6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775594676, "uuid": "ac950119-d7b3-4a47-b012-7db05de2f553", "comment": "Malware payload", "value": "12086e41a88226f995b6ba345991020574163cd4bffaae74721bc114ce2c48fda78709cb5d1cce99ccfffbc85f91abe0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775594676, "uuid": "b812d8ce-c2ee-4cf5-92a3-f8873991cef7", "value": "T182F522568521F096C1A1096BB8886D20CB82EAF954487F30515707B63FFD7EB2FF990E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775594676, "uuid": "8e299435-95d6-452b-b426-9d632993f520", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775594676, "uuid": "aa3e4f88-97b6-44a7-85d0-86f8f7bce734", "value": "98304:PcS171niB5oIJEKt+qaDxVld/MHLYHfVdc:PnniroKEK+DxVld/QLofzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775594676, "uuid": "ca0de457-3a88-4640-96dd-27267a80f55e", "value": 3494912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775594676, "uuid": "da2521d4-d2cd-4162-a61d-bd2bcce3dc60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775594676, "uuid": "cc09db52-8c60-431a-9b54-570676aaa48b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6711733-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552718, "uuid": "17db7a63-8227-40c4-bd2c-7fd1ba2b32b8", "comment": "Malware payload (Mirai)", "value": "c09ab83b943ff9ac39514a3e8e01d66c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552718, "uuid": "60463667-a002-48a7-8bab-5a7fd3c43be1", "comment": "Malware payload (Mirai)", "value": "96a81eb7cfa5b874bd61da09d6c91474fc7a81799800f7ca125de6cb0a915dc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552718, "uuid": "894f936b-684e-4e0e-a658-3236e5480d59", "comment": "Malware payload (Mirai)", "value": "fcd59b9fc5326730c9ff95e2993541b2d46bfb3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552718, "uuid": "2b7f8c09-061f-441d-a2c6-1b0a3c47a2db", "comment": "Malware payload (Mirai)", "value": "b1e9ffe4064cdd78dd4079ef35a9733287f3a2cd56b0edd1056833dc53206409251c335c231fadc9ebf2dc6889c52069", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552718, "uuid": "5eb72b73-e488-41e7-8eb9-0b29b2c92e12", "value": "T118F33B46F6408A13C0D6177AB6EF42453323AB6493EB73059928BFB43F4779E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552718, "uuid": "36e0022e-6d50-4e2b-b9fc-ca7fd9ea3297", "value": "3072:Dag64iZXzawFS4BHqW2oADK7pzQVINKLvrsM/9jnJ:Dag63zawFS4BHqto/75QCKLvoM/97J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552718, "uuid": "599d5a60-7b86-4c04-a9ab-0c5e4fedda42", "value": 160458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552718, "uuid": "bc41e2e6-650f-4e7f-abdb-2c114816f45f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552718, "uuid": "ef275c66-85c6-494a-bd00-47b0cec045ca", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37dd9f05-3274-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775561016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561016, "uuid": "d56a3ef5-fbd3-43d5-bfe9-481b059ac663", "comment": "Malware payload", "value": "25a0a06277141d9ccaecc745fd47d783", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561016, "uuid": "dcb33cb5-7269-4bb1-8e22-196dee673878", "comment": "Malware payload", "value": "970ef103f16fe671dfc71164b3911289d748710e438c647a2fb9112d2f3922ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561016, "uuid": "5c93aa3d-c156-4344-8685-54599fd9b113", "comment": "Malware payload", "value": "de112aacc88dc50a332645eef0c727f4cf33d1b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561016, "uuid": "bf856480-d1e4-456c-89c7-e3b0f6aa2d59", "comment": "Malware payload", "value": "4bd8b505ad76d3726b8b8727676113ca04afedc06af29a21278d929983cfa520f3423adb71ee4de1cc5895b05c53a08e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561016, "uuid": "6e3f50f8-054d-4a79-a5f7-1d3e3530152b", "value": "T1B1C1960B97EA4337E8AF4F3118F30746977AA454D963EF9E3C9001195C62B40D966FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561016, "uuid": "478ba610-0c75-440a-b289-807936bd4c59", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561016, "uuid": "833803ae-9d67-4ae6-809a-6d646328c804", "value": "96:02Y/2LXouyybyHxWtEaVh797LqMCpGaN+hryK:39LX39EaVB9ypGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561016, "uuid": "791d1b49-2f04-42b3-96e2-e6308879431a", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561016, "uuid": "a53b9376-6d7d-4014-aae6-7fa4a222df71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561016, "uuid": "1c93e678-c7e8-4b5b-93e8-6ec7ea82b4b6", "value": "970ef103f16fe671dfc71164b3911289d748710e438c647a2fb9112d2f3922ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e58a1d5-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554154, "uuid": "79227604-d33e-41b1-8e58-2ebf969baad6", "comment": "Malware payload (Mirai)", "value": "5c22e8986aaab0f14ab966ca597ca492", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554154, "uuid": "9c073dda-b461-49ad-8c99-36430c412092", "comment": "Malware payload (Mirai)", "value": "987114689bd78006238e6113db135720e04de36e05392637ebdd67d3d5c52d2b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554154, "uuid": "7c373a26-0f1c-4749-a872-901b0baa386a", "comment": "Malware payload (Mirai)", "value": "a6a9200ebf5e5bb12ec062f2f1b3507f3788caf4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554154, "uuid": "12b4c9a1-6387-4782-b8c1-f89f1fc9f640", "comment": "Malware payload (Mirai)", "value": "0c1d0928a02ad2b9fc832255256e044c909a7f7e60b1520ac94022f437b056365649449baa3cd0b7d82dfaf6d3095285", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554154, "uuid": "8267136f-effd-402f-a266-2a2a5aa3cde0", "value": "T14A734B21F9391927C0D5A17A21F74B23B5F683CE20A8861F3E710F9DBF615403A57AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554154, "uuid": "296f8615-4f49-4c42-86a4-92b537cbcc3f", "value": "1536:0km4j59k6XTXypv4u4YF7tR7SYm5BHxS1H1tTvfT:7PQbrL7SYOBR2vfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554154, "uuid": "c0c6889a-e9ba-443d-9788-25eb180ff8ec", "value": 80032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554154, "uuid": "3864dfbe-7ab4-44bc-b53a-816edd034d7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554154, "uuid": "80af16ff-ea9d-4b13-95af-038996e2cbf6", "value": "Space.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c8355b-326a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775556871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556871, "uuid": "35f0ab07-18e6-4be2-993a-1ef2afc30d9f", "comment": "Malware payload (Mirai)", "value": "40a86cb59ba03443fcba991955317197", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556871, "uuid": "42605381-ebea-4b46-8cf2-8b8c49614a48", "comment": "Malware payload (Mirai)", "value": "98b443372c7329d0f7dc8e00e8b4aa22d591c09fc7ef90d453aab1a0f3162b53", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556871, "uuid": "9c04342c-d1fa-463e-9f21-fb82fdbebb0f", "comment": "Malware payload (Mirai)", "value": "7f319497520e7e0ae23bb83b8b5db0769272aae4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556871, "uuid": "85ea9759-c8e2-4a04-af54-2cd76adfe30a", "comment": "Malware payload (Mirai)", "value": "5fa726a4ba19fedc22c230ee39e14b3908bed02864350215b87778585c706391eaf905ec4a6d5769d25016ee5a4d22be", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556871, "uuid": "d39df9d3-7096-4b1c-bc35-14ded42c0fe8", "value": "T1251302A45D0E633FD7A0F3F2216F48B9D49C3E2129AEF55535CBA1D285634A46224C5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556871, "uuid": "80a01d2a-bbdf-4753-a8ad-c7be880958af", "value": "768:W2pucm+IzYMmllcKbipt8W63fAxMQqiFCeh9+skQh:W/cm+/MhyW63ApVFCS85m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775556871, "uuid": "51b46bf1-93ee-47b2-817e-d7096f33c6a3", "value": 42776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775556871, "uuid": "5a208c57-afb5-4ff1-8e2b-bfb20e87c267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556871, "uuid": "effd4b89-e621-40c8-b137-5ee415366608", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15af4554-325f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775551939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551939, "uuid": "18ab736d-845c-4bb3-864b-ee221f9a2f40", "comment": "Malware payload", "value": "378c53337cec9b875c685d712d64e632", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551939, "uuid": "1b17e0f5-c098-4158-a387-b57b89dda7e3", "comment": "Malware payload", "value": "99cb63bdbaffabfa6ec4c1bdd88ee42adc95954f2c4f99b1715348702cea67c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551939, "uuid": "c6e47d11-c091-4b12-8c2b-15083d9313d3", "comment": "Malware payload", "value": "92400d32a1656937008bd696180a4d5bd2ff3bb8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551939, "uuid": "0dd49d51-dc92-487e-8163-2f16b18f6ae4", "comment": "Malware payload", "value": "cd947bd622d6c38255b492d3b3ac5cd0b8fc282f977720032232817b67b98abb0db2edc507374effe8d0d6ec232b38aa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551939, "uuid": "2efec9ad-583a-44f7-bd1d-abb1bcae18f6", "value": "T1DF2148D065C1A6DBAE58BF6AC5CDC5244F0B22C06094298BED0B3A506E792C576F350B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551939, "uuid": "1f545912-20ea-49d7-b396-dc93368606f4", "value": "24:MJpfXbwfXa/CEf6PsGPdVAHlHBNUOfLrNiFc63m2vKHoy9h:M7f8f2xf7GPMCOfdiFc6JvSdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775551939, "uuid": "ca7a64a4-7975-4597-b5a1-458932ec88b8", "value": 1281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775551939, "uuid": "368b213f-6d9d-453f-bc4d-3787afecca9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551939, "uuid": "eb47a00d-ce3c-431c-9440-ac9ec1930074", "value": "99cb63bdbaffabfa6ec4c1bdd88ee42adc95954f2c4f99b1715348702cea67c3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f771905f-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552747, "uuid": "c3af5ef2-2f5f-447d-8a02-259c4268a215", "comment": "Malware payload (Mirai)", "value": "fe092e9eede4c21087451b55b0a483ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552747, "uuid": "6c710724-5f55-4afe-b86e-b6b03bd81b7f", "comment": "Malware payload (Mirai)", "value": "99ffc3d19c81f8d469f88ab4623f16c8c2c43371f0c970058e923c5e80a43cb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552747, "uuid": "23e2db80-d37f-4255-8982-aafd48b14c30", "comment": "Malware payload (Mirai)", "value": "551737cb7b98fa67a83f2001b81879bb86976472", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552747, "uuid": "48944c84-8f35-48d6-9301-64b5434870e5", "comment": "Malware payload (Mirai)", "value": "f0d64f8afbc9b57bdd15c9f305a94295a868ed4f8436af79bcbe5e52cc4c50d53ac0272cf722f8684d18df7cec283d4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552747, "uuid": "5d83fe6e-ef17-475f-867d-d1f04a813e9b", "value": "T105132A92B8829A37C1E0127EE96E805D3325A7F8D2CFB717C9156B417A8A41F4D77B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552747, "uuid": "7928bdb7-49e6-462c-b536-361f7c982262", "value": "768:/ZlaDk2XL0mqmQZIVNU/zcXfaegojJ3Ru/+DM4Yq71dUx:vabXIm3QAfaM9c+g61d6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552747, "uuid": "480e29c9-0f10-48bd-b069-8749a4b6c701", "value": 44576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552747, "uuid": "e70662f6-7a34-4de3-8223-b087e4f16d77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552747, "uuid": "8d9e0130-78c8-4ca1-bd02-48a95e646e6c", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061113de-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539887, "uuid": "016241c5-ed14-40b4-9b05-9711878cd351", "comment": "Malware payload (Mirai)", "value": "c4f2088ba46c8749978825f4205e6cd1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539887, "uuid": "6717f657-e5f0-4f67-82c9-d40a80b9a86b", "comment": "Malware payload (Mirai)", "value": "9b63ebef7f6ad31bc9bbcb7ced55570fa1547d8690eeb3e55bac95b7a4e6c784", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539887, "uuid": "30fca12c-dd03-4d4d-97d6-f1b83918fd1b", "comment": "Malware payload (Mirai)", "value": "3cff760706318ee14af8f8a819df99180aed6c26", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539887, "uuid": "ab554a78-6346-4d8a-a70b-1140ad37422a", "comment": "Malware payload (Mirai)", "value": "4d1acedc824bdf086eba0a2f0be2045fa016cd0fec2b43d9660b54ba07843fa7af26f764351b27119700623cd3d1d0eb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539887, "uuid": "0fce683d-d3d9-4d27-9d7d-b58f23db5a53", "value": "T1FE73022017B371DAD35FAAFD55179825E773ACF9384A175926129D2282DE99B0D030C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539887, "uuid": "c39a3358-3e83-4d0c-8c48-dac3d57118ab", "value": "1536:9aZwDmoX67vNrZJw7nK276AkEQNDf9RL0ISXxIE9e5SZ9E59n0IgSZbxfD:sZwDn6jNr/4J7PPQJj0zXxIEuEIdbpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539887, "uuid": "ae526ce2-9077-460b-b3a3-a9901711932d", "value": 77588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539887, "uuid": "de80da4d-fa63-4481-944d-a22aace797ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539887, "uuid": "40fb2e56-dc1b-48a4-86f7-8d796a6d6bd4", "value": "windy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6de4d00-325f-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1775552236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552236, "uuid": "9ab23638-6773-4462-b232-db10bb9b4118", "comment": "Malware payload (VIPKeylogger)", "value": "8a3a39917ecf4ab6dbb718d16937a6ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552236, "uuid": "a36a19e1-a883-4b0d-abb2-c6da846a5d66", "comment": "Malware payload (VIPKeylogger)", "value": "9bca7a3ac404807c63670141a3459eac24450e0cffbe1066cd3c8b503a917170", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552236, "uuid": "476f7493-31eb-467f-9abb-1d7ef89e5291", "comment": "Malware payload (VIPKeylogger)", "value": "d1391b888eb39e3d475f435a5acd630eafba41ad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552236, "uuid": "47c14819-4801-4127-8832-82b8a5b8330b", "comment": "Malware payload (VIPKeylogger)", "value": "843d1418a321d9bc18bcce0c0e4e6547c2d80d7da381a796b9862f91bbc85f3f74fab257df3d910db449f930c7c7fbd7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552236, "uuid": "63918e2a-91c0-448d-8199-5c57a64c0ca1", "value": "T1ADD2B6CE7BCAB4A5835275E3195FE0A6B2AE9D80344C9050F6C4ECA87C2C71CD566D7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552236, "uuid": "fc40a2bf-ba49-4fab-b522-d5165f64df42", "value": "768:momtdRbnU4a6ynxIh+anP6L3i/uEgnbYncMcCGSl:mfbn06ynxIEaP6L3i2EdnPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552236, "uuid": "bbe0f9f5-669d-4746-ba8c-64ea177ce3ce", "value": 30698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552236, "uuid": "629ffad3-4af7-4f75-9f2e-ec3327c17ce5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552236, "uuid": "0acb18b9-1b98-4e6a-b89b-6a804d34cbd6", "value": "INV237687289.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d57a61-323c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775537061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537061, "uuid": "38f9154b-8c07-4da6-8dd6-98be149f10b6", "comment": "Malware payload (Mirai)", "value": "2f300516d3a031ce7f31570efd1fe0a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537061, "uuid": "64925d42-6402-493c-af08-a67b6fb98032", "comment": "Malware payload (Mirai)", "value": "9d380030b3d2b1fb1194e7af9fa12a4443fabc9bd1a2d0036efc05e68888313a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537061, "uuid": "61febfc4-4630-42ef-8709-0c2d75e3872b", "comment": "Malware payload (Mirai)", "value": "cd7592ad641086389b794115d9cb65c3668f27dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537061, "uuid": "3dff60af-2951-4473-b113-4c1a03bf117c", "comment": "Malware payload (Mirai)", "value": "af9017adc6859309ddff114fb04bb5191de36d92faaf6db63115b4da6c16ace4c2e6dbc8d607a01ce92043dc73d00b45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537061, "uuid": "855f78b6-2c6a-4b1f-bef6-fe3bc641819a", "value": "T1F29309A7F900DF7FF40BE2B780A309057230FB7509935AB2772779969E790E41866E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537061, "uuid": "8c86ef25-829b-435e-809f-b0199d3574e5", "value": "1536:9lrLMroaqe4MqpKN6I5u6u61K8Gm37HSy46i1eSzMd24990kJyjdJlCp:vcroaqfBEN616u61Byn6i1psWkJyjdJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775537061, "uuid": "c77ceb22-5b19-42e3-8e81-eac13d31b5d9", "value": 90748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775537061, "uuid": "30bf3ed4-253e-4b7a-9b95-dafea0beceb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537061, "uuid": "a1e2847f-6cf1-4756-94e1-8c735e568b03", "value": "zyre.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c794a5b-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561990, "uuid": "91c0bbd8-3056-43f2-902f-5eeba4b0fb86", "comment": "Malware payload (Mirai)", "value": "81cd82cc5bf674da41d702f0d45df34f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561990, "uuid": "e37f019a-fe9d-4285-a7d9-1c35d94eb72a", "comment": "Malware payload (Mirai)", "value": "9eb0aaff2ad7562d8d354ed9a2ba3521f14cd4af1bf7b0db2c96b3ecac65197e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561990, "uuid": "44c9f2ac-e993-4183-9188-eef429922303", "comment": "Malware payload (Mirai)", "value": "1f6f62d7310063418197632b9de5b64cc793d9d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561990, "uuid": "54887801-98be-4e99-bdcc-332986ffd693", "comment": "Malware payload (Mirai)", "value": "eee6352aa8b031a2223a7d9bf654d46181c3141a2b6b46b7ee3ea1da695fbf5a8019be60589ce7983d410d141cb1ba75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561990, "uuid": "24ac1d3e-2764-4433-8fc7-97c3b448f25d", "value": "T18BD33963DD26AF1AD116A0F0B1F14E741B43FD2589A71FB96476EAE08183DCCB5093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561990, "uuid": "b7576ef9-b834-4a4b-8c3d-f0c667c36d43", "value": "1536:v9S9OXQ0NX2Yba0I3NdG1C9xp83Cem7hnuEqZOsWPkJhKzkG1Q4bQQnAIy:vTQC2tDu10bCCxuESHWcJozJAIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561990, "uuid": "e3d61114-6980-4fcd-bd18-70d7e98b2c7c", "value": 134880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561990, "uuid": "6cd7eec9-0f56-479f-a54b-635a6025522b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561990, "uuid": "0c7b19f7-966c-4787-be37-d64ee758c4f8", "value": "nsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fbbfbb-3258-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775549226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549226, "uuid": "835aaf13-aa98-4f2a-b133-158962d90de9", "comment": "Malware payload (Mirai)", "value": "28d144de120d3c8c8216e8bfb8947e7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549226, "uuid": "f5eb535f-660f-4d35-82f3-594f05c35a76", "comment": "Malware payload (Mirai)", "value": "9f6dcf0ec3dca1629a6e5140c5cc62aeed82194f98dc1b2fb79c9c687ed20556", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549226, "uuid": "d6652e9c-e9b6-4840-a902-edf98121e571", "comment": "Malware payload (Mirai)", "value": "a7254ce563bd9f21f6902dade93e0bbef7e1e5f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775549226, "uuid": "8c838afc-4754-41f5-a61a-2831c82da755", "comment": "Malware payload (Mirai)", "value": "dc205e67dbffc67b6255bb17a918a5b3c443112a39398387f99b45b7ddf8b7b82f1add3a59e79b1b8a0fb66c87ce7cf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549226, "uuid": "2b8ebb68-3652-4442-82aa-a791a7b52f8d", "value": "T1ECC2E1309771077BF6CCEEF95D37462D1827866DABDA70283FC964E348824727128BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549226, "uuid": "ddcd274c-cabe-4711-a42a-5668e9dc4a04", "value": "768:w31Cf/r/KtXA3o1cJZd3kA4k4d3ikvRCtDWs01:KSIw3mC74dfZA76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775549226, "uuid": "04ac7638-62bb-4869-9ae3-be70d4cd559c", "value": 26092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775549226, "uuid": "ac1b35e0-b646-4c83-b8ee-ea0f62dbfb92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775549226, "uuid": "70fac70d-def9-42ee-9bae-907a0ea2a3b5", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8facb36c-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554720, "uuid": "81f127ae-453b-4947-bcf6-0d4fcd653433", "comment": "Malware payload (Mirai)", "value": "589cdc58fc5cf4e916c458979d2570b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554720, "uuid": "320788a7-25f7-45b1-80d4-27b407ef8d51", "comment": "Malware payload (Mirai)", "value": "9faa8f1f81a06a057d3ef0ee5ad9339dbe44f1c1c0730be966a1a065a470f149", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554720, "uuid": "a08c16be-75fe-4cfa-807f-00d5fa05d2e9", "comment": "Malware payload (Mirai)", "value": "214b36f5aeddecd21c5b5223386a25eda958ee55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554720, "uuid": "aae9c740-e2cf-4e11-9e27-d7b6185c4c7b", "comment": "Malware payload (Mirai)", "value": "cf9cf7b6616d8cad827e20bd4c03f270bb4bb4c6815868458005315aac53374cb37983068bdffce46e6633790d830c40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554720, "uuid": "8ca5a9ad-d8f5-48da-9acd-575674ba2886", "value": "T132E32B46E6414B13C0D21779BADF42453323AB64D3EB73069928BFB43F8679E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554720, "uuid": "7d8f0ecd-8869-4f19-9384-b92dad799c00", "value": "3072:szUEHxeByy5aA0U456e9ZElTnXRzUJhO/+UeLsM/9guJCVF:szUAeM4aA0U4566GlzR4Jc/+pYM/9tUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554720, "uuid": "c9a2ef80-3b06-4ca3-bcf5-a41588b3aeb0", "value": 157131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554720, "uuid": "5dda413d-6100-4ac6-8f17-3b1e6dfcafcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554720, "uuid": "37027034-84b0-4fff-98fd-f83a0c7f66a3", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cf46d3-323d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775537685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537685, "uuid": "628f3f47-bdf1-41bb-9cfc-ea7736f1c61f", "comment": "Malware payload (Mirai)", "value": "0621d9d6893576c27503b86a64e81781", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537685, "uuid": "9ec6f325-6e76-4c86-b4f3-e94ff9013314", "comment": "Malware payload (Mirai)", "value": "a206c528aa82627c1b19646cf368619ad8d550b712cb2e2fe005883ca6761d8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537685, "uuid": "2233515d-a7ef-456b-855b-3af8fe7968ee", "comment": "Malware payload (Mirai)", "value": "4e1a8cc07bda997c0c73c7a1992241f579f37fed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775537685, "uuid": "d2ff8aec-c698-4888-9b99-87ef5316c5f3", "comment": "Malware payload (Mirai)", "value": "01be448300872975c1a82d3eff12ebd8c1bc9a6bb38ac4908e148222f5929d0408d0900f7aacd254c4668780c2acf9df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537685, "uuid": "30b579c0-95c5-44b3-8c2f-94ac203e0d9b", "value": "T190632A86AB03DAB7F94351F002F7AF365930FE3A0839D596D760BC739A219D1621639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537685, "uuid": "c528b440-9776-4687-ad01-f6070f576cb0", "value": "1536:Tpvb/eebc8J3molaW7W4evIwJIqvdSexpept5kZPQ:FDu81SW7WNFJZd3neDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775537685, "uuid": "c8d969d0-3893-4458-8668-4af43ab79b87", "value": 71136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775537685, "uuid": "e242b4e1-fa9b-470e-882a-e66138495ae1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775537685, "uuid": "ca9e0c3f-0f44-4210-988e-74acc92ed6cb", "value": "zyre.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95970136-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553012, "uuid": "b6110925-37c6-4432-82fe-ee5874e14dfc", "comment": "Malware payload (Mirai)", "value": "603c28218dee65df699112688c843481", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553012, "uuid": "a1af7bc5-5d8c-4621-89b1-b8e731e6d778", "comment": "Malware payload (Mirai)", "value": "a20dbd5fe8c4a2a461d0fa0d9108fabd0edbef7a8576d800374c4b4ddc471c84", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553012, "uuid": "2ffc1aa8-2433-434f-bfcb-b110f03eb49b", "comment": "Malware payload (Mirai)", "value": "44aebed59f1962b496dd5403e6b476f00e90b3e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553012, "uuid": "005920ec-c898-44e9-a239-37d444273921", "comment": "Malware payload (Mirai)", "value": "c875060eab7ed98c0ebb7ca68f69fea6487e417bf07e4eff6a06746894309ad292033b0be5ee71757c818f2a2fb27c93", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553012, "uuid": "8dee00b2-7b41-4234-9b0a-9cfe8dd8fcc4", "value": "T10EC2D0AA414556F9C81BD87BDA5B0FE13C760F70B257BC43BA91E2832E490317647BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553012, "uuid": "fc1fa9cc-88d3-4f08-b1ca-76b7079b1121", "value": "768:bKqzKznXzSkwMfhuqOHW2vvyiJgGlzDpbuR1Jp:bKqzK7z2ghfgbvqmVJuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553012, "uuid": "feaff853-ab48-4e67-9cee-76066865f339", "value": 26720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553012, "uuid": "c940353f-8464-4968-9a3d-07e5a32aef54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553012, "uuid": "ed618daf-e2df-4e9d-9775-f8e3da02ab62", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932ec494-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554726, "uuid": "531efb72-d7b7-4cb5-9dc7-bb1e5e7aa466", "comment": "Malware payload (Mirai)", "value": "fa0ac8e6a67dda0acfd85cc1295451d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554726, "uuid": "eebeb78d-5c6f-46cf-9ca5-c6378d23c97f", "comment": "Malware payload (Mirai)", "value": "a28586cbe50b6cfab0174804f2d5d91d749f7fb12594acba8e2835804a6b5c1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554726, "uuid": "036d9a66-b8ef-45bf-b271-64e68185a37a", "comment": "Malware payload (Mirai)", "value": "e14fbd902d41f74fa264a9add916a139a419d781", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554726, "uuid": "8a4b5d7d-94ba-4920-aab7-de07fe3af8b4", "comment": "Malware payload (Mirai)", "value": "445b9922b94cf84bc0485fd6743d0be1880e358dd1d56672a733e152a58eaee5641cd95735151ac9f86f7d265075381e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554726, "uuid": "e5b62d33-ad3d-4d40-964e-aaa9e4c3dada", "value": "T1A5A3C91E6E218FBDF369C33047B78E21A79837D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554726, "uuid": "28de72ca-67b0-4e76-8f78-ad0f3f264ef1", "value": "1536:yk8NZJjWAa4Prcve4meOeuCyTPHvwIp/read7Q1Qs/Rd/uP:WZJjBa4jzhHvlp/o1F/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554726, "uuid": "db2ed7e0-28ef-49bc-a35d-0013a774a5a7", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554726, "uuid": "46c2fd5f-a1a4-4c81-8acf-202d7b666fa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554726, "uuid": "26558998-534c-4957-8bc4-2556c9c36665", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848051a2-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554702, "uuid": "5d585089-2e6b-46d8-8b97-a2d9d5edcc1a", "comment": "Malware payload (Mirai)", "value": "b3d7c3c7890f831b033fb590f6a0987d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554702, "uuid": "493c180e-e9b1-40bd-864e-98267fa63dbf", "comment": "Malware payload (Mirai)", "value": "a42c596ab4376bacbfc429abf2bfd828a5502bc6366d7db12b2aa7f4924f6939", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554702, "uuid": "1174d2ab-2a93-4fc2-a94b-3b0e615c53ed", "comment": "Malware payload (Mirai)", "value": "1f8b051d552d1414f704c0a7480376c7fa1aa4de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554702, "uuid": "30495838-2bd7-4074-859c-9552e63d795e", "comment": "Malware payload (Mirai)", "value": "2818ffd5803f66e9be81cc495055b6a542242ae8c27f13baa23b3080888b862966b66caab237442fee7fdd862ef7a107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554702, "uuid": "11971dd2-c393-402c-9850-c2bf43d055d7", "value": "T170733991BD815713C6D012BBFB5E028E372653A8D2EF32139D266F21378786B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554702, "uuid": "b5b1746e-1635-4c3c-8218-8df8bf1be456", "value": "1536:yu2Z1jY80ld4BpG2jKnbhhz2HVPAV9sOvss/hfs:yu2XU2jKtV29A3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554702, "uuid": "b70ae6af-b92d-4ed8-b742-74a8c0b675a0", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554702, "uuid": "fe4faaba-de27-44c9-bd8d-fafadbb9dd16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554702, "uuid": "d0972612-a6d6-477d-a2fe-6d27affcd568", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49cb036-3289-11f1-a769-42010a9c0008", "comment": "Malware payload (TinyNuke)", "timestamp": 1775570352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775570352, "uuid": "ef05314d-c2e8-4eed-8a40-e6401a97bc20", "comment": "Malware payload (TinyNuke)", "value": "aefb91d3ea2869d914c676382094a644", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775570352, "uuid": "35c2a154-a5cf-48d0-be21-792af3c3f150", "comment": "Malware payload (TinyNuke)", "value": "a46a4e603fd1921ddc47176614f7227049b483643a135089f113e73930f3afc4", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775570352, "uuid": "dc9d02d8-3305-4689-85a7-e83fcbe09059", "comment": "Malware payload (TinyNuke)", "value": "7843bbebbf586a8408eaa80703bea42266815cc5", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775570352, "uuid": "740a5d0a-e9a3-422c-9243-509520987834", "comment": "Malware payload (TinyNuke)", "value": "cc897945d2e759111ec562a3c8c72e593387aa1b79adcfcb2ba295fc14f596e24bdd857501fd61a5c6605686bd64d15d", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "TinyNuke", "colour": "#A399D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775570352, "uuid": "6e0d1c6a-b9f4-49ca-a9ff-30ad39771ca6", "value": "T109A6D019A3E401B5E96BC734CA56C733DAB1BC925734C50F0158F2162F73EA29B6F226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775570352, "uuid": "736e01c4-bb42-4dab-9b1e-01df78a8b9c8", "value": "2eabe46c02a6772ffbc0545cddd275e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775570352, "uuid": "129b0b87-b6b5-44c8-b73d-92408197ee94", "value": "196608:3QF820ZxqsQfEn/nEEEEEEEEy7GRTZr3l/3yKXuNuyzJeXODpU:AFlEqskEa6RTZ4KXl8eXODpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775570352, "uuid": "cf412f11-050b-452f-a99d-3e8630d01720", "value": 10342873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775570352, "uuid": "c8de43fc-7b32-4a7a-a9e8-017bf0c413c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775570352, "uuid": "de870f7c-8d98-4d48-bd62-d9582b892abb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a79106-32a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775579849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775579849, "uuid": "8f169f23-d3d3-4b52-9769-92878f52c221", "comment": "Malware payload", "value": "79a7c8bf2e7fbe95edfebdd08a6ac1d6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775579849, "uuid": "ba5097cb-d845-4691-b9b2-707dd22dbd42", "comment": "Malware payload", "value": "a483fd8a7230a62038e47dd19324111957d2ea5a1e94705a5315c8409829c001", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775579849, "uuid": "63eba29e-16f5-4a5e-9737-89602fbe1690", "comment": "Malware payload", "value": "b6410d7757ab251e23122c66a75e70a642c93cab", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775579849, "uuid": "aa35f9f6-f0e0-4244-965d-511365aeebcd", "comment": "Malware payload", "value": "f676bc48913746faf509bc2d2acd4af4082d662596733d9b2010ed9a5d5a5b352999dfaebfe8e836a9ceddb122e7db2d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775579849, "uuid": "cd42dc70-23c9-40c6-86b2-d9dc0b68ae01", "value": "T1E5B58D217586C132D57F03702A2DD76B46797E603B7784DB63E89A2E1EB09C18232F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775579849, "uuid": "94b5a6d5-720a-44e4-b95c-d876c3eff7ef", "value": "49152:32qqYaZrf5jSTUialhJrMf+7UVZDEFe/4vLNgmUESIEjPMN2lv+oB3YKMV3eVoup:EjSTBaq+e4veHjPMNaLYKMV39CAMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775579849, "uuid": "d3bf7542-1e61-480a-8c83-2ef56dee75e4", "value": 2489344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775579849, "uuid": "121735fb-ed8c-4d84-b6bb-96d934f834ea", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775579849, "uuid": "baafea93-7501-42b5-bde6-690d846ef96e", "value": "ast.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93c8e5a-32ca-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775598196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775598196, "uuid": "6f38873c-6b7b-46c6-85ea-48d73e7958ba", "comment": "Malware payload (RustyStealer)", "value": "4b6cda3faea6f438f896865b3ff83796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775598196, "uuid": "d91528dc-f9ca-4f13-b11e-90cd3a1cedcd", "comment": "Malware payload (RustyStealer)", "value": "a4b6e81233ca2b8a4c6ace3da6344a7e0a8df92ee06c4763c7b18001c169b133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775598196, "uuid": "a9994a07-1796-4fb6-b8ee-7372b121478c", "comment": "Malware payload (RustyStealer)", "value": "d41b769ea80dee95b9b693993b844fcf11c5ee9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775598196, "uuid": "3d724fc2-d81b-48b3-a17d-6a5aaf84828b", "comment": "Malware payload (RustyStealer)", "value": "187c0f2c7661d83fff58303d1353eb4723e36d5898dbea7c4262c731ca5626c88192e6e105e6ba24f2bac85ac80c15d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775598196, "uuid": "9d48d04e-c67d-4522-9143-c952964ec1bd", "value": "T10CC55C0FD69582F8C0BAD0749346F733AB327C890722795B17B45A11AFE5B905FA8B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775598196, "uuid": "f48f4cb3-5229-4a83-85ce-fd51f3c3d573", "value": "7125e63ef49600434eb0a7106dc8d7e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775598196, "uuid": "a7c1297a-bf5d-46bc-b73b-36284e8caf85", "value": "49152:tGO8mQyhQoknAip3BHWcciok8idMsu2/stIfYLJxSb4IU6iD6HF:Hezcdsu0u6bH+wF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775598196, "uuid": "b4ca5bf0-5f31-45db-ae93-d92d7febfcbc", "value": 2604256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775598196, "uuid": "db93e576-3cd6-4f3e-ba2e-eb58835f6331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775598196, "uuid": "467355ed-c9f9-49ba-b6d9-4e188c4120f9", "value": "Install Mullvad VPN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1579db-32ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775599649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599649, "uuid": "22d65a76-4e30-46da-8d6a-7fa732bc8fc2", "comment": "Malware payload (Mirai)", "value": "bcf78157acad0cd99e67965eef586c8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599649, "uuid": "43182bdc-46d7-4e88-a16e-d0fda5d5f88e", "comment": "Malware payload (Mirai)", "value": "a4dd867f512c7fb2d17eccb98829c74d6df637f1acb66313dbece5d061c4f8b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599649, "uuid": "a5e7980c-6e7b-47f7-87fd-28c39e03aa6b", "comment": "Malware payload (Mirai)", "value": "5e28d0352c5bf60a503b3d24bbb72384a32b22a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599649, "uuid": "87d75c14-4a9f-419c-b1bf-7b91fd253b43", "comment": "Malware payload (Mirai)", "value": "9dfbd1081094e9764f9f98de90cc5b904ffcca33691b42fa414a7c9fc7faf5ac15ad11d7f6f1df71d017004468637411", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599649, "uuid": "b40f0e38-9431-44e5-b279-9868cec0d331", "value": "T108935B43AE668F06D547A5F0B0FACE355B22FC660D271EB1A872EEE951439C875073B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599649, "uuid": "f4f2a450-cb9d-4815-bc80-250c0c88591b", "value": "1536:u9OwP7c+JZdVbPURUfKntYn7fLAxtWCa4DqTQ6x:ukwPw+JZ7D8UCn0XAxtWK36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775599649, "uuid": "b14e1ea3-84d1-4880-92e7-71c3d092111b", "value": 88796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775599649, "uuid": "d7c8b020-fe8c-4134-8e7a-6c9708177426", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599649, "uuid": "91aa09d1-7aba-450b-8e9d-c308f7dc8d6e", "value": "zyre.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d572ec67-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554837, "uuid": "529cb4dc-5a67-4df1-9ebf-64a1281bde03", "comment": "Malware payload (Mirai)", "value": "35241003335913066b1c463dfb30a0db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554837, "uuid": "ee73364a-a15d-4e96-90e5-34afb8992519", "comment": "Malware payload (Mirai)", "value": "a50418ca44b2fa0571dadcdc7db34ca0175292c64854ae625f62160db6c1576c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554837, "uuid": "4c777602-139e-4615-8fb4-63a0cc2e72c2", "comment": "Malware payload (Mirai)", "value": "2e5526ab33b4f5686833d1956f4b73b98f89d517", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554837, "uuid": "04ee0ca2-d320-4dd0-846f-0cdc7b67318c", "comment": "Malware payload (Mirai)", "value": "2236da741ce3ce1d37044856e36caa8eccec647eff0cc99d24778f5426e68ca441b3bf541efdc6f1990bd431cc9c2338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554837, "uuid": "fe4b83a7-310b-46ce-9ed9-933b578f13dd", "value": "T127A3E506BB650FF7DC6FCD3706A9070225CCA51B22B83B367674D928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554837, "uuid": "2d2b80b8-bf0c-4dbe-949f-4de7953fae9f", "value": "1536:LvGefaZSdt9r4/xl4ExO29zyN0ZNhdZp54crFCZeLs/h5J:LOefaZSdg59zm0Hr6eoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554837, "uuid": "d1808cd7-b299-458c-96a7-6852220ae8f1", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554837, "uuid": "b8251de5-888d-4e54-ac5e-4c9adbdde8b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554837, "uuid": "75f28797-6065-470b-a03a-d28f670e600f", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0a1cc0-326e-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Generic)", "timestamp": 1775558388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558388, "uuid": "e9f524a7-3b17-49ed-a05b-ef05769c7935", "comment": "Malware payload (Adware.Generic)", "value": "c72318ad60eeb7bdf52b702d2f7a42f6", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558388, "uuid": "5936a5a6-ef5f-493d-97b3-dd71ed175c1d", "comment": "Malware payload (Adware.Generic)", "value": "a580aea346ddb70d4b642e2f4b5c6f33b62702bb190e4afeecdd9415b4e615e0", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558388, "uuid": "02ccf243-92fe-4719-9566-b5ee96415ddf", "comment": "Malware payload (Adware.Generic)", "value": "13b15e6980f7338cdfc84822e4feaf5e0daaa82a", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558388, "uuid": "c2d1ceda-a948-4e46-8d97-c126b2dfa91f", "comment": "Malware payload (Adware.Generic)", "value": "8fb9415e2ceac7dd60a57a5b3707bc3a74eec6cea17e2e18bef8a1ceae2d8c8132e2d9cd7610c0038e9ff48b1c839a2b", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558388, "uuid": "bcdb41d5-0a08-4e90-9fb7-a98427f23b89", "value": "T163E633527D88DBBFD4212770C6429B77529BBA744810186B6F0C1CB66FB28CDE528F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558388, "uuid": "f87ad1f2-88d1-48ad-887d-5fd5207b1b7c", "value": "393216:2bF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1J:4rRxvoC/7a0jUxX7h1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775558388, "uuid": "f943c335-1ebf-466f-a700-f7379089136f", "value": 14782206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775558388, "uuid": "aafc0f75-f120-41b5-82a5-a1a88fca7ca4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558388, "uuid": "0af97752-b36d-45df-ae68-d57fffd1bb1c", "value": "Microsoft Onedrive.ZIP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08394487-323f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775538172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538172, "uuid": "8bd0ac59-3b17-4ecb-97c6-ea21fb9d819b", "comment": "Malware payload (Mirai)", "value": "180661008110da71b6b9d84a1d87abf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538172, "uuid": "82f14717-e297-4cbe-85c3-cad3910f52c7", "comment": "Malware payload (Mirai)", "value": "a80b980b4ec6d73dab5d4bfc15c82b9261295ea693937a449d1fb78c827ef39c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538172, "uuid": "68fc019e-45bc-4278-a50f-1df8f2ab58fa", "comment": "Malware payload (Mirai)", "value": "a7b28063c60fea5c19ad8bbbb49a3a6c71e77d09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538172, "uuid": "2d630215-28ae-4df6-b5c5-70962f4bca5e", "comment": "Malware payload (Mirai)", "value": "b523eab4a6410622fd0942095f71acc5c6b7c0b35926a486b80f9ff003e06a4a07b30d459f34e7df49dbea64ff8f064b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538172, "uuid": "2b36069c-7bb0-4e2e-8f07-3d7ab12fabde", "value": "T1C6B32946BD819B02D4D321FAFFAF404933136BB8D3FA7102DD249F65238A9A70A77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538172, "uuid": "14daf2ee-a476-4574-b669-ef57581cbe80", "value": "3072:nzT+CWLlx7Jl2OdXRIgaCmOkKxQh2bZ5uNS1cu+73:M5WgaCmOkK22bZ5Ou+73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775538172, "uuid": "427e3581-2405-4e89-9b0c-b66f3cb6bd7d", "value": 111524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775538172, "uuid": "67593347-5c52-4615-8b77-d9ced3f7f873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538172, "uuid": "77bd51f8-dde1-4244-9fe8-69f7baf70a27", "value": "zyre.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f10426d-327a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563766, "uuid": "d9c9c35b-6336-4cfe-badc-d7e3b5f6678e", "comment": "Malware payload", "value": "420dd293fe18d31078536b6d11087ff0", "object_relation": "md5", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563766, "uuid": "261fbfdf-f41e-41a5-9b5a-09d80998a603", "comment": "Malware payload", "value": "a934ed6fd6edc0cb3d7dfe8636e996c35a8d4f1e44ce70e508e9d5967677785c", "object_relation": "sha256", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563766, "uuid": "e84bdd9e-584d-473b-9ab9-f93bf3d87cac", "comment": "Malware payload", "value": "aea1992d1969ad5ff1e5538b6afa08350787bcf3", "object_relation": "sha1", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563766, "uuid": "26677d22-7ba7-43e4-a4e3-ead56ca430d9", "comment": "Malware payload", "value": "52e63fc12f378ee7a9390c21c153a49adf4f4b7cbf80901042f99440a3a93fcd84fab43c88b7c5688605750c338fa8e6", "object_relation": "sha3-384", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563766, "uuid": "6c6803b1-2185-472e-af9e-690e57888978", "value": "T13DC27D5616C63C58BEC48A3E6CBE1B1DB9F1C3E1360A51AC7A4B3DB1CC52E5C861CB19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563766, "uuid": "b487a9ef-2200-4e89-a35c-77634cdfbfc5", "value": "768:bSyU9Tlvtm9FYpMSUpi+20qUpi+20YQwG:bSyUDtQd2QwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563766, "uuid": "e1672f52-27e0-4511-b0f5-f43a52b72cf3", "value": 27393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563766, "uuid": "0f2580ce-d301-49b0-87c4-35d2a7673c16", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563766, "uuid": "3c3010c1-543d-43d8-b8ef-c53717f2bda6", "value": "a934ed6fd6edc0cb3d7dfe8636e996c35a8d4f1e44ce70e508e9d5967677785c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2638aaa-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775562053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562053, "uuid": "92454ded-f4ad-4bc3-bb2c-5b6da71866d4", "comment": "Malware payload (Mirai)", "value": "de01f61d1c84289115717de1416f123a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562053, "uuid": "793ccb85-65bd-4951-bd4d-7d249e5e91c8", "comment": "Malware payload (Mirai)", "value": "a94e86adde0d3494f5eb6f09d2949804b9c58c6a2ad391d63b075fafd7fc95d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562053, "uuid": "5d0dfb9e-bbe4-4fe4-991a-6b6cb837194e", "comment": "Malware payload (Mirai)", "value": "730d2b2637ee1447d23a2b85686a317d739c0080", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562053, "uuid": "72f72339-f814-443d-bdca-175d85fe6aed", "comment": "Malware payload (Mirai)", "value": "0e9e652370eb50f013cd5ce52d1ac1c43a4d418f4ab20dfdcdb5acf2bf146bfb995f4701cebe6d42cdd54f7ed252e948", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562053, "uuid": "e6f81b1d-f3f1-4da9-9dce-1ff9d3b68c95", "value": "T1C0746553DA1684A1E1248CF222777345AC4783BF88E766D3EF5A49A1FF2141B41BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562053, "uuid": "32a7efe9-1897-46d1-94b9-27c24f14e485", "value": "3072:rlCLD2YgJKpYoqDuhDJCk24fjoytdDSTjT:rlCLDTgJ6dU1Qjoy9SfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562053, "uuid": "e55a7441-801b-418f-b0a7-e5bd2830bf0c", "value": 337292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562053, "uuid": "ae84101b-c6b5-4ae1-a71c-3d8a984bb505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562053, "uuid": "08547672-ce08-49d3-9c22-3666b02e636b", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ede3c5f-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539955, "uuid": "2ec8e46f-58ce-4195-8408-c33565e83783", "comment": "Malware payload (Mirai)", "value": "bc92cde0fe665d5c65c47ff957771101", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539955, "uuid": "27374413-43c9-4902-a372-c8d31ef977ab", "comment": "Malware payload (Mirai)", "value": "a9703a3539566139591e3d0778de653fd2d0fd25a465bade116c8aabead82a92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539955, "uuid": "f710b444-f3a4-4dba-8c1a-1cc88255f5a3", "comment": "Malware payload (Mirai)", "value": "6a897e4555243a6d1f2683ed92451dda0d2109c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539955, "uuid": "8033e9c7-02de-4531-bf3f-2002f43f0e65", "comment": "Malware payload (Mirai)", "value": "c11672d4af7ef9a9ab2ff7252afb07adb1cf574e34c85c47cd71596fd4572d4c5292f24dbca46262b53d7896d66e357b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539955, "uuid": "2a6eff31-e76d-4054-af5a-799f7f6102a7", "value": "T123933B45FD819612C6D113BBFB2E328E372663A4D2DA3203DE256F22338659B0D7B751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539955, "uuid": "b59e785d-e2a9-412b-bd0c-e8bbc8087925", "value": "1536:m/t28jGKZPApdaOmghb87P+L0T5OWXffdyDKmvZe:ml28HZIT+77PK0TVP0Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539955, "uuid": "57cddbfd-03e7-48a1-b1b4-74cea4a8a490", "value": 92252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539955, "uuid": "83ed5864-07f3-47f2-b5ea-1729464ed109", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539955, "uuid": "4489b49d-c969-4c88-8a2b-c7a96396d329", "value": "windy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8327f73b-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775562001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562001, "uuid": "0cdaef2e-5878-4d5a-a8e5-4b6acde8d061", "comment": "Malware payload (Mirai)", "value": "82f12ba8d9596b11e8cc6511d82322cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562001, "uuid": "c3b148e8-8e6a-45a6-9d51-6eb840ee5b71", "comment": "Malware payload (Mirai)", "value": "aa2525e7323f152f0be40c7d4dc0c8fc11f8800ada449a72e11c66a1b3a2bec1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562001, "uuid": "88f4a333-db5d-4a4e-8a16-c741357136ab", "comment": "Malware payload (Mirai)", "value": "1a5149be7cd5e6e7192842be7792ba2694078023", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562001, "uuid": "81cd0422-f53b-4620-9f56-a82a103e3d3d", "comment": "Malware payload (Mirai)", "value": "c77787259297619c09c2561e99f1f9105aff66aac6f44752b8f1760f2bbf89081f5bf201ed3703c08286db763017784a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562001, "uuid": "20bbf694-7611-45c1-854f-89a16e2f2e3d", "value": "T16111A0CE12957FB2570C8F6CF23A805C6E82A5E2F5730582B01F44B45DD8348B654FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562001, "uuid": "291feeaf-5d51-46cc-910b-06846306214b", "value": "24:3J3FEbE9UEfNIxE1EIKWOnGk8FHDIlnz7M77HR:PEbE9dcE1EIdOGkkclnzYnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562001, "uuid": "10f9c1b1-2a19-489b-883a-122c1d4522b5", "value": 874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562001, "uuid": "ea8e467a-291f-4458-9ddd-9ae230b2e08c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562001, "uuid": "5974d903-bc29-4c50-98c2-2a2cdc107722", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a236cbe1-3285-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775568495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568495, "uuid": "047d678c-6065-4ec9-89b8-53b4a2768142", "comment": "Malware payload", "value": "3c4d979ed8c8e3b02c79e2ff2acece09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568495, "uuid": "80c86210-ab0e-452f-8928-95faf7008618", "comment": "Malware payload", "value": "aad8c638f029dd7731cf58319f5dad1d2a152eaeffa8071a778cf87caf6569af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568495, "uuid": "dd423cb0-2a3e-423c-bfe4-d1daa9d231c0", "comment": "Malware payload", "value": "dd3d6d9c61e79dda00fb43af80260f1d539bc448", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568495, "uuid": "ede9587c-7405-4197-a5ce-eae18b65c8ab", "comment": "Malware payload", "value": "eb71442de7b8c4f92d065b2c9c8b74ae202679a75e334c0f56b782ddaa21b88d2e0375e3ced989f45f692dfaae69b513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568495, "uuid": "1f4fbeff-3b5a-4a06-b319-4cefd0f049a4", "value": "T11D67DF76739CD299D46F8538D2359617C2F278061BB482CB51A1279ADF23FE17AFA300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568495, "uuid": "9b0e8ac1-1872-478e-866a-e3cbf15642d7", "value": "aee6cd958403a8d3245c21dfba55cc5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568495, "uuid": "534dc775-7ccb-4090-8d14-4fa9a9155bab", "value": "98304:n688aU3MJF/oPm3Y+OcB11cruuX/56DAd9BoKPK7f/G:683nW3AAVoK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775568495, "uuid": "1c8d63cc-32f0-473c-88b2-9a3772e0a0f2", "value": 30468096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775568495, "uuid": "fcd90253-9c95-4092-8cea-20934c0c8a04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568495, "uuid": "69fa79b2-4371-4eb8-bbf6-eac70e337a7b", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faaae182-3242-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539867, "uuid": "59169bad-9522-4371-b5df-7d0894f45333", "comment": "Malware payload (Mirai)", "value": "56b2b91ce63a1cf3ea50f8c80e763422", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539867, "uuid": "a91cb23a-16f9-41cd-bef4-3306c7df638e", "comment": "Malware payload (Mirai)", "value": "ab294c81c61bc5daa749e517e1d213ea2136961192f7ec289789ef625318272e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539867, "uuid": "08257d27-a5f6-42f6-9809-d2224cf18e41", "comment": "Malware payload (Mirai)", "value": "bd8eb9e43777af0902fa291081bd97cc99ab7feb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539867, "uuid": "bec4c972-a63a-4b60-8ed0-0efc1c256d2f", "comment": "Malware payload (Mirai)", "value": "a8280e97ce524c3b820c6951ddd64266d643260f44c645106656ef10446daab21e396264b6c78c83ff647f915aad26c2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539867, "uuid": "b93c4866-bbc0-46e8-b5b6-af29b67253ed", "value": "T147210ED90152A243967BDD1C76B5CC546222E083A5CB2E2EDCC8287DCCCA769B314BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539867, "uuid": "7196a941-d413-487e-a8a5-d876f9ec2c89", "value": "24:opqjgpQ0Qhmgpb9gpUHz3gpeDgpUOUmgpadasgplfgpco6gpqOqNIjqmgpWeK3gd:opqjgpQ0QUgpb9gpyz3gpeDgpUOUmgp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539867, "uuid": "209e3ed5-bb38-4f02-a8c8-23ae6cdf5a4c", "value": 1343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539867, "uuid": "123c4a69-d726-4150-ab3a-968289121cc3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539867, "uuid": "d3277986-b424-4263-8243-219e36634702", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533c9df2-32d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775600575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600575, "uuid": "26aa5eaf-7c1c-44ae-ab83-94ae3662ebe1", "comment": "Malware payload", "value": "1d83f9818d438ab781224aef75eaaec3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600575, "uuid": "834f53a6-17e7-48fe-9faf-52e27ed16f46", "comment": "Malware payload", "value": "ab672937ddc53624e59eacc42e830d2674b0d2e21e12df87e88581b7fd153156", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600575, "uuid": "90283f3c-9733-40f8-a818-78ff804eba69", "comment": "Malware payload", "value": "d53a224a0231f28599634a89cb4cf82a14a23213", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600575, "uuid": "09f6ea67-90cc-442d-b5da-dd0151fe14a4", "comment": "Malware payload", "value": "c13c41dbbba41f7c66577b8b4847497439c8e8f02b0083aa93de8c7401ece70e76f27ba9e4b7e967b6875bc90cba2a83", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600575, "uuid": "0448edb4-c168-463d-aa79-a2f82c700de0", "value": "T15CD3DF889A4F57E49B432C30C11B5407D7B859233607DE90F76F8D917F0A8AD4ABF9A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600575, "uuid": "95152a82-5f69-4ed7-91d9-9ff863407eba", "value": "768:ME8WEoeMxhtxk85goneU0/3RAN5Br8DOVTeDNDka5hrY+PHnwOJOQT1e/rsZ06LD:ME8WE0x+5JfrRwOgQT1ejKMgHYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775600575, "uuid": "0ac76452-061f-4562-b7ff-96403e80bab0", "value": 140831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775600575, "uuid": "a89cf8ea-3a33-473c-9c0f-abd3e887152d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600575, "uuid": "bb14e28a-4ca8-4aef-a42f-95840ef12e84", "value": "Core_Invoice_France_7477.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66605a87-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554651, "uuid": "a4ccb0b7-4f24-4216-a31c-2b2215a8d52b", "comment": "Malware payload (Mirai)", "value": "2ee83304ce996c3c4f18ff15b317019d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554651, "uuid": "287a94b6-d26c-46d5-ad84-8e7de7dedec8", "comment": "Malware payload (Mirai)", "value": "ad2cfd8b661654b7518a991c8caca2b2f3455c3cac6794b2da55ffc0d89baaf4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554651, "uuid": "d1c5ef5d-e39e-4acf-82a2-2bfaa3669238", "comment": "Malware payload (Mirai)", "value": "8bd5ea1d239315e969aab70f63fcf022b2cdf573", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554651, "uuid": "73deea97-5cb7-4364-9b7e-f5f73fb39de1", "comment": "Malware payload (Mirai)", "value": "5be7e22da8d06a3ec5c364c498e917aabbb54ade46882576574a485adee2b82d2434d168f779921dea3added09fcaade", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554651, "uuid": "405663a7-d96f-4c86-9085-820aae5b16d6", "value": "T12003F171B1C2DC7089622035F0B48B8906F799FC50AF6C355394C57C70EAFA923FAA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554651, "uuid": "2d5313a5-279b-4600-aa0b-3137e00dbb44", "value": "768:ccjSxHiUtOtWQDe8NLRhtOwsJNZ8Ta5E7VRZ8B7eFjSuiU9q3UEL2R:cOSwUtqDpL9Vsp8+5EDyBCQui9L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554651, "uuid": "bc9fe2e0-4c4c-4a30-9cb0-a2456c79960f", "value": 38024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554651, "uuid": "564e1512-44e9-4868-846f-200e597fc354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554651, "uuid": "602bf60d-9a55-4000-a3de-2543fe99e5dd", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffbc9e8-32a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775582074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582074, "uuid": "1a41eadb-55e6-4649-8fc6-3bc13570c080", "comment": "Malware payload (Mirai)", "value": "40583b5dc12e688d64aeb8e9d7b24ca2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582074, "uuid": "90c08f33-fe51-42ef-a1cf-5cfddc2b9d23", "comment": "Malware payload (Mirai)", "value": "ae48547dae5144f511550f5c4d29e474df9bec6fead8e201fd5f4683740f90b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582074, "uuid": "0d088fbe-22d9-4b8f-91bc-e45ac179983f", "comment": "Malware payload (Mirai)", "value": "2eac812734c8cd12ec1db52068acd0676791bfb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775582074, "uuid": "8f1a76c2-1efe-432b-ae4f-fb3f4374f9ac", "comment": "Malware payload (Mirai)", "value": "fef064023c6261050f6391ac48b32ac2f52e19ae8bd1b341f09aa9c68ec311a0d15ff81fc9c63de21346937c9e77bd8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775582074, "uuid": "6a55da1c-1335-4c0c-b5e0-4778e0d5c8fa", "value": "T180930847E353D4B1E84300B101A7FB399930FE724D21D96BDBA4BEF29A329D6604672D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775582074, "uuid": "a53d231f-e084-4fbc-bc29-bf01769fe8c3", "value": "1536:s8lC0JFqxd1U6YV7cILGWmLopRLVx98mYzsML/AdNaU831UcvoiWY0e/r:sMD0XpY+EaoJdIsML/AMi/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775582074, "uuid": "c467c745-24e5-4a1f-8249-4b1efda40d0a", "value": 90028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775582074, "uuid": "c6149fde-50be-42ea-bc38-332c9221ca6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775582074, "uuid": "ae0ff3d9-0cff-4fec-8c47-71fbe6b77772", "value": "zyre.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44f3310-3272-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775560446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560446, "uuid": "b42f6654-f094-4804-886a-0c88793ad020", "comment": "Malware payload", "value": "e78d4f1f53123ceffedac6d4698438b9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560446, "uuid": "d1f4a33e-a2d0-4ed8-8c8b-cc2e6bc7db2e", "comment": "Malware payload", "value": "ae8d2cef8eac099f892e37cc50825d329459baa9625b71fb6f4b7e8f33c6ccce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560446, "uuid": "581ca0ff-2e9d-424f-97b3-0f7362e72b1d", "comment": "Malware payload", "value": "a019aaa7b90bca17ef8f9910db3ad7c0a3c2afe4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560446, "uuid": "c2b35694-6f0d-438a-92cc-e6686b690bcd", "comment": "Malware payload", "value": "3d58a5d4e90f833c9ae2ef536a056ff9c9ca80c3a85dca5ad2d67b22398541f1350e05109be68c7f6c39916876bf9b9c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560446, "uuid": "acaeebd4-924b-4ce3-b534-60d0bde314ec", "value": "T1AF81B416D3D196B8C0AD2BB8012A4E73D1B9C8B08FE91CDB834BDB574512AF07C7AC09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560446, "uuid": "b9992793-66f5-4479-b6b9-9ca4dc983f1f", "value": "48:vpgEGF+7kD8yOaheurrEqCGLW4tCJRyXBQMZPsJajDL4xzKgY:Bf+OfaheuPDfLW4tC2RJDL4xmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775560446, "uuid": "f1187ed8-648a-4ab8-b9a8-848853d3e7d5", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775560446, "uuid": "4c1b2319-1b5b-49a7-bc65-3976baf7b919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560446, "uuid": "715eb62a-0721-48c3-a13b-d09ab8253d60", "value": "ae8d2cef8eac099f892e37cc50825d329459baa9625b71fb6f4b7e8f33c6ccce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469d1959-3268-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775555886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555886, "uuid": "d3fb5b12-10f3-407d-8a3a-e9311df37ddf", "comment": "Malware payload (Formbook)", "value": "e23127608b4663dbf503382769f481ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555886, "uuid": "1fd07640-7df0-4a7b-8c44-b0ab84857cba", "comment": "Malware payload (Formbook)", "value": "af3f5610187dd9fadeffd7148fce068c920c10a824bc7e139550e06dd4cca882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555886, "uuid": "00e955c3-7e3e-44fb-9bef-cf9d53031a4a", "comment": "Malware payload (Formbook)", "value": "0dc9f725e788e4f9fbe3ed3e5d5d843b19219add", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555886, "uuid": "7d173b46-af90-4cc5-aee5-c6f75bf53f9b", "comment": "Malware payload (Formbook)", "value": "783b99e81f8fec4a7c19d24d2a0313f26cb292e44a141d393554d6faafcede4ad99349b6f8b54cdd5e9e5afc1a76e1b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555886, "uuid": "a4520c48-0bb9-4168-a51f-7336409dd584", "value": "T1DE45F1113A4FE691FCA84F701566F6394B223EE8B411D2059EE8BEE777F27923425702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555886, "uuid": "cca10923-004c-4c3f-a577-45dcce9542ee", "value": "24576:jYH8+v9n1dE8ZlXmlFPVvbJV33Jqx/cxGIiw4:kZvLfZlWLPpbJVYx/cxa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775555886, "uuid": "906efa75-de1b-4892-98d5-a0f45125f1f9", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775555886, "uuid": "c2ed17f8-0d54-446c-a109-79596be68970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555886, "uuid": "0f93217c-72a2-4d46-a39c-3c9b58e99f5e", "value": "PO-000806758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583ff8d2-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554198, "uuid": "871d6628-1aa5-48c4-b789-7d821f2bcfa9", "comment": "Malware payload (Mirai)", "value": "8f57bd114ff432efca04970f1db7a297", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554198, "uuid": "f76f880c-8c42-4ed0-b38e-b03495d0503c", "comment": "Malware payload (Mirai)", "value": "b0848f9a9f1f2a0d3cbb184c807b3bb9fd2898c5226ab0718467455585d8698c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554198, "uuid": "e5eae3fa-a12e-462a-961c-8a62d4ab8345", "comment": "Malware payload (Mirai)", "value": "5db4e3c1369dc2a460f705c227440a689a3a3318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554198, "uuid": "d28c6fbe-d22f-4ce8-883d-aebeba0b0fbf", "comment": "Malware payload (Mirai)", "value": "ea7742c710788fa48086714c7821b6d2cec89586088d303b3713cec73008b4d9d87f893e9d876658da591b2e90955f86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554198, "uuid": "5048c220-c57f-419b-b11f-6d9086b4ab6e", "value": "T1AD733A55FD814B23C6C1123BFB6E068D3B2653E9E2EA72039E259F2133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554198, "uuid": "9788bb07-0358-4cf1-8694-0fab74e2fff5", "value": "1536:OZWLxW3i3jV9ZJpcO72Rbu1U+qhxp8f8vNW:OZWLnJpcO72RDRZNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554198, "uuid": "e621db47-9d5a-4830-becc-c78f8476b893", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554198, "uuid": "df4e6edb-c87e-44d7-92e9-f05ebd8cdd25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554198, "uuid": "6bc39fa7-c8f0-4f9c-9826-d44a7fd28136", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202589d4-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775561835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561835, "uuid": "771784c1-7ea0-4812-8866-62c33ac55ef3", "comment": "Malware payload (LummaStealer)", "value": "e4e586d08404a82145b42f533a249864", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561835, "uuid": "0bd1cbf3-9756-40c4-aabd-417f1e57e314", "comment": "Malware payload (LummaStealer)", "value": "b48212fbb88fe59813f71e4f55d85b8549a02c090bd3879e44df6f5095d577c9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561835, "uuid": "76bba574-a66f-49c8-b388-91d8c50254b4", "comment": "Malware payload (LummaStealer)", "value": "a1c552ef7b0542106de7a04645d92152a9e430ce", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561835, "uuid": "49cfa76c-3ce1-4b2a-b277-89070814fe78", "comment": "Malware payload (LummaStealer)", "value": "dbc185d8f5d7e2c580596f62b0dc16a94afa6bafe1f81467a58f55b13131b1d407f5b8fb9845cd5a4bdc649a785933bf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "MIX10.file", "colour": "#B80CE5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561835, "uuid": "6fb367e9-1e39-4428-8767-b953bebbc0ff", "value": "T1F8654B00FCC744B6E41212324AB762EF6335A8494F36AB87EA45773EF9B76D05832356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561835, "uuid": "06fd9644-d1bb-48c2-8987-dd648015ac78", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561835, "uuid": "03238071-828f-4ca6-a5ed-b742f53fb541", "value": "24576:mCOy0WFdlrQvLwNaRX2mjf7nwPY+LggfVLkjymCA4RTs7+5vuf0IH3M+m+Arz:mCDz6GqwBmfz7hsEhmNrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561835, "uuid": "f2a4ddcf-f4e3-4b2e-a331-30756ff15be9", "value": 1432704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561835, "uuid": "d5bae91b-e86f-435b-9191-b4aee6847600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561835, "uuid": "1098629f-d8cf-40a0-b110-28a670d52cc1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcea852-32cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775598845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775598845, "uuid": "0bb9f0f9-1ac0-4433-9abf-b389c56a54e8", "comment": "Malware payload", "value": "9d6dde9c4db92219ada85b92478cd15a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775598845, "uuid": "25230d6d-cd13-4cb5-9fde-9e0327f869ea", "comment": "Malware payload", "value": "b4ad76f7fab47d36f538df5f8f7b5d5f41f15a6c2c3a9c128dd1d49b3d96957c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775598845, "uuid": "8c730f0b-5ec8-4504-b2c3-0ceeb8030bf6", "comment": "Malware payload", "value": "b69a4b7b1a8aef9af1ec6e7febaa9ee56e4b6e29", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775598845, "uuid": "4873b930-4033-4fb1-8ccc-194a3ba64a44", "comment": "Malware payload", "value": "8c17826b63792f187c820db126d7eaa1731c5e8495251049387bbc660b64b5357402b6a853c01f3c6b135611af55e750", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775598845, "uuid": "d2ee82e6-8230-450e-af50-af4eee5d13e3", "value": "T11377335675A5C062C07A0A34DC26AFF1623F7C2CDA2588472363BE1FF9769C1627B607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775598845, "uuid": "e6875d01-8fde-4e0e-8dd4-b47d98d9732e", "value": "786432:XnBoo+9N77BSFJy3ccSMXp8nkc4u1R9uHJ6vulYYQT+SEPJb1stzgO:XBooM6Jy3ccFZIkc4JHJ4ulYYQqSEEtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775598845, "uuid": "57b1dd56-0653-45e2-9bd8-5e7982e305ce", "value": 35901440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775598845, "uuid": "24342949-2932-4083-9761-1fd1ef25af64", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775598845, "uuid": "24f4521a-0f4e-4746-a1c9-c4c4d909644b", "value": "KeePassXC-2.7.12-Win64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ea55f3-326f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775558912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558912, "uuid": "a1627d4f-7f7f-469e-bf56-37da53174a71", "comment": "Malware payload", "value": "59bc1dfe73834d904ac45e43c10bc51f", "object_relation": "md5", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558912, "uuid": "15cac6d0-349f-4a17-a65a-3b6e4b20b969", "comment": "Malware payload", "value": "b506fc828bf9ca224cea60258358857e054a4bc78a2763530eb7998e6c00eb26", "object_relation": "sha256", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558912, "uuid": "a183ceae-0359-4da1-b15f-e426bcf31bb8", "comment": "Malware payload", "value": "71c8df0a623d2dcdfe6ea5e15a2afe8f6082222a", "object_relation": "sha1", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775558912, "uuid": "850629b8-f6ad-41c6-8efa-c3d75151a6b5", "comment": "Malware payload", "value": "0ad826adc13b8bb902d8fae1092b25700bd212a5c6a42d4a75bf39045ae865fa4797f1d943e1884b7ac44a0bc5759076", "object_relation": "sha3-384", "Tag": [ { "name": "160-119-69-4", "colour": "#9F5FE7", "exportable": true, "hide_tag": false }, { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558912, "uuid": "d5204f39-ec53-4004-bd74-5449d4ef20ba", "value": "T111A2FFF1F8ECA43636DD853ABB9CA805A9CF7C2F4DAB7D2014575928411C71EA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558912, "uuid": "4cd7c21c-640d-4b4e-a62b-978a2d268ce9", "value": "384:SVc3s13isjsKG6qkSgjkjV/A4UAcGE3JNRhQuW5Q:psyUMkSgjkjVdUAcd3JN3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775558912, "uuid": "cb754545-ce29-452d-ad78-870965b226fa", "value": 23355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775558912, "uuid": "16afa1fb-d05a-46f3-9f5f-46cc2b96c185", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775558912, "uuid": "d79bdd48-70a2-403b-83d8-cc59de071943", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9042b4f3-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553003, "uuid": "5070cff4-47a3-46f0-b295-978418093654", "comment": "Malware payload (Mirai)", "value": "6d13a127aaac00ce9cb40048bf4dcba1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553003, "uuid": "162a1983-132b-49bd-8a90-3837a3fac10e", "comment": "Malware payload (Mirai)", "value": "b5e6e77181adc081ed345193096cfba3f6b6d07beca9f9fcbd73e839714e2856", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553003, "uuid": "12c33c64-fc6e-4839-b3ce-715ddba255ca", "comment": "Malware payload (Mirai)", "value": "10ec8eb7603771fb57a5d54bd400fd90c90b94c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553003, "uuid": "d20dfd11-c53c-4237-87f8-2ccafab99099", "comment": "Malware payload (Mirai)", "value": "b474d2d3372bcf0e3a0ec1dfdfe00f1b8c0e137be6aa4122c2de3d9d8dbd0fb29405ccfd0197fa253147acfb12366dae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553003, "uuid": "d22d0b4a-4f1f-4cf3-a35c-47a9b1599fc6", "value": "T1E4A2DF316819BE62C4B1C633DAB8DAC319723BFDC0FAB5A6554813A9AA4304771F8057", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553003, "uuid": "b67f4045-2dea-45c2-a3c6-8829fa960c0a", "value": "384:HFe5KT7BUUAWxrpWeJJxZh3J790rJLvSD+u7Zj82TnhymdGUop5hgx:HJTW7OLJx/3n0rJLvYWms3UozSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553003, "uuid": "0900c7f0-cc52-4b3f-9a6b-3851bcda2642", "value": 22556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553003, "uuid": "79c25278-b9a4-44bc-8fc3-53b1bf199da6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553003, "uuid": "2172b21c-91bc-45e3-9857-0fe15a8cb49c", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56aeadcc-3228-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775528425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775528425, "uuid": "68fb2bb8-67a3-4702-b39a-ab59f3f7ccce", "comment": "Malware payload", "value": "7b63309df9e97bab2be2e147132a5862", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775528425, "uuid": "36d2db2d-63f0-4606-946c-41e1530aba6b", "comment": "Malware payload", "value": "b613964e4d20e3732d599081ebd6e3861610c6ab3fb15dd8807f95fc80e307b2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775528425, "uuid": "a9b6d6b6-6de1-4530-b9c5-df490d662a99", "comment": "Malware payload", "value": "5ecb9f3069b6720a023304700df53c38d56ec5c1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775528425, "uuid": "19f5655e-a041-47e1-98d4-25a73326f806", "comment": "Malware payload", "value": "c4b3231021df59e53fc842fb8aa64ef4778e5a8787709c0a1c7aad25d512af9d2e834f3220a2b0df7df934061ccd51af", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775528425, "uuid": "05b4ffb2-39e1-46d1-9d35-ba0074f307de", "value": "T174C58C217586C133D56F03702A2DC76B46797E603B7384DB63E89A2E1EB09C19236F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775528425, "uuid": "6b1ef9d1-230e-460a-b729-b1cc907ee4cc", "value": "49152:0G32KqYaZrf5jSTUial1JrMf+7UVZDEFew4vLNgmUESIEjPMN2lv+oB3YMMV3eVm:yRjSTBuq+F4veHjPMNaLYMMV39CAjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775528425, "uuid": "ff662f7b-a6e6-4c02-9ba4-a35e9f89ef87", "value": 2534400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775528425, "uuid": "e46dec30-9d8e-4773-b0e6-d83eb7ba1cd3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775528425, "uuid": "43449f40-cc7d-48ed-9fec-5541b33ca0b3", "value": "disc1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5e65ba-325f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775552009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552009, "uuid": "d1e0d40c-2ab5-4ae2-a507-8df37d68500b", "comment": "Malware payload", "value": "61d0d2c52c84a3eebe5bc0ed6b044999", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552009, "uuid": "edca3d98-a864-4d6e-819d-e8dea2476592", "comment": "Malware payload", "value": "b678e6881d926dfc12ead7a8b0c276ba50a0517010d3e9efb100460b25992135", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552009, "uuid": "bf6f32d3-9d3e-43e0-a7b5-5ece7d74307c", "comment": "Malware payload", "value": "1f1d00c17d2c62257c181a0ad114b2b91c910e43", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552009, "uuid": "1ba6b5c1-d52b-4661-a55e-60e57ef517a0", "comment": "Malware payload", "value": "cc247961b9becdff0607b74eb5e534375b2a9c6f0e85481729ef95f4826ab779203aade6b17586353f50090d28cf30b3", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552009, "uuid": "1ba664d1-fd36-405a-bc70-47ef5e3eb1b3", "value": "T136A5CCD9ECD8DD2696946FAC73610023725AFD89F1FA2143F76319E72AAD4C121AC7C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552009, "uuid": "000dd226-9505-432e-ad01-c4a82bc77678", "value": "12288:0W4f7wxgW4f7wxgW4f7wxgW4f7wx8EciTmmaHmumuOttLs94xVw0OuTvFQ1lAMS4:0bXbXbXbxEc9cVwZlAMSvc+x+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552009, "uuid": "ee8f4f16-3e7d-4732-81d1-891551c17351", "value": 2155475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552009, "uuid": "86e73d67-b880-4128-b95b-093b3af14e78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552009, "uuid": "2179e9a0-27f8-4004-b9a6-ef415fea5f0c", "value": "b678e6881d926dfc12ead7a8b0c276ba50a0517010d3e9efb100460b25992135.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5152e7-3269-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775556243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556243, "uuid": "122b3d53-0ff0-48e0-bc47-11b4dcfae967", "comment": "Malware payload", "value": "f0023d2c2238342b85f8ee012e1b6382", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556243, "uuid": "9867ce4a-5d1f-4852-982d-5c95370bbd58", "comment": "Malware payload", "value": "b6ad6c96bbf96925a8ec5b17bf48ef49007c2f09e4eb8c294409f12b414a7765", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556243, "uuid": "1b0fb592-7c28-4ab5-86f9-200dfb90f124", "comment": "Malware payload", "value": "db43570981a0076cc2bd0a466b01eb2175ad0077", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556243, "uuid": "a4913605-9343-4a22-bdc0-7ece97c33bbe", "comment": "Malware payload", "value": "77df27c159386423782eb3764382d7f7666dcc97291258092908a6687b1c5c8a58707bb99a6208d044686ea259305fa4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556243, "uuid": "1d50a543-3241-450e-8689-cfa9da8efc3a", "value": "T1BD530F6EC48477E775EDE510E6AEF8F030888016B68F5C979EDC84998F5E40F7927A20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556243, "uuid": "217a2510-aac4-44b2-8012-ae8902bddf92", "value": "1536:9vmCrKavQMJ4yonas7tPY5wEqXrUu9311/Fy/:tKcCNYLNm/M/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775556243, "uuid": "719ce283-f49b-4bf6-b314-0de09506158e", "value": 62184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775556243, "uuid": "d752de10-404c-4f3e-a349-333ef78347a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556243, "uuid": "8d45b230-ef2d-40ca-a9c7-ccd53b719154", "value": "NEW REQUEST FOR NCT Holland BV.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6220d9-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554665, "uuid": "f69b2260-7ef9-4009-93be-32e670d92ccf", "comment": "Malware payload (Mirai)", "value": "5edac00af76b4413f445e9f0c668c3d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554665, "uuid": "89633d09-41a4-47a8-95e2-90a7af117986", "comment": "Malware payload (Mirai)", "value": "b7dd079942df5544c88b861ccf831ac7222c332643cfcd3947d23917c58d3c7c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554665, "uuid": "3f797624-1978-4009-adc0-33ba14a30921", "comment": "Malware payload (Mirai)", "value": "53dd61795a8ef6d791c26fc74542a77d69fad482", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554665, "uuid": "766ed2af-f16e-4dc8-8770-5618516a9b66", "comment": "Malware payload (Mirai)", "value": "18ec90fbe4578e3d28afc810d72af1b15084c41f95b7a6b9e95e75be1d2f38f109c5da8ea6ff8a3765c1dd7df4edea2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554665, "uuid": "df9b584c-b743-4db3-8985-5ebd32736115", "value": "T1ADE2F17A03CDA22CE45C427AC28BD9DA921B0D047F5F9BB63585C3875041A21CF6E9F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554665, "uuid": "9fa1768a-1e74-4d57-a75d-8cc09084f952", "value": "768:j32bRAqg2zif0bT4jnOgjlLutUmu3xmj+qs+:ibRAp2efvDhLkUmcmr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554665, "uuid": "ee906934-01bb-4aa1-87b3-403a966aa556", "value": 33900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554665, "uuid": "7db83847-e2af-47e3-a782-6e42b489248f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554665, "uuid": "28f07417-06e3-4579-972d-c235fd364db4", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44d20c1-32b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1775588256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588256, "uuid": "f6002469-a0a9-4bb2-a373-fc4eef08ae17", "comment": "Malware payload (Prometei)", "value": "73c9add269e8df455a34d7a48c91051d", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588256, "uuid": "174c7286-4738-4021-87f5-a10f1ee33294", "comment": "Malware payload (Prometei)", "value": "b7e3de4a7d184750aa41274262d302331c1b055cee299031819589dad5101b94", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588256, "uuid": "1834b3c9-de1e-4a7c-a0ff-6140355376d7", "comment": "Malware payload (Prometei)", "value": "57a995f40ca018b49b65212c8a6f4dc23288bfc3", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588256, "uuid": "16e2e61d-111b-45e4-9f66-4393f7f728a7", "comment": "Malware payload (Prometei)", "value": "25ca8a4354078fe7c799bd41aed8c61919fb989928246e8fb3e324d15eed996ed8ae3b61a4afdf4413bee8f9cac39ac4", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588256, "uuid": "f00c741c-b695-49b2-a1ad-b366e6cacacc", "value": "T15E9423F8C87D2E30D8169F3CBB1A826CF0A15772D9562F6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588256, "uuid": "895d8041-72d6-4444-84de-1aa3dccd93ca", "value": "6144:ZcfxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmw4Dsi6wwcitgd:a5WOSACZSV6eKRH5EPiamw4DsDwwct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775588256, "uuid": "3c2bbbc4-227f-431a-b65b-2f0975472eef", "value": 436045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775588256, "uuid": "b0ecf7b6-fa66-46d8-9d9c-3c1f19acf4e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588256, "uuid": "07f556bb-acea-4109-9a92-5c02d33f7069", "value": "b7e3de4a7d184750aa41274262d302331c1b055cee299031819589dad5101b94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646bd8ac-3238-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775535320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775535320, "uuid": "47040b95-9405-4902-8daa-6bcdc1fc4bfc", "comment": "Malware payload (Mirai)", "value": "22a483c61542a58afca7a2f38961aae1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775535320, "uuid": "da8b14ab-610b-4cb4-ab25-a1e0bf730d34", "comment": "Malware payload (Mirai)", "value": "b80f13e4dacd3ccc0f1a09b6d50699e9e1dcd69fca7205c09072d9b89e10009a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775535320, "uuid": "638551a5-af8b-4cc8-9026-1ffacd8cf7e1", "comment": "Malware payload (Mirai)", "value": "ffdf4abce77ef1d99f4df5eb96867fe1a528172a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775535320, "uuid": "61af74c6-09b0-4a63-811b-4acef5b92574", "comment": "Malware payload (Mirai)", "value": "5a176b1cb02698376ae2a47fdee3238869d9ad4afb7fba946c13abb61bdd19bddabb50baf9f5c5f91b7c683d78a6b5e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775535320, "uuid": "fc03bb68-39fe-4fad-a234-8195127c913c", "value": "T15EA3D94B7E228FAEF21982704BF34E31A65977E727E1C581E25CE9411E202CD645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775535320, "uuid": "829ef8cb-5109-43a8-8272-899af950165a", "value": "1536:61yOyJw9gO0jM/fVE5mIOX9paSYCr6xd/3U3ZIeK7DnklMhMCt:6Yi9C95m9zvP2/k3Zq7DnzhMCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775535320, "uuid": "b6652bbd-d45f-485f-90a8-67703d673ad4", "value": 100860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775535320, "uuid": "563f1f3f-7b23-4acc-b8fc-7db365733a17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775535320, "uuid": "6dfd017f-bcd9-4020-b8bc-c24f495a6292", "value": "zyre.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17358254-324b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775543351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543351, "uuid": "6e218474-986e-4678-a973-61852dd1dd6a", "comment": "Malware payload (Formbook)", "value": "20b27f69ddaac2971ee144d81a6a9af4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-maxbotfinance-ru", "colour": "#3BD072", "exportable": true, "hide_tag": false }, { "name": "www-xg66s-sbs", "colour": "#423F2D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543351, "uuid": "0c91cee3-44fa-42df-a461-98bf256f9842", "comment": "Malware payload (Formbook)", "value": "b8fd3878d6797ad9721ef8e6b3b304b743f9d4f403dc6501d6bd35a2ef4fd5a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-maxbotfinance-ru", "colour": "#3BD072", "exportable": true, "hide_tag": false }, { "name": "www-xg66s-sbs", "colour": "#423F2D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543351, "uuid": "450602a9-1c9d-4294-89e1-f1ccb7d20131", "comment": "Malware payload (Formbook)", "value": "7ef76538e0892d2ea83356324c276cec837f192f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-maxbotfinance-ru", "colour": "#3BD072", "exportable": true, "hide_tag": false }, { "name": "www-xg66s-sbs", "colour": "#423F2D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543351, "uuid": "36064ad1-3533-4ca7-844f-bec39d8f085a", "comment": "Malware payload (Formbook)", "value": "5c71cf5c8a06ff1768c6f73195ca222b0175eeb514a2645c49076598454addcc4565381c3b05b2f0294b0c195695cea5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-maxbotfinance-ru", "colour": "#3BD072", "exportable": true, "hide_tag": false }, { "name": "www-xg66s-sbs", "colour": "#423F2D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543351, "uuid": "a2ad197a-9c1f-4560-810b-db67f546478e", "value": "T1295533007839CC36CBBD45293FB20B83541D0937B876979A614EC945BEB8B49397E2AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543351, "uuid": "2980b49d-928e-4969-9889-60004a4106d3", "value": "24576:h1R5ARydrafCCjbDGjCPOUfnzKzar6S5F7YrShTxaiQwFvMIrNfjUK4z:R5AAfm+jCPOSnzK+rR5pcShTx7v3Kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775543351, "uuid": "845e904e-bbf9-44e5-8e19-68ccb8b9a25d", "value": 1404984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775543351, "uuid": "b49c4664-7849-45d2-a369-23ff328c8998", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543351, "uuid": "5f7c116f-838a-47e3-89be-77b21660b50c", "value": "Order Acceptance.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02094dd0-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539880, "uuid": "f923272c-c3f8-4c2d-ad96-6863002fc8c4", "comment": "Malware payload (Mirai)", "value": "42c25e3ffcc8d1fc2c8334d4cc0c2c5d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539880, "uuid": "a05dac2a-6033-4165-a735-cabc15076bd3", "comment": "Malware payload (Mirai)", "value": "ba7fdb4560a4f0e332d2ae4376e52e805d2e3bf71432fa3fefd12a5d30d40978", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539880, "uuid": "b899ece1-717d-4c7f-963b-cb31dd6fd3c5", "comment": "Malware payload (Mirai)", "value": "60b6d582514c92661d2866a72106f1321816612b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539880, "uuid": "a2c98df0-9763-4361-90f3-97ea4c0c56b2", "comment": "Malware payload (Mirai)", "value": "5a9bf319d12b254d8e2909e9225b14601a99d023e89b8462dc531fc1f84bc01dfb51f7c386e46428a751bbafec70362a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539880, "uuid": "996b71a9-3d7a-4889-9d38-0f7dc30421b3", "value": "T1FE9317C6F401DC7DF80FDABB4463690EB631E2615A831B266757BE53AC321E05927F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539880, "uuid": "62c7da17-79eb-41d9-b56a-197da11448ba", "value": "1536:lQ1JsIO7ywe3iy5JjPYRggWnSPnK7wjkoLFWSKZRPD8bAjaZkH5S2gk0zjX5R2RD:lsJTYLWnSPnKcwSKZpz2OS9kqSGCJjGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539880, "uuid": "616500b8-299a-447a-bd69-37cd1dffe8c0", "value": 96740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539880, "uuid": "7b593409-e358-40ff-8cee-4e7839f580ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539880, "uuid": "7f311b64-2796-479c-8f30-e17e3e1dcc6f", "value": "windy.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1170c196-32d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775600894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600894, "uuid": "2dd66ecb-21bf-47d0-b1d3-35703dba5708", "comment": "Malware payload (Mirai)", "value": "5c2fb5577891201e2f47ed731b69898c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600894, "uuid": "03e5a243-26d4-424c-8136-614272b095da", "comment": "Malware payload (Mirai)", "value": "bae9f047a954897fd367e3d7b796fe7821356c6ad4da521f42e044fd56bc9312", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600894, "uuid": "5b1c06e9-c805-4019-83d8-a1f6475b8239", "comment": "Malware payload (Mirai)", "value": "fa966b0b2821b15ada77b884c81422a1ac744b64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600894, "uuid": "03904298-0e49-4744-95a4-393c38faeade", "comment": "Malware payload (Mirai)", "value": "8a09415aaad8cc017c1d8579de29015eddf1f3c470aa34cd39d3b0d48abc170e11435ec35a979d54c7531fa32befcd73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600894, "uuid": "039163a0-e5de-4c2f-a22a-9055efc6359d", "value": "T14BC3194ABD419B02D4D225FAFF6E418933135BB8E3FB3112CD249F64238A9DB0A77615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600894, "uuid": "3df1d3ed-766e-4850-86f3-a07697728b0d", "value": "3072:wCQrETiNBt+4c7l8L0ag947XIyRwXRtDFcwL7Zlypb:iT/6Koag27XIyRwBtDb7Zlypb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775600894, "uuid": "921468c0-e6e8-48de-9f64-37c2e82cc14a", "value": 128248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775600894, "uuid": "7928386a-ae11-4d05-b4f0-e2fb5d908c0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600894, "uuid": "27711505-d2f9-4448-a6ae-c48700e000be", "value": "SecuriteInfo.com.ELF.Downloader-DN.47215224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699d318a-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554657, "uuid": "ead425c0-7d61-433b-aa33-940ee70003b7", "comment": "Malware payload (Mirai)", "value": "6cc4edd91d0bdfd07db77e629676a311", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554657, "uuid": "bdb0865a-87b8-4257-8a26-1ffa452ad1da", "comment": "Malware payload (Mirai)", "value": "bb1d71acda0f065e6bace361dec4d89bbc3338f8a2c780a614c94c99019724bc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554657, "uuid": "318a663f-f1f2-4c2f-b5ae-647cce14cb77", "comment": "Malware payload (Mirai)", "value": "43780d8e0fb96a4bdc86beb70b464c8c7ea361f8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554657, "uuid": "9965d3e9-09be-4fff-8873-f918cd49e093", "comment": "Malware payload (Mirai)", "value": "3f6fdb15f87b421a3f8e9ee9f42156d281d1d4d4d948c8870710ba195c2921262b5800e08b5b848cd9a2cc1647cf640f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554657, "uuid": "25713ba2-0784-4b84-a442-51fb75079e3c", "value": "T134F2E1BD030A4E9ACD24C4FA16B167A65E5843B1B943AE6FE008FCD3FE695593703290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554657, "uuid": "46a16fa9-0f2f-428b-8269-6296252e845c", "value": "768:2NYKyukZoTMKe/5/lrokrUDCqs/hsX4NxvA73HHVBJgGlzDpbuR1Jw:UYdWlexRbupQhsXM273VVJuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554657, "uuid": "96797c8c-5499-4282-b2d3-19e1beed74a8", "value": 37068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554657, "uuid": "e27bfa38-95b1-4380-a37a-e005e87fd999", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554657, "uuid": "95f024d6-48c6-40a9-b51e-7881a6222acd", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe03c277-3242-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539873, "uuid": "a0284f86-cf5f-4449-b8df-7926d6f45ace", "comment": "Malware payload (Mirai)", "value": "1f057f2401938551d33b17bb52a5c45f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539873, "uuid": "47f314ad-f179-4043-9da1-157faa560de0", "comment": "Malware payload (Mirai)", "value": "bb8dd16fffb5f78d3e8919df1b020fe413c2e9fadb5a573a78a33bce32f1bb21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539873, "uuid": "3bc76771-65fb-4af8-91b0-d77d5da316fd", "comment": "Malware payload (Mirai)", "value": "054966c67e29650553909417e7a27ed925f2201a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539873, "uuid": "5643ad3a-1d79-44b5-a373-472ae45f4602", "comment": "Malware payload (Mirai)", "value": "2fa24cdf36fdd764de97ab366fa0f7cbbbb9e60b77ac63fa60d76f0bd22f15d12df861b2435434a564fd7ec2a25480b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539873, "uuid": "fcc0cf1c-e1e9-4a39-9389-2462c4b9c354", "value": "T1BC13F19C425A3383F7B3C47D634B70E617A91E0F93939D4BA409F882302E0A5CBA7D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539873, "uuid": "ca8d7a95-f7c2-4eb2-9065-6cea788efe1f", "value": "768:/RWmY27cjKE6HfqwToru8Wy1ztw3WVKdoiaK7BUkQUf0SFfs0:/dY2w36HSwTurhzqsKdoyXQek0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539873, "uuid": "662d91ee-afaa-49c3-a326-66a26231bcf4", "value": 43140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539873, "uuid": "26bad442-e893-4f2a-95cd-fd87b72345d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539873, "uuid": "12f39562-2968-43b9-b31c-45c82b5a1c20", "value": "windy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111e0167-324b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775543341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543341, "uuid": "7bddbc85-3574-4631-bd31-73eb99f8b08c", "comment": "Malware payload (Formbook)", "value": "f7d9a5ed64e9c3bf8aba8f5a1f9f60b7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-bodyritualz-com", "colour": "#207308", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543341, "uuid": "708f00fc-7303-4428-a055-132102ffdc1d", "comment": "Malware payload (Formbook)", "value": "bcce0774de4a4c311a839a05804122f72d83c497e8333ac8aacff6eef2d007c9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-bodyritualz-com", "colour": "#207308", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543341, "uuid": "e92f575f-c359-4da0-8e6b-3e0dc43a9360", "comment": "Malware payload (Formbook)", "value": "a73bb18b907166d831f3123ead5f76e3b6366914", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-bodyritualz-com", "colour": "#207308", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543341, "uuid": "33bdc98f-9ef3-406b-ae8b-fb5a9f1ad175", "comment": "Malware payload (Formbook)", "value": "eaa3135f1f7c0d8f192fc0b4c694f59719424e8991df60facb7a4a23cca0a2d6f4128170f168ce875f495fd82cd00622", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-bodyritualz-com", "colour": "#207308", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543341, "uuid": "259a0487-0cd1-4343-9a19-786cd72bb0b6", "value": "T15755337A77A63C4EE579099880D1D3DEA9322C0F5A99E849FCF1D531C788E683B5C10B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543341, "uuid": "f58f95d5-cd27-4a8f-b496-d95a23cc763b", "value": "24576:Dau9H8HCN6oMG3/5C7yH8LKzHv7br0aDHXbxKCOIdLOT1LBlUwyhcj:DauhNsGs+H8L+HHr0yLxKCOaw1r9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775543341, "uuid": "e028337d-25d6-4070-8b0b-3e64f3dcca1c", "value": 1392104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775543341, "uuid": "e9a30261-f01a-41bc-8200-2cc0799d75d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543341, "uuid": "bad6e41d-677d-4e65-b298-4753a0ec21bc", "value": "USD BANK DETAILS.PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bfae96-327f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775565876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775565876, "uuid": "b2de4c1d-1aac-44ef-8291-846cccaa00de", "comment": "Malware payload", "value": "20b4a28683f3fe15849d33e95d8325d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WILLIAM-LAWLER", "colour": "#9E7849", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775565876, "uuid": "25d2fa20-8a10-46ee-ada1-ce3345b299b9", "comment": "Malware payload", "value": "bd70646a7e2f124acc9da25acac373ba15da74a4fbb0cda82766778864b55cc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WILLIAM-LAWLER", "colour": "#9E7849", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775565876, "uuid": "88bd7a7a-9377-40ca-b6a2-a1ea0a88fb04", "comment": "Malware payload", "value": "4ba2638887f7be77522b2c67b7adf9aefa776ac5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WILLIAM-LAWLER", "colour": "#9E7849", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775565876, "uuid": "277bbc40-65a1-430c-9f0e-dec22a6c0e16", "comment": "Malware payload", "value": "9e1e8088ad75159711596ad03c0c75f60055603e96766745dd28e9ff01fc18b419ff658c15d4852b4eed39badec0114d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WILLIAM-LAWLER", "colour": "#9E7849", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775565876, "uuid": "8dde6ffc-d865-4823-a986-a42b8360fb34", "value": "T1D608333F728F6A29F09E0671B9339214983B6D60AA464C4987F0FD58DB361706D3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775565876, "uuid": "bd1358e4-64ab-46b8-9a28-45c92b8eb88b", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775565876, "uuid": "a126b681-9382-4a59-8b58-36c1457c43c1", "value": "1572864:fS4or/UUL7aYJdKYYrBgM400kBdvuZtGlj5khTjrXU1+:fS4or/UUf2rRNB4PGYhTjI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775565876, "uuid": "6751a00b-8a17-4118-b8ec-ab5f56d1f64d", "value": 78272584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775565876, "uuid": "fc3a399b-a2b8-4fdc-a21e-7d3540975787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775565876, "uuid": "ed054b8d-b5ad-42fe-848a-703365a48543", "value": "bd70646a7e2f124acc9da25acac373ba15da74a4fbb0cda82766778864b55cc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa0af2c-327a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563758, "uuid": "ac092836-3487-4563-bf25-6faaef958d46", "comment": "Malware payload", "value": "d99e0d20e53366cef4591a247085e959", "object_relation": "md5", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563758, "uuid": "88dc52c6-1c83-46bb-a599-61eee405b731", "comment": "Malware payload", "value": "bda8e662f6be5af3fcb03923999d6d746edb53393f8a2b7369913232b079ab84", "object_relation": "sha256", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563758, "uuid": "1cf04b14-446c-4dba-a419-18ddb7ce325b", "comment": "Malware payload", "value": "fc24d81a3df60702d4a6401a1c3f1b988ae62995", "object_relation": "sha1", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563758, "uuid": "63259405-1400-4e0e-9c5a-d7ae17873133", "comment": "Malware payload", "value": "8b07569d6a7e26aacdeedc51d954c9285ffd2f9ed1bddbe6585ce0e31495c21a334bce6b2e938e4c72c39e9e7dd4e768", "object_relation": "sha3-384", "Tag": [ { "name": "45-95-147-178", "colour": "#2E0694", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563758, "uuid": "b7e7f90f-7fea-4648-8155-6632b233760b", "value": "T1B49220F1F8ACA43636DD903ABB9CE804AACB7C2F4DAB7D2014579934411C75DA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563758, "uuid": "e49a9b06-7d3f-415e-b621-a5e8b049d098", "value": "384:QVksRsjsKG6qkSgjkjV/A4UAcGEx3DRhQuW5Q:vyUIkSgjkjVdUAcdx3D3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563758, "uuid": "b19d726f-aeac-408b-b41d-8777528844be", "value": 19441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563758, "uuid": "e4e42ee7-4357-4848-ba22-c1078f3abb37", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563758, "uuid": "8e97f71e-de52-4c4e-8387-9cffd95a93a0", "value": "bda8e662f6be5af3fcb03923999d6d746edb53393f8a2b7369913232b079ab84.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50beb218-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561916, "uuid": "589c3424-1d5f-4b6e-98f5-17fef96ffb94", "comment": "Malware payload (Mirai)", "value": "f6031493c8231cd297659ddf80a0796f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561916, "uuid": "d483d1bb-d6da-4878-a50d-6e2742b4eb81", "comment": "Malware payload (Mirai)", "value": "bee50c2c6feead98fe142e943b251980dabd22aca67f0d27307fb6dbd156a309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561916, "uuid": "4da6f67f-5bd3-40fc-aa68-84a7ff64153f", "comment": "Malware payload (Mirai)", "value": "d0844d70490a6c4f34d54858ceb36e4adc9be6da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561916, "uuid": "90a43f22-0363-4680-8f8c-80b8e2cd9283", "comment": "Malware payload (Mirai)", "value": "27bd9570101cddc4027e7678660c796f5a7391515697cbef95535fcda124ea68777d7e73f2232823ae2e40ce73ae4314", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561916, "uuid": "6a43789f-a2d6-4d62-8791-f44daa05ee7f", "value": "T115730262B1881F5BFB965F7D4CD5CA6633E2073D0B535A406B8DA62B0B326DCC6069E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561916, "uuid": "b089068e-d6da-416a-8cf0-92fe188b96aa", "value": "1536:5XPoRx7T1wCyoaqkY+pRNOGwLtsUyDZV74WcdxoXXqdpP/zrZmpVpvFW1C4u+qg7:5XPoRx7TewkY+9ewV83oXXePXQpg1C4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561916, "uuid": "7a082130-27fb-48f8-9139-30f20f06b9d3", "value": 78268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561916, "uuid": "4a797d76-e077-447e-b0cb-03073fa9d9e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561916, "uuid": "aa1616b9-0fa2-47c6-a85d-7966816adf3c", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5820b711-3287-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775569230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775569230, "uuid": "a9fd303d-c102-4a7e-a4f9-f19d435589fd", "comment": "Malware payload", "value": "8e36155087f3414fddf5ac69d8e5fe69", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775569230, "uuid": "910f7112-e860-4724-9c66-30477faead38", "comment": "Malware payload", "value": "c00452a801075e2dbcbee8fcb0aa7d60f166fa682ba62c30378feffa4acf2f38", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775569230, "uuid": "c9d52ef7-be73-4c82-8c71-14f6df5cc43e", "comment": "Malware payload", "value": "9b06327d72205df4f857424366d0ffb73c666bc3", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775569230, "uuid": "672b3db9-6431-431a-be8b-ef3117eebeb7", "comment": "Malware payload", "value": "fb1e2f7f797e1f9751aa158e950f2758f7929039c14663b0766d98cfeaf88e56240c2b61eb222dea1c05ce7818eb646d", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775569230, "uuid": "838f1c98-1b22-4d21-8203-b7ba0fc94ce0", "value": "T161958D4B7CD005BAD46A633288B66292BB72F8590B3233D72F50BA383F767D05935764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775569230, "uuid": "26fc805f-1163-412d-a141-b2ea722b4877", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775569230, "uuid": "ae635a84-2e4a-4d0d-8546-c18b4d47c90d", "value": "24576:2EQZYs6Qyd8/aciXFsPp8GHa377mQSAqGiWPbUBNA:2ZKs6QtacSFsPpq77mQlWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775569230, "uuid": "35fd017e-91b9-443b-9a1d-356638aa6e6b", "value": 1916544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775569230, "uuid": "bae7fdec-c445-4b8b-9fdb-3a78dbf0e5df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775569230, "uuid": "7d90c77e-0042-4de1-a93e-900f6294d3fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0bbfa78-324c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775544038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544038, "uuid": "32f24242-1097-4763-940c-5963cc1c3ec5", "comment": "Malware payload", "value": "93da3aebcda6907d0a4c8a9f38481844", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544038, "uuid": "cf13e8a4-df26-4a71-8baf-ca0ff1405eb5", "comment": "Malware payload", "value": "c181db9086025a31c8493e95914638b4baf1a77f285df611a6b09a4213603d96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544038, "uuid": "f814060a-2c74-44d6-af82-a3626e09032f", "comment": "Malware payload", "value": "04739d4f8692babad5cf407af6c274758757bd79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544038, "uuid": "ba71f889-360c-4d36-825b-fedfcd15581f", "comment": "Malware payload", "value": "cc646c767c061680bcb0d95149c806f2b1e5585290bfe89b3f6ab73732add77c3335f0b696250618904f1f2c9968d577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544038, "uuid": "891cc9c6-e49b-49eb-980e-ef3458d4b231", "value": "T1AF566C87F2A795ECC069C070935A7233F732B84947246AF797D04B213E65BE0AE39719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544038, "uuid": "803ee935-1faf-44f2-ba9e-98441c3ccd68", "value": "42653c734255434cc453e3ffa3eba4f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544038, "uuid": "f22e81ae-b8a7-4ddf-ab1c-5bf95f361a44", "value": "49152:aee4WJaWhFCgRPQXnR+yldaH/XmDO+NHbVQa95TrvmCHkEdO0ArQXx3EMuTAJf8I:mHRPQpDDFNH7O5a3ESfz9LVOIbi+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775544038, "uuid": "bb698fee-e2b7-43c9-8e8a-c887b18fe329", "value": 6074880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775544038, "uuid": "7bcc2074-f0af-4189-b4ee-94c4e2e3be5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544038, "uuid": "5ab933fa-a61a-4e43-83d5-5a72f8a5fe99", "value": "paperview_v1.0.0-dr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec2f903-324b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775543364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543364, "uuid": "b5236570-9502-4125-8850-486bc16abe62", "comment": "Malware payload (Formbook)", "value": "a2c09997b70907379c9920821cb9d570", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-bodyritualz-com", "colour": "#207308", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543364, "uuid": "072fffd3-db87-4f1e-b858-c70845e1fd2e", "comment": "Malware payload (Formbook)", "value": "c2474da768d306dfa0e4504d8d999dec37705232059734b25f78620fea2d53ce", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-bodyritualz-com", "colour": "#207308", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543364, "uuid": "22ef3f01-63d2-4524-899e-c8f346ebcf73", "comment": "Malware payload (Formbook)", "value": "8100e102daf2f05400a02e4e8f5d1056599eaaf6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-bodyritualz-com", "colour": "#207308", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775543364, "uuid": "088bb223-add8-46b6-8210-2c4811052903", "comment": "Malware payload (Formbook)", "value": "5008a32b169a96ba8d6c60c0cb0fe73edc5a27fba475849bd016232f8add2f65ab632011818613770c14592da412e45d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-bodyritualz-com", "colour": "#207308", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543364, "uuid": "3da57bcb-ccf5-48d8-b351-4ab98fb92f86", "value": "T1AB95025189C83FB8CFA85A1C40FE150E93F14D8E54196989FB73BE4ABFBB504522B1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543364, "uuid": "d3eca04e-db3a-4680-9cbb-b40de130d122", "value": "24576:8GShpyj6tmzhkjPfuak/9vfffgs8CFjiMHQm67AUIwTKzzR6yByC:BYPhCpMurHQ/VLTKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775543364, "uuid": "c6bbb513-f27b-45f8-addc-3540d604c352", "value": 1956763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775543364, "uuid": "ab077cff-b70c-4192-a3c0-4c80100f2438", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775543364, "uuid": "0f2178d1-dbcf-4047-a2da-2eb876c5806f", "value": "USD BANK DETAILS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319724bf-329b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775577755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775577755, "uuid": "baa7b8e4-cee3-4fef-8fe5-83b42fb9842a", "comment": "Malware payload", "value": "f51b921fa0efb788abbfc27a932c2017", "object_relation": "md5", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775577755, "uuid": "48fb6950-cfc8-4a28-b6c9-129c15965b9a", "comment": "Malware payload", "value": "c2f18f6c5ef4700dd442b99552fa0a4e02a057c13cb7ba4f7ba0e46ccbbc30a9", "object_relation": "sha256", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775577755, "uuid": "90ec8b0d-8eb0-4d06-b615-59ad1b2c670b", "comment": "Malware payload", "value": "81b0e02f42f64c02fac3cbe18d8f4c87e84b6ad4", "object_relation": "sha1", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775577755, "uuid": "9f68ba1c-34ee-4498-885f-6803d64a28ee", "comment": "Malware payload", "value": "b3db452e45de1f4a7bed79df07291957983e4dca2837d8b570d9184dd839cae6a96bf680144d0934a6237007d2b27ad4", "object_relation": "sha3-384", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775577755, "uuid": "73a3bdaf-d423-434a-84f2-bdedad9cbbc3", "value": "T178E2D2467B11319AFC249638CFF7D7E06A143856AB1088F13FD5BA4F26EE583D30A225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775577755, "uuid": "47aa480f-1998-4eaa-b756-b4b6078d700d", "value": "384:SXymI6hiMGk8fo8P2znk0G252uokt7dNNp7PeAQWk/tTPtbEWSt9tg:gI6hNjZ8P2zkvkV7mEUtTPtAWSt9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775577755, "uuid": "c5284e11-3024-4272-978a-54313e4c4c42", "value": 33128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775577755, "uuid": "167d1407-70fc-4318-a49b-32923f10bbb8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775577755, "uuid": "9b077871-f2d6-4c5c-bff1-81389aba2e02", "value": "Orden de compra_pdf.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de285ee-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561938, "uuid": "84de1e1b-a11f-4a97-a7e0-bf0d04283e7d", "comment": "Malware payload (Mirai)", "value": "b93a0ca0a3092890a20187f32f642a2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561938, "uuid": "9aee7260-7d03-4d97-8e4f-5a38941473b7", "comment": "Malware payload (Mirai)", "value": "c3219862aa48dd960472fd84758a68554bdc3d3b748b5ae5ce360e966c61a244", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561938, "uuid": "dec6474f-9a78-4173-b725-691e9f651e99", "comment": "Malware payload (Mirai)", "value": "47c1e08bc0d5afdc6b9c8f4ca40d0a759c0606db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561938, "uuid": "3c6b3abd-899d-44b4-a622-5f0fa5d47c5f", "comment": "Malware payload (Mirai)", "value": "57796017c3e408c2481707c12efb1605e9d6142cb2e136aad6f66ee2d9afb1326eb6638b15671b9465766c7925a6f27d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561938, "uuid": "3a1b1733-9b85-447c-b9f6-9b0985699c19", "value": "T1E9747713C9254894E0148CF2226772656F4783BB88D72AF3ED5649A1FF2381F61BAFD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561938, "uuid": "d11e2bab-d6c2-45b6-9afb-c4b1dc12faea", "value": "3072:FqUoRxQlSPW6j5BOFWUyTIIeYjWyKnmk+joCd:FHoKwD5BOF6nyyTpjoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561938, "uuid": "d4c1a241-3643-46f6-a8f1-614644aeebc6", "value": 366788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561938, "uuid": "12c9ed28-5a6f-4171-8c41-fb73f122ba6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561938, "uuid": "ccc89b03-e10a-43c2-948a-8e30aeaa5596", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab84105a-32b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1775588268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588268, "uuid": "cd8a2aec-0821-4667-bb9a-924e8aabe230", "comment": "Malware payload (Prometei)", "value": "f45d671dd3c9a2f0f8274aab75319bef", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588268, "uuid": "b3b67d9d-f700-4146-aaf8-7f351b9c946c", "comment": "Malware payload (Prometei)", "value": "c4b5946c54629f9a0500b9b97610204298cdfbf2f29a56d5c3ee622aaf551997", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588268, "uuid": "cee8263a-213d-49a9-af45-61491e6c73f2", "comment": "Malware payload (Prometei)", "value": "8c8bf1284619f101b20440e3eb597418df95aace", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588268, "uuid": "7346b3bb-bb70-455e-aebd-fc90d8e21ded", "comment": "Malware payload (Prometei)", "value": "d2069e2503d04eb0f18d68e4dfbcd093d04627a4db02003e5c1d17698805e44be2e693416e7a18450b7a259bae1c35f2", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588268, "uuid": "6f5dc35a-7af6-4258-b504-4ee1408648a3", "value": "T130844A42635E9296F46768B1A02ABE735EF4A430C16F29F7F3C80D5C14997D0AAE071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588268, "uuid": "945263ee-eafd-4896-916f-3ea1c43d47cc", "value": "a2216d9130438491266dde9306e2f8b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588268, "uuid": "3f146a4d-f7bc-4e17-a45b-3862c5bd9a3d", "value": "6144:6Lx/pL6+VzW1g2fGlbS4U/8OoG/xNFDwu0Cu/QoSTScPzfJeQs+yQnUXoCU:6F/pGjfGle/8HG/xnDwu0HQoUScFeQdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775588268, "uuid": "af71a12d-1788-40f2-abcc-c59cdec67c47", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775588268, "uuid": "9d6ef297-1a92-4bc0-9390-e5fe5931bb7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588268, "uuid": "e8ffa467-ac8a-4053-917a-9739d503e0ab", "value": "c4b5946c54629f9a0500b9b97610204298cdfbf2f29a56d5c3ee622aaf551997", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbdbd235-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553130, "uuid": "9bc1ec06-0c12-48c7-8865-6b167393f0e9", "comment": "Malware payload (Mirai)", "value": "06fdecb27cb42ac2840e95f6afb4bafe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553130, "uuid": "00e2978b-ee28-49f3-a192-d05e910487e7", "comment": "Malware payload (Mirai)", "value": "c4b5f523ed04d872e69695edbaacf1c6118deef4921b495c6321667839fc2438", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553130, "uuid": "7dfcf6cb-fe7b-4c60-8fc0-741c6d90ee43", "comment": "Malware payload (Mirai)", "value": "cdb80d15996ee8975c1a6e651fb69271f9846872", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553130, "uuid": "9092b05a-5107-4dfb-a895-e9f68025feb4", "comment": "Malware payload (Mirai)", "value": "96d58692f3ba8de92eb0bc910097978373d544b627ef637b8da8a3ea24ffcafdfd638117fabf4d38f2c356a7403fc6a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553130, "uuid": "4d7ee35e-b526-44a8-988e-16ea3ddd6630", "value": "T1AA334B4AE607D9F0DD5609B0106FFB3AE632DC362130DEE7D7D4B967A9B2642D08225C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553130, "uuid": "02e88c79-ee16-4c35-928f-6095b678282f", "value": "768:tZj1/3TLJiIkDS9fObba8EXcPiSxeL/jSxmSkZ2rOOSBVaanaopK+:tZ9Tp9fObba8RgL/uxmSfkjla2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553130, "uuid": "58bff393-7af9-490f-b966-c6ca16a887dc", "value": 53848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553130, "uuid": "10c11af4-57ed-4e88-b42f-09fa4edfcf98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553130, "uuid": "ba634773-6200-4886-a938-cb728c59acb0", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71608598-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561971, "uuid": "9dd87a3a-89c5-4889-b9b3-9e7cbbfc75e8", "comment": "Malware payload (Mirai)", "value": "30cf0ed23f0fb96df1825da37160f8a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561971, "uuid": "735b632f-757c-498c-a43e-d7becba9a21b", "comment": "Malware payload (Mirai)", "value": "c53486da1abf69b989fa8fef232538ff51d16201a9ee633756f291d19ccebc09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561971, "uuid": "ec22b245-b0bb-4d5e-b579-0a4c90ccff44", "comment": "Malware payload (Mirai)", "value": "6d6ca7814ec6842941d3bdbc185159eb51b69dc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561971, "uuid": "55e2f288-a473-4708-b62c-5747288689c5", "comment": "Malware payload (Mirai)", "value": "4fcdfb619ff1c919a019469c9cdd28084454052bc94866ba95daf86ce13c14e17dbe2903790a0358c51834d18d3eedb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561971, "uuid": "40bb69db-90af-42c0-8178-bf5a4aa06854", "value": "T1E684A653D91688A5F0245CB312273241BC4697BB48E726E3EE6B1962FF3541F41BBEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561971, "uuid": "7abe713b-3b24-4945-8fcf-668529ef636c", "value": "3072:NbBtLpcHMnXW0rUIbWwejLrfXEN33sqw0Ho8VKjbiKLhYwryXp/yf3D8MSQiYzFz:/tLCdfPjLrPEWT0HoRLhbyX0faJojP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561971, "uuid": "64767173-28ed-4e63-8ea3-f7bb0ba35728", "value": 394048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561971, "uuid": "cfaa17f1-dea5-42e4-b5b7-f9f537ae2971", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561971, "uuid": "f16c3859-1d0c-49bc-8d96-9d9dd0b65cda", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5eb4d23-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553174, "uuid": "f71b6fe9-c090-4ffc-88f6-c686c174b3ba", "comment": "Malware payload (Mirai)", "value": "5ed87fb3ba9648d53fa92c79c8f048be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553174, "uuid": "0653e35f-f6f3-451b-b532-894c2875004a", "comment": "Malware payload (Mirai)", "value": "c544b92b22e7e131ff963c794a66c32354a7c52eb81f32556186cac4506b06f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553174, "uuid": "7a4aba98-3e9a-4e0f-815c-588ea55f54f1", "comment": "Malware payload (Mirai)", "value": "22bcb65bbdc3f8c9249344b888edf53a41f80e31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553174, "uuid": "aaaf08f1-f57d-4e19-85ca-d7961e41bfc3", "comment": "Malware payload (Mirai)", "value": "3a9c666fc6ed91b9d19828cc675c66cf3d7a4499b31cdfc23f77ce12e8cfb331d013f68121822edafe8f17bf3692d70d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553174, "uuid": "7473d3c5-04f9-45b8-9faa-d7949e44d5ce", "value": "T1A2234B41765C0E47C2665AF4293F27E083FEE9A020F4F589260F8B868275E77418EEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553174, "uuid": "ebaccd96-c979-4034-a96a-2d9282e68a12", "value": "768:FqkwvgVaz33B0bTGAX9PRskRpywFwyK7WhtdC5AkHodtVABUksb5W7yaEN:yYVreAXV5ywFwyYyjwZI4/sQ7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553174, "uuid": "29898206-cc2e-4115-b937-9dbabbae4378", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553174, "uuid": "f98afedb-f5bd-4ba6-8c91-1b18a81570c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553174, "uuid": "3c1dbaff-3ad5-4042-84e2-696f329fcfef", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee53aee-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561967, "uuid": "ee776421-cb3f-49f2-bf5e-c2e2b8624837", "comment": "Malware payload (Mirai)", "value": "f06c9f16e53a009ba3c433783c00ef12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561967, "uuid": "2f1b1bd4-5c9d-40d7-83ff-6f7bd2bf49f0", "comment": "Malware payload (Mirai)", "value": "c54ccb12ce1326299428c6ff9a28fd8770e7eba4d36d1327118c600f7f93899d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561967, "uuid": "e5d4ac26-c2b5-478b-a95d-25e03ec31993", "comment": "Malware payload (Mirai)", "value": "b0fe7038b71520e4cdd1c530c5435cae980175f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561967, "uuid": "17901df9-0a7e-41ab-bf97-87df0763dfe8", "comment": "Malware payload (Mirai)", "value": "6e92ee0280e6f4f32616cb25d96c030a10d190365a32e962e7f853bc0302b9dad1b2f6e532f29addb3da06f489f4fa4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561967, "uuid": "94657096-6ff6-45a7-9e05-21f2b930028a", "value": "T17A24B50A7F919FB7C86FDD3706F98A0128CCB45721643B3A3670EA5CB91A54B09D39B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561967, "uuid": "356b9c25-d041-47d5-af27-2854d5d41afc", "value": "3072:/gIDdzTyjoHZO+ncGl0YgRCQssEZ0y85zNzyBalTbhzDr00:/ZWjoHZxlJuNzyKTNb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561967, "uuid": "5db0a0dd-90d1-4a6f-b324-66355314893e", "value": 221064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561967, "uuid": "c1a12078-0081-453c-850d-a5eaeb947790", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561967, "uuid": "b4485547-b32a-43cb-97a8-8076a969f5d4", "value": "nmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf7f211-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554152, "uuid": "7c284229-6816-48fe-a1d7-989823b7f2d4", "comment": "Malware payload (Mirai)", "value": "44dc265f08ea704b2f30ca5ac9e43ff0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554152, "uuid": "66c914b1-4462-4a6d-9ef7-9e7f321329ab", "comment": "Malware payload (Mirai)", "value": "c63b9d0f332d79c82b5bb6dedc484e06a254eb046b831ffd5af183afa8995c8e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554152, "uuid": "a4e9fb81-9217-4105-8c58-28060061b19a", "comment": "Malware payload (Mirai)", "value": "38b7713ea5e73aa88487638ddf1be03751130284", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554152, "uuid": "aef4cfe7-0aab-4caf-ae60-4cfadb921113", "comment": "Malware payload (Mirai)", "value": "fb0bf0a96b57dfb3c1cad547ee26646922ab62853b93bfa66ea2139a1ee0f377907e1ed00ef6a206534683b36d3040af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554152, "uuid": "af1ebb7c-e620-4610-a81b-4c5409ae4284", "value": "T117F2F139C2FD997CC03E76350C9D5785B9C2F55326A93367092962BAAFF74813E026C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554152, "uuid": "145f3b7d-5a93-42b5-80ca-2bc220210982", "value": "768:AwS0nQr9tpJEu0annIBqVqVHmwIHWUFtGtzXKT41dSjUx0nZw:rOX80VqVi2otGtzXD17MZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554152, "uuid": "0c7806d7-631f-4c44-8d66-e5bb3b220bf0", "value": 36916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554152, "uuid": "c27c7d06-d124-41d7-a9b9-c153b4505bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554152, "uuid": "ec58daca-805e-4955-bddb-3dd82a9ce0a8", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ec7351-324e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775544661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544661, "uuid": "a266bf40-c50b-4d6f-b78a-9895b3b4f627", "comment": "Malware payload (Formbook)", "value": "2ba07d3873e4caeb1f949805928763b7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544661, "uuid": "e51b0174-b1a8-4d77-873e-ce02ba988cea", "comment": "Malware payload (Formbook)", "value": "c881b775bf291491c50ee8d6aca59282633775829726062a1bb0086a69b4f80a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544661, "uuid": "4cf3abda-743f-49be-84d8-945a81b12fc9", "comment": "Malware payload (Formbook)", "value": "ba5c0def48cbc371bfa7fe009781e1aafa633292", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544661, "uuid": "5ace0da2-978c-4253-ba14-9a8b2d52dc43", "comment": "Malware payload (Formbook)", "value": "0e151a08785b386cf453b8c0cbe2dc952ee2cdac4549f46d5f99bb7987f1a3695ff18865e69db7eeba598f9e7548141d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544661, "uuid": "83b85968-5c4d-4592-870d-9efd5ea35a2f", "value": "T10ED586A183E11E7890428E7391AACBDDB5BC1E6EA40314DCEDA5F1B1E053D9408FB67D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544661, "uuid": "89899fda-6f3c-47e4-8719-249b87c90fd9", "value": "384:9RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR6:e7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775544661, "uuid": "47ab31a2-a52d-4a0c-8123-374e84e61517", "value": 2878505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775544661, "uuid": "a5b7bbbe-8577-4b95-876c-950120334791", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544661, "uuid": "dc04a076-30b8-4a45-8cc8-d0b8cb54cc23", "value": "Request for Quotation-RFQ NO000020260407.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76507bfa-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561979, "uuid": "90df2192-adee-4812-84e6-678281955c21", "comment": "Malware payload (Mirai)", "value": "370d0507c8ef5260eeced30e8509d10a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561979, "uuid": "263dbb03-bdbe-426b-9191-f74a8da9a9da", "comment": "Malware payload (Mirai)", "value": "c89930247179822c150ee3a2c34d520bdebb2db0e78dcfc110fd8297a9a7e256", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561979, "uuid": "c3a9c13e-e930-4fa8-aff4-d65ba2eee4db", "comment": "Malware payload (Mirai)", "value": "372ebc9a95eadbe09befc5a4099642123835b165", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561979, "uuid": "1bd8144c-2397-4abe-a12b-6abc617468ad", "comment": "Malware payload (Mirai)", "value": "2895a4b151c734495997496a18488335a613e95f68b13a3b48114ac9d3facb5d67146aed8edc954735eae2526f512fc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561979, "uuid": "d408b3c1-eabf-49ca-b505-459d188495d8", "value": "T19383022C26061BEBE5BE8AF4F3FD27F23D361D257422C475B281ED5B98270E06542B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561979, "uuid": "c573506d-0797-4ff5-a7a5-8c75deab196c", "value": "1536:Pp1BViEj943nB/WKN5PysdYNKkBgN6eHXf0xlBk0GYMrY/ihn+VJuD:PjBsEB43B+K7fmNr9ccDBk0GtrY/ihnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561979, "uuid": "a2bb6526-3e5b-4104-8771-49a045b6f88c", "value": 83648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561979, "uuid": "8017918a-2376-4c05-a39e-d520284924ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561979, "uuid": "dc94465a-2121-4cea-a612-0af72e50a06a", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0835107f-3273-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775560506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560506, "uuid": "36629a2e-8a58-4f5d-8eef-293b9bcca313", "comment": "Malware payload", "value": "2226d3e8843b3e2c228da3a3fdc56e7b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560506, "uuid": "404a09df-0b1b-4433-b8a7-2d4ea6d05cad", "comment": "Malware payload", "value": "c96338533d0ab4de8201ce1f793e9ea18d30c6179daf1e312e0f01aff8f50415", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560506, "uuid": "7c31bc7a-c1a7-4945-b340-df5642713992", "comment": "Malware payload", "value": "596b582169f5d65c4791477a61099c03fbb63a41", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560506, "uuid": "64992245-8ef2-49e7-9478-008a58a18124", "comment": "Malware payload", "value": "a0abe124d7cb437968c69b3db5c4a8f38c943abaa05bc8a1d28cee53e06785afa75eec602fcd94b2d7afbf247343032b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560506, "uuid": "e204c8c6-6cca-40fc-9c2a-4e3e5d1c8a4f", "value": "T1ED81E917C3C09678C1AD2AB4011A0E33D4BAC8614FE90CE7870BEB5364729F56DBF905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560506, "uuid": "8c44c6cb-a143-48b2-b030-26ed3f91f7bc", "value": "48:vpgiGF/Ubi8XGCheuCarSGyQK8HRqcn6GZXsJajldcYH3NzKiiN:BB+AhGCheubvyQK8x966ldl3NmiiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775560506, "uuid": "3d7cbcdb-c6da-4c92-8eea-e724a5848ead", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775560506, "uuid": "e70cd525-986d-48b9-b725-1a1217b7e9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560506, "uuid": "12c33ed9-0907-47dd-bec2-99d98028b6fb", "value": "c96338533d0ab4de8201ce1f793e9ea18d30c6179daf1e312e0f01aff8f50415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4479cb-32cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775600112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600112, "uuid": "d80b4ea6-626d-423a-ade0-06a42ba6d7d4", "comment": "Malware payload (Mirai)", "value": "6df547752664d856ff16d699fbdc4657", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600112, "uuid": "3f7a3d84-868d-4276-8f37-42dffd531da6", "comment": "Malware payload (Mirai)", "value": "c9ebb56f8b65387714a3d34a13605144f72b4d0c3e6aac21b1dd7e7406efbb29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600112, "uuid": "11f695d5-4776-4f6f-886a-cb7b2bd016b8", "comment": "Malware payload (Mirai)", "value": "d801a89ed870d007925362ff888763c9be43136c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600112, "uuid": "f5870c2f-303a-4c60-b655-a0b4e0d56491", "comment": "Malware payload (Mirai)", "value": "5601d95494093073069fb2deecea542be717290f85a94e53f1a8ce01cf6ccc469be2d6446a16be0579fa0084b0db5f4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600112, "uuid": "e5ac42ba-1460-4dd9-9d50-fcbdcb2f2123", "value": "T1AF932946B3D3D5F1D84356B001AAFB39A630ED330120991BDB94BEF2D9369D2611672F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600112, "uuid": "29c5dc58-b452-4176-9f3c-596a45ce3af6", "value": "1536:GMLoO3xu+XTSxEu4OSEQSaDRna+PNukA/lBeozhMzz6/Lc1GwOUH31Uhv+W5f0ym:T7MGIL2SeaEE/lBeoGv6/Lc1/iKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775600112, "uuid": "5470740c-c9ef-4648-bdc7-216738b14ee0", "value": 94124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775600112, "uuid": "eb74c538-fae3-4df6-9cff-810c182a8b1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600112, "uuid": "48151a9e-b473-4495-8404-b8429107ec0a", "value": "zyre.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fca327-32d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775601058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601058, "uuid": "86d3ec00-cc00-417f-bf47-5b8e6bea44d5", "comment": "Malware payload", "value": "c16b82725fea4a280f1eb72cb1f7f749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601058, "uuid": "1a311c45-bc9c-421b-8cf4-807d009c1455", "comment": "Malware payload", "value": "cad38b5d0f9d6ec7d132a3af6a6a5da33ba351468c2a360c6c338705c78f2914", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601058, "uuid": "27f9e971-d52c-4a32-b1cc-a6ff7452e74e", "comment": "Malware payload", "value": "fc62782e27e6d03e5d67020e261c96d18e3391cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601058, "uuid": "7c64e0ef-cdbe-4381-bc2e-e4b925828525", "comment": "Malware payload", "value": "9e1d73638fe443162e638dec9993d6a529cd032ed12ae2e000ea98934f3537cffde57f852a4808055265ef188751c804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601058, "uuid": "1dd6f46d-4e3e-4957-9a7c-387cf08d2da5", "value": "T10B2733A53232440ECD87EF7B4352D2844BD792078962DEEF1153A560E2BB8A07FF9176", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601058, "uuid": "248675fd-4734-4b72-bbb8-157f1a98641a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601058, "uuid": "ecf1f566-c074-4719-a0b0-3dcbbc854150", "value": "393216:STEBINh0eCq9hoU2HO8QVXj2O+P85Jcl0zbI3UG3etPh916T6y0vvKRXY:STEeZ+HODlj3+P660z+X3etXqovIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775601058, "uuid": "b6d348b9-3ee3-420c-bcdc-dd627cf53b68", "value": 20784246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775601058, "uuid": "851fff86-b837-4f02-82b6-59c89a28caa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601058, "uuid": "b49af0da-84ec-49ae-9075-1f09aa563905", "value": "Joplin-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa098119-3268-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775556053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556053, "uuid": "a9a83074-7daa-4618-9db0-63b78cc21914", "comment": "Malware payload", "value": "b1d9a54edec2ea2791a8fd5baa3f2b24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556053, "uuid": "115fd68b-4b9a-49b2-b395-b40697957371", "comment": "Malware payload", "value": "caf33b2661de6447f28ee893794e962b83fa3938a7ba5aaa95434dba60669155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556053, "uuid": "a3f55580-57f4-49fd-9842-c4a5faee3bdd", "comment": "Malware payload", "value": "9b38dfc67f2730c5159cbfdaea7f6d3b04b10fc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556053, "uuid": "6fcdfcfe-b5f3-4d58-ab51-0e5387832f81", "comment": "Malware payload", "value": "5b0d8fff8478560fe1f51ac311409ca4c867b467ad2fad6e5d8ed73212a97c8ab54d43e4709130ec74e1239b913bf7da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556053, "uuid": "2304a7ef-127f-462b-84a2-e78db2613332", "value": "T1B7F5CF9573C87ADAD42AC93A9710D722C1B3AC234B76D0CB5993134A1A7BED15F3EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556053, "uuid": "1594fc5a-b1ce-4446-9f92-8f9ad0d26f0d", "value": "e878e7c5912d92d7bdaee49048ad1bac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556053, "uuid": "15d009e7-f9e6-4086-8f5d-238b2c20c3ef", "value": "98304:6P+T7UT3/UxXugrtc81ioCs89vcrjiCvpvFzPeaphVfI2jOpeZqCgmmhFlnx5E9W:nT7UUpntc81ioCT2XnvFxhV/WeYamhFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775556053, "uuid": "f1e34308-ad31-455d-947a-43bd7c7c7ee2", "value": 3483136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775556053, "uuid": "3c379c12-830d-4e31-bfa0-25c3b00880a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556053, "uuid": "9168059b-a636-4dbf-a1f8-033ddbca5122", "value": "libvlc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dae4356-327b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775564085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564085, "uuid": "76152109-2c48-4512-ab7d-eec9ede73f21", "comment": "Malware payload (Formbook)", "value": "fc98754c49360bc180d94e0851d153e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564085, "uuid": "e73f9039-246d-464d-af6a-7b811119ebca", "comment": "Malware payload (Formbook)", "value": "cb48a1b95924a62d97e4e2295f168dbe880a08539a2305e95e907865a36c6fe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564085, "uuid": "1ee6f6d5-88db-4226-afa3-f85442b96472", "comment": "Malware payload (Formbook)", "value": "b0cebf69b4f7fcaae1762d7b58fc26c2009328a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564085, "uuid": "6f998819-0484-4843-8ced-6b8bc28b5d3b", "comment": "Malware payload (Formbook)", "value": "9c0b41d305346823512e387026ec07d87deeb2b38cc5aa0a151f399f150f76e8a9157e5f4447b3959c237b5412901ab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564085, "uuid": "62d8cbfa-1cf9-467d-9068-85a0e1eff99c", "value": "T1E945F1512627DC03D1A69BB01CA0D33007FA6D85A413C267CEE67EDBBB39B8599C4793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564085, "uuid": "a5e85f06-2139-4b18-8bf0-f40a3462b7a7", "value": "24576:IVXuqSJJSHwu4HMoGVO1zJOgDHNwogz222FgKCbMsmvG3qFK92VWjtZhL5jNSNlG:itqUwu4ZttUgDHOz2JFgzHsCAK9RjDh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775564085, "uuid": "76b09b78-ebc3-4420-a21b-5cfa6c87cc1a", "value": 1242624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775564085, "uuid": "f11dbe60-cf37-444d-87fd-c9626395b0fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564085, "uuid": "b151c480-a5a0-429c-b43a-3228d92a4a1f", "value": "HBL_SEH26030005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e91f32-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552682, "uuid": "2b885418-c3ad-4827-a143-f1a050d66752", "comment": "Malware payload (Mirai)", "value": "4493cff48bade26d85487daaa186f412", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552682, "uuid": "6aa77e98-256a-4cc5-a179-24fa27507993", "comment": "Malware payload (Mirai)", "value": "cca67e75c64eaa701c5b1ce05ec825a1bea9396dab1d4cbb09ba752c24d0763b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552682, "uuid": "b28383eb-a985-4c15-b343-01e52f43128f", "comment": "Malware payload (Mirai)", "value": "6298b97f96f6e48f6af906700bfa4fcf504c26eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552682, "uuid": "49749ca5-8b8d-41a7-a6c4-6265f5ce6a69", "comment": "Malware payload (Mirai)", "value": "d275dd4de10ba3da9d8395eb3f51a13a698b730929ed32d05808984f109b70651069718276c2f23c77704f04a7a878f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552682, "uuid": "373fd30f-0903-4684-bda3-31610ad09a8c", "value": "T1B0837C32BA751D27C4D0687A61F30721F2F6479B25EC8A1A7DB20D8EBF2564032477B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552682, "uuid": "d22262fa-4c9a-4517-b718-31ffcda62d54", "value": "1536:BqjSIdmh69OHkGvTdN5zoR5EzQKt0qrNM5owQovwVY4t/7o9VNNus73:sWTlEG3VmAScN8vQKkK+s73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552682, "uuid": "fb84250c-f63c-446c-b0d3-8f86242fd9b6", "value": 85512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552682, "uuid": "384d0102-6ae4-44f6-bf41-cf515de8eb62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552682, "uuid": "96a5f222-6e74-4758-bb36-4af75b232572", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6c5e7b-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561963, "uuid": "beb3fcbc-f5aa-4da4-9b67-b850d7824ac2", "comment": "Malware payload (Mirai)", "value": "1c73ce48f71232a4dcfab0112527c939", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561963, "uuid": "7e4cc11b-925a-4dba-8c00-7235d73b76e4", "comment": "Malware payload (Mirai)", "value": "cd29241e82a821c6ad1709096ac825e37171523fad9a10b7ec0c28bd40aafe85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561963, "uuid": "3095c7ef-63d0-435e-b920-56c268ed26f8", "comment": "Malware payload (Mirai)", "value": "7f297b462f24a8affd7503e129cbff6d7a3b0f19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561963, "uuid": "81581659-c338-4f90-9038-ef660e459abf", "comment": "Malware payload (Mirai)", "value": "13a339663dbe0eda8e7d9e79c2d3d35e5851b0e6c4b809859504abfeceab1443c6ee66db0a3d51947e00377cff5f2d31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561963, "uuid": "dcb1f6ae-89b5-4b75-8a90-8915a7466f7e", "value": "T131D317C6BB83DEB3E44315F011B7AB324A32FC3B582ADA91D369BCB19D511D1A50636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561963, "uuid": "126f421b-0f74-4569-b9f9-84f488c43ef8", "value": "3072:6f6UBu4TpIfRheMbmhAuVLMI/AHJc/xFHiI:6CKxi7glCHKpFHiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561963, "uuid": "34e04e4c-58af-48e8-8049-2abf2729c34d", "value": 130684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561963, "uuid": "3e259ed6-ba5a-4100-9855-9e479a52c2d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561963, "uuid": "a727b509-13ac-4e98-92e5-388b65589b9c", "value": "nx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93faba28-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553010, "uuid": "78caba94-823a-4f28-bb10-e8dd7344ce36", "comment": "Malware payload (Mirai)", "value": "1d9ddfed91c99673f44a8f496cd8a215", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553010, "uuid": "6ac2abd1-1809-4412-a0e4-d25ec7700536", "comment": "Malware payload (Mirai)", "value": "cd7ddf5171d6e479ce7bce0a2fee6ad909008ceec2640361fe028c136b3db6a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553010, "uuid": "7ba632c7-0526-4f30-a726-4da9bfae0709", "comment": "Malware payload (Mirai)", "value": "d0c984d16b43361402940ef26c4d57b4b983dd25", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553010, "uuid": "3dd4b4c4-7831-4fcb-80cd-fbe2b7c74756", "comment": "Malware payload (Mirai)", "value": "052aaf73701f70bc80cd86e4708c63555697dc1da177ee594a93aa7f804650a70e41b3cdc4838ee989bb5d9501806fac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553010, "uuid": "483d6ff0-c5eb-4243-931c-0c5a9d7339a8", "value": "T1953307D6B401AE7CF95BDFBE8012490AFA31621151930B3B637BFD936C322A58D53D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553010, "uuid": "d580a2a7-c8c6-4ace-9d48-f54be96bdd97", "value": "1536:outWMN1X17lQJKO5dPzdCH7n2q/CV25/9r8f:o0rl+KgdA7U2514", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553010, "uuid": "7a5409f5-1845-454f-8351-1040a9ee8a80", "value": 52500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553010, "uuid": "8935243e-d201-4b90-9f68-033c715d5093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553010, "uuid": "69b7a9d0-95d7-40f7-97e0-aee0146a3410", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21707ca-32b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1775588279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588279, "uuid": "8dd151f8-04b3-407e-9180-a09caedd9e39", "comment": "Malware payload (Prometei)", "value": "b2a9e6d1633f474290835b2a69caabd9", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588279, "uuid": "c7b3e572-6d3a-4e6f-aa48-779adc5085c5", "comment": "Malware payload (Prometei)", "value": "cf30bc39e6ff51de9815492c5d87f98e651e6fdee9adad2a5f52d42d167d6d2e", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588279, "uuid": "ea0cc86c-9851-4490-b114-d65d30cf63a5", "comment": "Malware payload (Prometei)", "value": "b2550c5db3cd5fab422dc93c5e49420a48475174", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588279, "uuid": "fb3abc9e-a622-4ac6-bc3c-4077c1f6cd50", "comment": "Malware payload (Prometei)", "value": "50e7c796326296069d7a931cc6364ed0c91420475fa5f232a946d83e3d20499e6c90337d5dcdefe5bb199e3dd324613d", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588279, "uuid": "25105eca-5cec-4766-ab22-89049f636188", "value": "T1298533EFE12637E0AC4DD95C531D1BE4810209979DEEA06F5E9CC0C2867AAF9F432647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588279, "uuid": "9130804a-2430-4d9b-a31e-3c5e7042d3b6", "value": "49152:4zz0kLxqODTzktEbD3ApvtnM+YUANiDojF3pjUtBH:kwk9Fz4EPApvtnNgie3tUtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775588279, "uuid": "865a30c4-7f41-46ab-822e-ba9655d426aa", "value": 1770236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775588279, "uuid": "02c0ec03-9011-4abb-9940-5f577e90e6c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588279, "uuid": "6f818127-cdb0-4431-8af6-b0698f1921f0", "value": "cf30bc39e6ff51de9815492c5d87f98e651e6fdee9adad2a5f52d42d167d6d2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0d4a77-325e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775551522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551522, "uuid": "4551e267-929a-4f11-b2c2-e944bdfc4f62", "comment": "Malware payload", "value": "45974914832793f3cd362acc36324123", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551522, "uuid": "741092b4-e2cd-4be5-9623-02b4e717763e", "comment": "Malware payload", "value": "cfddfe6b645842b8ed34137a45a13736119d4d408f9fb99f62c5aa7d318c4747", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551522, "uuid": "1c17ad45-7066-4760-b39d-6f1c56c6129f", "comment": "Malware payload", "value": "273f59ae6104fd5dcadd8683a095b10e29b1b79e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551522, "uuid": "efda573f-35f0-4b7f-94de-eaaf71283ee5", "comment": "Malware payload", "value": "5e6d4f531bb97a76196f86bc2dd6446bbbfd24010b60d73ace596fef166eeda410c9b98f7050cc7b5a5a99e75f9654aa", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551522, "uuid": "18494009-adcf-4014-a7de-62d9e482d4db", "value": "T182F162692E57DC9203B0D642E808820AEE73136B129D1E61F87C84405FE8D1EF69C9FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551522, "uuid": "4341d7a1-e18a-4fbe-83cf-123f030d9c2e", "value": "192:/BYwS9bYQ074MRaN7m/K+lSF+I/ZxqRxrwXiQOC9:/qwSNYTc7mS+lSFF8pQOC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775551522, "uuid": "fb1a6278-516c-4141-8b2a-a53bf786d52f", "value": 8158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775551522, "uuid": "c9be5f47-1cc8-4792-84af-4f0e774c7bcc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551522, "uuid": "5937a3d1-6310-433a-aac0-b3a46660421c", "value": "cfddfe6b645842b8ed34137a45a13736119d4d408f9fb99f62c5aa7d318c4747.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d291f6b-3266-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775555011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555011, "uuid": "e3dde67d-d6bf-49d1-ba45-16f85299a343", "comment": "Malware payload (Mirai)", "value": "5e01bcaa6610052b3a016acfca70dce3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555011, "uuid": "5ffeea27-6c4b-4173-a10f-4396ae196ae2", "comment": "Malware payload (Mirai)", "value": "d1af2a31955d5e7138d0babcc157d3d5306a5fd3c98c9c5c285687a22ae680f5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555011, "uuid": "64ec4272-336d-4a2b-bfe1-9c316c7e886a", "comment": "Malware payload (Mirai)", "value": "dd686fe85e56e0edb0c8d0daed1b26b89ad57098", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555011, "uuid": "77d91807-a75f-47ab-bcdc-b7e603b76448", "comment": "Malware payload (Mirai)", "value": "95ba2bd9250d17e9139f7babe2d36ea2e0b387c2892039453d8d5dd9db92d513e4af2cbe07d2d35d7077c5ae7841df74", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555011, "uuid": "0a1a1a15-c0e1-407b-8742-758ca0c329e4", "value": "T176F30945BC918F26C6D622BBFB5E028D372617A8D3EE3103DD255F25378A95B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555011, "uuid": "cdc2edaa-0433-4100-9fd7-29b14ff83099", "value": "3072:zrMr/q3J46RUTRqdVjqtMWrMLQT4+Ppb+a0mLk3Wa07:zIrk6EHgzH4za0d3Wae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775555011, "uuid": "4dd77e30-a552-4cb1-bcce-c2d4ec40c5aa", "value": 162560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775555011, "uuid": "4bdf316d-438a-49f9-811e-51a242df77a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555011, "uuid": "ddb57efb-bb26-468e-ad02-1919461deffb", "value": "rebirth.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36855ab4-322d-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775530519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775530519, "uuid": "f907ce9e-4154-444e-ae4c-ddf883c33f0f", "comment": "Malware payload (NetSupport)", "value": "1d70c9b0104b93aa993684bef4ccab9a", "object_relation": "md5", "Tag": [ { "name": "107-189-19-35", "colour": "#81DC5B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775530519, "uuid": "df2b77bc-fc7a-49f8-8a1e-5add1b8c9955", "comment": "Malware payload (NetSupport)", "value": "d1ed6f580ac311528d74caf813bc0c6ec412d9fe6b0f106aa23a4c4f8adb365d", "object_relation": "sha256", "Tag": [ { "name": "107-189-19-35", "colour": "#81DC5B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775530519, "uuid": "ef665a6c-2584-4996-bc9c-9e6f5b1546fd", "comment": "Malware payload (NetSupport)", "value": "0e952e5c2fa8b438d1c4fd7542b4dfc3c5ee9242", "object_relation": "sha1", "Tag": [ { "name": "107-189-19-35", "colour": "#81DC5B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775530519, "uuid": "0b7011ce-e116-4fc0-b61e-01c2dc22d4b2", "comment": "Malware payload (NetSupport)", "value": "6c948286420122d1648fc3e85fb82241248ccfd05793771718b32df8ceb23842fd4fab54148a822a1161f7d5e5590774", "object_relation": "sha3-384", "Tag": [ { "name": "107-189-19-35", "colour": "#81DC5B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mher-club", "colour": "#CE14B5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775530519, "uuid": "c61c2b73-2458-404a-aed0-8ae9dd2a66cc", "value": "T12B565BCF728B7672C55CA9377C9A414A3042CB76278606794CFC5ABC48EE64E8A0C75F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775530519, "uuid": "cb99c768-7d7f-44f8-91ea-7e7ac807a2da", "value": "31f01382ba761e6e741d4f20d6d399eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775530519, "uuid": "a9e9f656-c5a6-4036-b069-338c55e21fd8", "value": "98304:BYuALZU077TgIj1vKFvoKmGkYgYwAu99hRrlmsmMysTz:m3vhv+voKmxYgYnu9TRrEsmXs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775530519, "uuid": "c7f58cdc-86a6-4423-a182-fe04417ad29d", "value": 5909010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775530519, "uuid": "7432ad92-de6e-4f6f-851a-07538f3601fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775530519, "uuid": "d5a772df-bf39-4bdf-82f8-a4ac2ae69efa", "value": "1d70c9b0104b93aa993684bef4ccab9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8beefc95-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554714, "uuid": "51e775e0-3288-4331-944b-62bfb0c541a3", "comment": "Malware payload (Mirai)", "value": "f8ee45e8f786d6194072bb73af9c2289", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554714, "uuid": "8d969583-8964-4fa1-8650-277336ee7fae", "comment": "Malware payload (Mirai)", "value": "d234a6094c5edb6a1193d31840a14f25fa4eee9d906b822765f2d20d6c5102ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554714, "uuid": "f1517a59-26bf-4087-a623-c77f62826dba", "comment": "Malware payload (Mirai)", "value": "c92076b2bbfda368eff72918687d3c0c66927817", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554714, "uuid": "7c207604-1153-4fb1-9b65-ba8c66066b6a", "comment": "Malware payload (Mirai)", "value": "2994ac757dfb4824405ab314baffcc1e51de5e5ef4fe0b4a44f160ccb2fd6528cf964227704572463ec1ad836cbdedcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554714, "uuid": "84f99a8d-da0f-4cdf-9f56-90eec8b24279", "value": "T19B632A91BD819B13C6D0227BFB5E428E372653A8D2EE72079D216F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554714, "uuid": "49f0bcde-a3f8-4e6c-8677-31777cc50b47", "value": "1536:zGYi7YUGCsKrhhSlCkTDYPSnJjCR86s/hX:zGYDUfYCkQKn4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554714, "uuid": "9dd8a3a4-f1a7-4dc2-a1a1-42179d910f13", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554714, "uuid": "53bfde87-7b1b-464f-8269-1d67586a4984", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554714, "uuid": "47d1d427-dda7-42c8-8340-517dc2191a50", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c919eb-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539905, "uuid": "5637cb7f-b684-4923-bd20-8d90d1aa65d3", "comment": "Malware payload (Mirai)", "value": "aca909727d06644e3ca002a673b00978", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539905, "uuid": "53936e42-f147-4bda-813e-d889cb205a4d", "comment": "Malware payload (Mirai)", "value": "d2647d1715214be23e0bb27d8b19801478c7eccea7efd8be7051ef18ec9e48c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539905, "uuid": "76313a96-5e33-4e13-8f9e-0385271ad15b", "comment": "Malware payload (Mirai)", "value": "191466c1614cdd730a8ae99d311c01a9273cf16d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539905, "uuid": "8c51d903-b85a-4c56-b1ea-1fdba40506ce", "comment": "Malware payload (Mirai)", "value": "201c45ab8fe41ae9163872c9fe0c2730326f6b7100b4478691ebfe816c88576f82d12fe1670090917c9135d83d39a4e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539905, "uuid": "f0fd2f02-9092-4a94-91a9-8bdfb33027b7", "value": "T166B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539905, "uuid": "b320c23c-b1e2-474c-94e1-b53133abc4fd", "value": "3072:Wd5b7djS5HECBQ1XezRRhFcDcmFhhcqpUt:Wdh7djS5ECvz4DcmFhut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539905, "uuid": "f12ccd54-3ba0-4c37-a9b2-8d0179fa7d86", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539905, "uuid": "3c534818-aadb-43fc-8e6d-bb284bec0b2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539905, "uuid": "3827c50e-9c4c-4aba-8748-03da244c2bb7", "value": "windy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36421ae-3261-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775553062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553062, "uuid": "fc70e6af-3ed3-4f99-9716-884a0d718a86", "comment": "Malware payload", "value": "e83b901def75914df9207434233e161a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553062, "uuid": "0cf9abea-0ff8-42bf-be4c-e98f21b24087", "comment": "Malware payload", "value": "d3c1ac6bb66b1abb7555bb3312002420744668089470bc4aee31fe151a2a63cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553062, "uuid": "84fdd7c3-431e-44df-9626-f7cb1f83d0fe", "comment": "Malware payload", "value": "7e34c0382d96f7f8525c6d25793496b860df3039", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553062, "uuid": "35f2c38b-a326-4dbb-a468-52c2043a63e0", "comment": "Malware payload", "value": "62df417079abb9bcd95395f558f5d8ba1508b5e02eda0cb2660dc2d17050f760d81f0b09c5de42bfa3e1a7a947a4a216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553062, "uuid": "b2e3fb04-8d52-44c4-b803-af218b146862", "value": "T16CF57CCBB1AA52A9D4B3C13886A7D55BE6727C02CF2096DF125CB3085A736F05D3B358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553062, "uuid": "cf7e48ec-2510-442f-a4c3-862dde241b1f", "value": "f52ca80f0cc32392621db9fffb0dc638", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553062, "uuid": "f55573e6-7bc3-41d1-885e-67c1c953d862", "value": "49152:lubkqh8nmTVDPiNURiLDcn/d6DpwdWst0Tu/+QP2frxJsv6tWKFdu9CJPTvG7UmP:J2YU8fh9PQklJsv6tWKFdu9CJi4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553062, "uuid": "a8eff094-a159-41f7-b0ae-34f6a5b5e3bf", "value": 3639808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553062, "uuid": "44f267bf-16aa-4a01-ac4d-8fb9d74b7803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553062, "uuid": "5c71c4cf-5938-4cd0-9299-62ea57b83368", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u89c4\u4e71\u7eaa\u4eba\u5458\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aed6385-327b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775563947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563947, "uuid": "688449bb-3618-4c5e-965f-3cce8b4134ac", "comment": "Malware payload", "value": "4a1ef000aa5350e59936954d9de984a3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563947, "uuid": "f803e8c5-30e7-47ba-838d-bff97fdd7bb8", "comment": "Malware payload", "value": "d4db8f839529eeeeffb231c5651572c54b94779b8b0a626a67c66a1b9096db6b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563947, "uuid": "5569bd57-b0b2-49ce-b5a9-d75c1a0ef4d2", "comment": "Malware payload", "value": "7a50de56aac4fe7fb5efa884a3d76e90eac84847", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563947, "uuid": "3c7707a6-8e9c-4c03-82ad-30ab79b528ac", "comment": "Malware payload", "value": "0e592e4532110fb489f669e849f82c74931ce018e982e5dedc00f6835c270142551afb88e54e845147b691bfa9128719", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563947, "uuid": "8303d0aa-c92f-4d87-b58c-7e4110e37058", "value": "T1A9E3F11ACD882FA4CBA9591840FE06D953ED4BDEA9216ECA97377C42EFF780440D32D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563947, "uuid": "a696eec3-4f31-4a4c-b328-e49ff761a733", "value": "3072:Etnoeu77iMdDf4Xw9+ZUaQ+Sf1bvqklW+42pagy/3y+GAZ6H9VIsip8G4jtNa:CnC6yj4Xa4m1+kYj2paDymZ2gpn42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563947, "uuid": "a5bbf60b-571c-43a7-8cbb-10da0279380a", "value": 151595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563947, "uuid": "dae618ca-0c14-484d-9674-62f4d9da90dd", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563947, "uuid": "d5df0b7d-10be-477d-bd58-d467a946439c", "value": "RFQ-Hamilton project EKTC-2025-0268.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01d7157-324d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775544440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544440, "uuid": "1f2e0987-95f9-4f43-be9b-e34e267a90c9", "comment": "Malware payload (Formbook)", "value": "4d5e97e5edceca8c0d51e711d3dfc64c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-bodyritualz-com", "colour": "#207308", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544440, "uuid": "8ffa38ac-475f-497a-8282-5b63878e0376", "comment": "Malware payload (Formbook)", "value": "d59186e4e3aedd78c10d75f069b1babfea7a88beeec236a52cd6df30c2d9a381", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-bodyritualz-com", "colour": "#207308", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544440, "uuid": "b4ad0250-200a-492e-b6fd-a319fe1d2eef", "comment": "Malware payload (Formbook)", "value": "9b638935d7dfb37f94cf88cf9e915db271c7e08b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-bodyritualz-com", "colour": "#207308", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544440, "uuid": "9928271e-51c5-4726-9c1e-c3c1c7747d1f", "comment": "Malware payload (Formbook)", "value": "09146bf56461b34cb30a54d4d2836b45b45836d6f481e0b58b0aa2c66af26dee0771ddb1f8dd8f570c2d4e51bff3928f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-bodyritualz-com", "colour": "#207308", "exportable": true, "hide_tag": false }, { "name": "www-vextgeas-com", "colour": "#97E0EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544440, "uuid": "79122b1c-b89e-4708-a6c8-d47810706120", "value": "T1446533345BA4BE6E06B8E70584236F249B63034269B9F9CB01E1DDF39B5B7C4D48BD24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544440, "uuid": "71546e90-120f-4df5-8590-b1a14cfcb383", "value": "24576:7EUXuRir0oF38rz99mQLZA0BJP63Xnmz6kgIVVlc1c8jmvXCA19rQ4Bz7Mhzdn:7EDRiYodyzF7Pbgg+nwtjan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775544440, "uuid": "8cd3127a-153b-4762-81f8-a3886b012b6a", "value": 1423902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775544440, "uuid": "0e4e78b0-8541-42c5-89b1-2fb43fee15ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544440, "uuid": "d071b9a2-181c-43d3-81f3-48bf77cbe081", "value": "ps_sU8IWW6cqFtT_1775543815932.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e6d415-3285-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775568315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568315, "uuid": "4f836094-a790-4cd5-9844-9a1d572b633f", "comment": "Malware payload", "value": "f5b59a16b3c63ee01a8276f4d30ba668", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568315, "uuid": "d7f90ac4-7067-4132-a547-abf33adb5104", "comment": "Malware payload", "value": "d5b6c048a278c06e2625c47a3a57f5ce2e4d6d73d830051a84de1768e0445882", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568315, "uuid": "8015e790-6ea4-4a28-bd81-2a670eb73f2b", "comment": "Malware payload", "value": "ca70426fad871e99e6142ace9f83e41c3bacd8a1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775568315, "uuid": "4853a099-1e94-4993-b62f-9802b2118ca1", "comment": "Malware payload", "value": "d802c1a526009654ae110433807bd41757dbc03fee9f49e370f28f1d0d942c6a4769eaa10e2a38e7ce868cf44e67867d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568315, "uuid": "de720508-81ab-443b-9203-e8390b38755c", "value": "T184E533035A068B9EFAF73A71254F8524C9631F7C2C61FFD206AD7701A9BB2917316386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568315, "uuid": "2adc5cdb-23ce-4d5c-b217-3608fe5f1213", "value": "49152:7DVX2EZKP8NGsCKGaQJBp0+p6xgrJ4ZeH1eArgu6o8D5m:7DVdGxKfQJ484ZeVeAMu6o8D5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775568315, "uuid": "714bda25-af3e-4cb6-b385-02f4aa88623b", "value": 3179958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775568315, "uuid": "cd7da2b7-bf3a-4fd2-899b-5ef9ce3f0ce2", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775568315, "uuid": "2d6b7a5c-5a11-4e67-9566-de0342e3c777", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e3cf31-32b3-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775588284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588284, "uuid": "1d8eca2e-c5ad-4e6f-a5c0-93b0e34e4879", "comment": "Malware payload (RustyStealer)", "value": "8152fb6c79279b731a296b83b96dc8cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588284, "uuid": "691fba9b-1928-4c26-9200-3793453eb9b7", "comment": "Malware payload (RustyStealer)", "value": "d5b932857da5f0975c557882c3f5f119210c2591810d8faf152d397298794d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588284, "uuid": "bdb73101-a572-40f5-946a-c751d89c8c96", "comment": "Malware payload (RustyStealer)", "value": "cb290b5790e878f8584a4761c98362a9793e943b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588284, "uuid": "88f081f0-ec62-4a9b-a7a1-e2c4ab01cbfe", "comment": "Malware payload (RustyStealer)", "value": "85d43e5a5446133d38e587680a311aa5ef323b6c205b40f4f551ef3a53bc950b54809c1ac28ecfbba6f39ecbbb319c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588284, "uuid": "4b901e60-7bc8-4635-9861-7012a5099fba", "value": "T1D876BFB03644B8FAF91E82B7D6556DBE13723353574A98CE5070F2C117932A7FE2A848", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588284, "uuid": "b0278d59-298b-47f3-9024-fed306889bea", "value": "0a192a526a03e7affeaec7026a59dd5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588284, "uuid": "1a8b1e8f-b0d9-4da5-aa09-d53858ffd65c", "value": "24576:oBmjWxWFFQ9BtlIB8s8obhbRn01oxBOr4GnslZrgPWFHPxJ2lcqX3N6kQhbTkPxz:oBmjWxuFQ9BD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775588284, "uuid": "bec21a11-3de0-4ac8-817f-f845edee9023", "value": 7175502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775588284, "uuid": "20757bbb-ef0f-48ce-baba-bd96fefabdd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588284, "uuid": "a8c8d5a3-7651-4812-b47d-872340209c79", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f07b6d-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553013, "uuid": "ba00b5ac-d021-46da-b7cc-78271261f3b1", "comment": "Malware payload (Mirai)", "value": "b5e44c280908fb7984c70569775bcd61", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553013, "uuid": "b30dbb7a-9f07-4ed3-816c-59fbee2c5033", "comment": "Malware payload (Mirai)", "value": "d5dfc8abb9353f6c7edd944b39df9a099d79d89d49407bada2a5dd53d87bf472", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553013, "uuid": "ec3a662f-66fb-4b6e-beeb-92b928ccda7e", "comment": "Malware payload (Mirai)", "value": "53314fcacc08767ef77a07396e2b478eb22e05f2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553013, "uuid": "1d20cfa9-2d0b-4732-81a3-7efd6154fc13", "comment": "Malware payload (Mirai)", "value": "5dfc9f283f7f69beccdd92f70eff846c0a1c117fb185d64cdb5059150e1de4835827a3a11f8739f7ce200ee606803996", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553013, "uuid": "dea8f5f9-e8e0-403d-93dc-52bf776a7209", "value": "T1F0C2D0CDE69429C7CBBD99F2A0B603625C59F58533AE0BCD43018CC4E9B95D9B5CA078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553013, "uuid": "c46ff099-f875-476b-972b-7bfb849d62ab", "value": "384:qYVw8FRfIQbuLFAPYSv10tgfta/jMKo5XppSAKGbyxwUXRWGVCz0Nvwjy:3+8FqdLKwS2tu1KoVppSoyxwUBW9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553013, "uuid": "2104e383-cde4-4248-a52c-c74d71ef91e9", "value": 27684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553013, "uuid": "a286e72d-46a7-471f-bb22-18b01167017c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553013, "uuid": "7ff19609-737e-464c-bd8c-10de1b40966a", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010b12f0-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539878, "uuid": "687e2e47-a692-4831-8e4f-8ab2e614740a", "comment": "Malware payload (Mirai)", "value": "677933ecf116879ac70be5dba0568c39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539878, "uuid": "0a4f2ca6-4eae-4319-8e07-b3621e44f9eb", "comment": "Malware payload (Mirai)", "value": "d6cfabe9c8614ce0a338a3bca5859bb396f24a290da768e974c5b8482c6591b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539878, "uuid": "e0dd2c0e-ead9-43f1-bd44-ba3756576780", "comment": "Malware payload (Mirai)", "value": "4bd7a13c948a5a7fd6806971a7b0955677b92aef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539878, "uuid": "2ff9c8c6-fc39-453a-bc11-767d6ba7caca", "comment": "Malware payload (Mirai)", "value": "fbea49527166c4c7d6d5a65849dd05d3d7fd15f7e1e2715f27c9ad43879186c9c3d26c4b83cddfae3915c1ecd675eede", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539878, "uuid": "2c48ceea-5dc6-4393-8e94-296949bc1294", "value": "T19C23F1C63DD8C600E33467E18E6D23BBBB630D7A177498A781D89C105C48AF6FE9495E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539878, "uuid": "e96f87fe-ac0f-4ccc-983d-f8a08c8d5b73", "value": "768:NbaliXehzf6LAX5FtFJaws1lBg4GG9BOIamOchkmzpU4DrDUkaVh4ilYGdQrtjC5:Nbu2+kwLFHaDZXN5OchkmzpUaEh4iWtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539878, "uuid": "b93aab8f-d2b3-4760-9ee9-e90f3a9f9346", "value": 48352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539878, "uuid": "5da67f26-4d48-4e47-9d8b-1b84dbbb599f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539878, "uuid": "dafe3b18-4f68-4a5a-aafe-e5ab753487b0", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ff0f62-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554707, "uuid": "2d619b07-d31d-48d6-8840-cc94d3e2ac79", "comment": "Malware payload (Mirai)", "value": "204b8e4526fd32c6599fc8bb11ce0764", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554707, "uuid": "af80b690-0b1e-4021-a50c-746891233f6c", "comment": "Malware payload (Mirai)", "value": "d6e7397ed255689006f48918b79efa661af40641acccb70b5b207e8245d2ea8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554707, "uuid": "f47dd9d1-9924-49d7-ab11-143409411bec", "comment": "Malware payload (Mirai)", "value": "585f79d47ae438f0a0b0a4957ace4ebc672a90a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554707, "uuid": "87e16560-e84c-472e-b17c-5a074d85c6b0", "comment": "Malware payload (Mirai)", "value": "48c6f94a475711d5523bbef333614ce68da3fb0b8304b08445f33da397b2135f023492883742c96b54e03fb736327921", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554707, "uuid": "78fc4e0a-40f1-4332-b226-7e653dda4c62", "value": "T173831895B8814B12D5D512BEFA1E118E3323177CE3DE73129E206F24778B96B0E7B612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554707, "uuid": "edff2940-b373-415b-bf21-ec834776c00e", "value": "1536:ijnJbiILiU66imPkDIPsSDvauDVhQ/MYi60PmzysO7NA52Y0s/hG:aHLUk4IkSDvau+0PmzysOBAY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554707, "uuid": "37b2357c-c5cc-42d9-b686-e4ab780c514c", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554707, "uuid": "ee459d00-b186-4fd3-a94d-d7756c01917d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554707, "uuid": "34d11572-8bc1-467d-9235-6003cde898dd", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031d5419-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539882, "uuid": "794a0057-28cb-47fc-9591-d70d0345ab81", "comment": "Malware payload (Mirai)", "value": "15d2b94783c631fab53cc4833250e962", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539882, "uuid": "46a2b4d2-e001-40f3-8e01-2a4b4892ae9b", "comment": "Malware payload (Mirai)", "value": "d78c0d7586c249e915dd01c1c9f3636d7318f16c66e650ce53b3e86286947770", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539882, "uuid": "d3746c19-26d2-4a69-88d3-d33d4a2751b4", "comment": "Malware payload (Mirai)", "value": "22fc638a4ac7434fc2b36e83d46463e36b3def8e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539882, "uuid": "ad340611-0af1-453c-a69c-4206869f5ffa", "comment": "Malware payload (Mirai)", "value": "c20f6eb3e8fe7f13e1d141ac2d751bc5f650931496a8b4a2bfa4a592cec2aa6fe5e715e1fc069a3ead7ff64e0bb0d3ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539882, "uuid": "802708a0-1794-4ffc-906a-663a83bff78e", "value": "T1EC03E0256D51680DD6DC277F848BC85F9C8CAC605F4EA7CE19C846E488F42FCE8B8B94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539882, "uuid": "aa53a024-5453-432c-9b51-4602b310c118", "value": "768:zVK6Rwy3Tpi6WJGlYfszbjBkSdUvqHPkW57iknqKeWaTTIJ:zA6qy3kRJgzbjtHcWDxeVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539882, "uuid": "4c43bd8a-85cc-4831-8ee2-d8a0f709e6f8", "value": 40452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539882, "uuid": "ad1ba8ca-8469-4e3a-9593-1cd7a11aa2c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539882, "uuid": "589ef01f-4e4d-4111-b2dd-ec475c408f88", "value": "windy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73803fc7-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554244, "uuid": "668cbfc6-9631-44b9-8958-084539be57b5", "comment": "Malware payload (Mirai)", "value": "86adc929587518ad2309adc945746a0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554244, "uuid": "2425c3d1-45bc-4af3-bed7-124a5d5bbabe", "comment": "Malware payload (Mirai)", "value": "d80257bcccbe13784aa2337662cd4dfa48941d71c005c2c99daf795ce92e316f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554244, "uuid": "fd053038-dec2-4a49-89fe-8dd5c115e492", "comment": "Malware payload (Mirai)", "value": "2c8ea7098cf9217223693fe9be9b3005de867b14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554244, "uuid": "da307243-0abf-4a82-a370-4a2d64a535c6", "comment": "Malware payload (Mirai)", "value": "53f0b3365588838f53491c0f167f35db30cad1f25eb9d52ebc447d32f6ccc0de417b08793e3febfc93abb563855e42b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554244, "uuid": "f5d7c6e2-8e60-4e12-84eb-d4db15c28f7f", "value": "T10B733A57BA4180FEC499C03843BEBA36D87274FE1379729A13D4FE366D46E601E29C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554244, "uuid": "c7b97da8-f0c1-48e2-aec7-9f3580438ca8", "value": "1536:BzIDxEwvZ8bouGctIb/+w4HnC+8l8AnzcUk:BUxEyZCXtIf4HT8l8AzcUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554244, "uuid": "9086d964-97a4-492b-b62a-0706ccd8e8f2", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554244, "uuid": "eba8b151-1b71-482a-86d8-c47dab3eb4af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554244, "uuid": "3519018f-fd0a-47d0-a63b-52de0da97f55", "value": "Space.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee4e287-32a7-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1775583227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775583227, "uuid": "468af515-26c4-4dd6-93f7-b07af2cd21dc", "comment": "Malware payload (CoinMiner)", "value": "34259af31f30946064d64041a484b7cf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775583227, "uuid": "d281e827-1061-456d-85cb-13055f7cd7a7", "comment": "Malware payload (CoinMiner)", "value": "d8ad5913c21ac5f5101576b3506b2bfa3ce12ccd71dd7f7aed516653a8421ad3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775583227, "uuid": "e793bd3d-eb3a-4a11-8ed4-243e0bd79d13", "comment": "Malware payload (CoinMiner)", "value": "b3cde310f6629dd5815a1b4d862b2785010880fa", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775583227, "uuid": "9bbaa818-7e9d-4523-9005-6b783f730429", "comment": "Malware payload (CoinMiner)", "value": "743829d4d28c725efa60a945ef7725a1094cdb0d95a09ae7beb2077942d9cc1eaa264875a5e00ec9aef50bfbed411b7d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775583227, "uuid": "3bf630a9-adeb-4b75-91da-b037fd9f8cee", "value": "T13632292A7E480232EBB088F90479524B957C16736B87B3DFF77396590BE52458081FEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775583227, "uuid": "2df20917-e7c0-4bd7-b566-5aeaf43e721c", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775583227, "uuid": "8b357b8c-43ef-4916-b3a5-0bc08ab08e09", "value": "192:zoL2wl4mhBD6VxAhRYumqS4dPFJxTEZmFhruc:zoHS26V2hoT4dPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775583227, "uuid": "9fad4f38-21c8-422b-9b6e-e51b604b508f", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775583227, "uuid": "d12e4831-89cd-4401-8fa4-274f483673eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775583227, "uuid": "2e76283a-2ba0-4bb3-a46c-347aaec218e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d75395-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561925, "uuid": "d213b94f-0edf-45d2-a638-e07b2f19a31c", "comment": "Malware payload (Mirai)", "value": "84da5f3d82767b09ffaa1d8e766c7674", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561925, "uuid": "3cfd7199-4c99-4d1d-9570-90fda058df24", "comment": "Malware payload (Mirai)", "value": "d9fa6abd4a0b6a66f825cebfea64f3f6c97d4154044987c0c30cfadf1d051802", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561925, "uuid": "30eab72b-69d5-4410-9f1c-e0fa779ff859", "comment": "Malware payload (Mirai)", "value": "6191531f551885cbc5bfe66b0235607126d4fade", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561925, "uuid": "0e242ff2-503c-4644-af7f-8f40e9cc332d", "comment": "Malware payload (Mirai)", "value": "6296c65de3adfcbfb6c6efd0956b37eab43618a391093025f06352c901c7023f506eb8e4291feb28414f3e8850299c9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561925, "uuid": "94b8e562-17a6-41bc-bf00-023ada29f1f5", "value": "T158E32907BAC1CDFFC496D1F04BEBA5369A61F82D1935719B7794BEB11A0CDA02A1C720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561925, "uuid": "4a5cc4c3-1e3b-4aa4-b7f1-5ed61b34b800", "value": "3072:rkmFKcg0vD+OH9pYmNuL1xV2e20IfkY0jgIrlovT+p8E841n:YmFKh48386BrcV41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561925, "uuid": "e6eeff14-2860-4013-bc88-5c04532d9482", "value": 156800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561925, "uuid": "0f2b4aae-3026-4b70-a49d-1f82dc616ba6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561925, "uuid": "42a77504-ad6e-407e-ae1e-2f21ce9ce6dd", "value": "nx86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f204a064-3270-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775559610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775559610, "uuid": "a3c3183d-e382-4c45-b2f0-d27c0e91a864", "comment": "Malware payload (AsyncRAT)", "value": "6864f4e6ddd1a510bfc36a187c5cfa3c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775559610, "uuid": "98888dc4-8b43-4cf0-92e9-a3b61575b8eb", "comment": "Malware payload (AsyncRAT)", "value": "da315d9c9c5c31c1cbfdcdbe673b94f236ad46afb6261ee7b22fea878b97a4e5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775559610, "uuid": "9ae9202e-484b-4786-a22f-300556f4c31a", "comment": "Malware payload (AsyncRAT)", "value": "e5b8ab52aa8905489f9ccaebcf2cc3589d682829", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775559610, "uuid": "bc683f1b-3440-49f4-9784-5b4d8119e0cc", "comment": "Malware payload (AsyncRAT)", "value": "00b167b38075211c08ecfc81740e915bc2250ff4ecece417d8be3dc41d8c5e480b549828c2e92b687fd77c58479ff91b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775559610, "uuid": "426ce631-ed11-4a41-86e0-915226365855", "value": "T19AF41268275DCC02EDEA03384575E7B513759DDCEC12C21A8EEEBCEB7869B1539081A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775559610, "uuid": "98a94dce-d9cc-497e-a8f4-1c5702dade1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775559610, "uuid": "7f387bc0-3959-414c-b03a-1d991672d47c", "value": "12288:yYYDG18+DbFdr9/OLLKZpNt5R+lQBKybDtaGqTxjN8yZC8Y0jjg0PUSw107fzuQ:yYYDG18+v9JnNtBNaGoumjW0PU0fK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775559610, "uuid": "7e5ddedc-49cc-4d41-9bda-4b394dde352b", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775559610, "uuid": "15fa151e-4528-4764-9890-309d158a5290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775559610, "uuid": "ee1ede73-f21a-45c4-af74-b54917f929c3", "value": "z16PO_MARC_26O38965.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665199ab-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554651, "uuid": "8ff3b06d-36cc-4d0b-8ca4-ca3e7e3c59d0", "comment": "Malware payload (Mirai)", "value": "fd329d186aa79e47455113c99fbf4f00", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554651, "uuid": "e75c9448-6e98-4eea-82b9-c9fc881eab31", "comment": "Malware payload (Mirai)", "value": "db54a6b0df51bdc18e43dfc91b8600625415592ddf88d54c2455f1c3934c2f5c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554651, "uuid": "3c6e676f-6415-4116-968f-7f5c2e70f672", "comment": "Malware payload (Mirai)", "value": "ac2d87f88bd01bf28c46a1d7153160744fa0da5f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554651, "uuid": "7bc61ca4-332d-44a2-be71-0dd22be7b744", "comment": "Malware payload (Mirai)", "value": "d985c1b1cc433bf4ea08db108f41d316de74911ae3358609fde1a490fa61266a74781106fe54ff858133d258bdf1a866", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554651, "uuid": "7d036508-2323-49db-9afd-c2dcc0ef84a3", "value": "T1C8F2F141B5910D28F32245B2DDD4E987BBD7077830AA63A92E52B33CF4580CB5AB8FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554651, "uuid": "92d7a780-9090-4e7b-a1a5-e021ca0f3f74", "value": "768:KkbNfB2uZnay/Hl8YZ89Fe2sL9BfMXPYqdRC7Is3Uozd:Kkbf2/OHRiE2sL9Bk/buzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554651, "uuid": "e94d8075-25fa-41eb-b174-7452993211e6", "value": 35584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554651, "uuid": "f96703c7-5e93-4218-83cb-05b90118f16e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554651, "uuid": "e3933a36-be3c-4732-8ca2-f24b8e7a50a3", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561471c1-32a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775580394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775580394, "uuid": "d2f9cee7-bebb-4d5c-95a5-67d3122fdb32", "comment": "Malware payload (Mirai)", "value": "e530450cba3e3fd2d98ea43ff2fb816f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775580394, "uuid": "f7d7360e-ec87-4c82-94eb-9753aa100722", "comment": "Malware payload (Mirai)", "value": "db736f860ddb6d31f48b0c9d279e821b3c7dff3e9d529500e464a490217410c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775580394, "uuid": "d84faee6-5fc2-4ac4-9faa-14fbfad40c73", "comment": "Malware payload (Mirai)", "value": "79410cae288d5e3e8c9c00223b6987bb051dd3f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775580394, "uuid": "3e4e0be8-a099-4f66-94a4-e0f76f6af828", "comment": "Malware payload (Mirai)", "value": "77719f453660a40eb1d8d03d6720abcd051770432bde9e6de184a151b35bd803ec5c46a46e10093ac010838bf78c4690", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775580394, "uuid": "93e7e609-56b5-4790-982c-069dc8900b28", "value": "T1CAA31AA7F900DE7BF01BE7B7449309097A30FB750E536EB2762678969A391D41832F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775580394, "uuid": "b44a4a92-54e7-4807-a06b-571975889d53", "value": "3072:roeo+z7FPmsZWBQ8vZlOF3yd7MV6VEo079sIKdj4eG:iHb7eydwVzFsZj4eG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775580394, "uuid": "df9e1315-522b-4cdb-8e27-f5b579317c34", "value": 103924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775580394, "uuid": "3c82cda3-45fa-4fe6-8af7-dfa14c12607b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775580394, "uuid": "21966492-704b-46a4-8c19-4cbc4a4c03ab", "value": "zyre.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3233fd-3235-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775534074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775534074, "uuid": "984f04ac-3f6b-433a-82c8-f586a42e07e4", "comment": "Malware payload (Mirai)", "value": "a2154af77f5af3fcbe41d217aa59d382", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775534074, "uuid": "8d6fd505-1f4e-4cff-b30e-36721ef5f1b5", "comment": "Malware payload (Mirai)", "value": "db7a5fabfbcd71a90fe9df11e59c7c0bca398947fe5147790f08eaec425d5126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775534074, "uuid": "2e03b023-c9e5-468f-9f7e-cc4edaa57261", "comment": "Malware payload (Mirai)", "value": "b0395becd58082de6766db5c377624dbe9cfcf76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775534074, "uuid": "163bcb59-c7f4-49c2-9008-0900f4f3f5b5", "comment": "Malware payload (Mirai)", "value": "d2b6d38e9df00cb96b9da7cf0d9412e95ff05e65f5be22733e4bbb8f7a3d03e1fe7399317557b8e6093d72db7a69c59e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775534074, "uuid": "7e93500f-8f1c-49a7-a8a9-8d4ad5c84cb7", "value": "T14323088ABC82C61AC6E062B76F2FD299335243F4D29B3267CC598B35675754B0E37B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775534074, "uuid": "0f34006c-9bdb-4013-a0f6-0615aa5321c0", "value": "768:e/fbkKgwsQ7CdeIzb+H+I+y8e6PiFNHWPkkSWUhA+9+1+R+2+q+p+9+V+q+W+y+8:eHgKNpeLt1mTsUIh9Qs09BV6B4ijo1RS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775534074, "uuid": "ff06740a-7a25-47c5-8256-cb2ae297fec4", "value": 47508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775534074, "uuid": "5b7f58bd-b4df-4b0b-a5c7-efaab75b234a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775534074, "uuid": "3b8ebd9a-2f54-4d0b-8bae-89520acb882c", "value": "zyre.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5321f187-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554189, "uuid": "3a04bb34-59d1-4777-aab8-8e6a21ca0b06", "comment": "Malware payload (Mirai)", "value": "ad8d3366cd6e486c85536b6b849ca48d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554189, "uuid": "536ec63b-79cb-4f6c-b686-e68fd5573f4d", "comment": "Malware payload (Mirai)", "value": "dbe5acce3d90d025a7a4e08902065b3501be5c9f37bcdf2b6e439f4f290ed6a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554189, "uuid": "69d64ff4-0a42-499c-9e51-0babd1f95e0f", "comment": "Malware payload (Mirai)", "value": "9bf45d8d053c6e8655eda23859d2b6acf63d7fd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554189, "uuid": "a6bbb55a-15c2-4a59-b961-41c26e0d6c81", "comment": "Malware payload (Mirai)", "value": "5881a151089820265b0256a539df16e4311d3de230c6d74015c23579971bc77fbc4bff50c9e8788db5948de8d2999d91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554189, "uuid": "944dd049-6911-487e-a4fc-bae8f6d49207", "value": "T1C213199AFCC24A3FC1C01379A6AE5A4D3721E3E5D2CB7607CE545B3536C660E1D6AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554189, "uuid": "c108b495-6a60-4f43-a2c1-dced8b35aa27", "value": "768:XG2/l2Geuo2SdeQxZE2hgoG3U6ZQ+PVgOJ4MmJdtBNCwCoOM:X3JuMQxm2htqzVgOjGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554189, "uuid": "60337879-0b39-48f1-8c4e-e9c7af2a0eae", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554189, "uuid": "e68a0e2e-aba2-4452-be8e-8685b5929d51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554189, "uuid": "9cd59778-dabb-4294-9ab0-3c8c9f404278", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77be04b2-32c0-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775593764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775593764, "uuid": "35552401-defb-4391-afc0-1b3521c53910", "comment": "Malware payload (ConnectWise)", "value": "c5b73a5d430c028be670c3dc288bdfa4", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775593764, "uuid": "9f57facd-d1d7-4275-a0ba-dfbba7064c5b", "comment": "Malware payload (ConnectWise)", "value": "dcb9e9760084d3c15061f6bdd17ff63b4166fca1e310254a12cc4db0a0894e57", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775593764, "uuid": "62ee2484-ad43-4bee-abe5-e4e7de388ec9", "comment": "Malware payload (ConnectWise)", "value": "15b5fda5fc8a748dc4f9bef565b15c7a34d1ed2d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775593764, "uuid": "0a2056ed-8835-4f76-b9f3-cde09d75398a", "comment": "Malware payload (ConnectWise)", "value": "3aacc37b42ae83c21dc7d3b193cf96a2a42c04d159bf988e09209b016b8197cb7fcf669e5f536c3a00d993e28f1c6d88", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775593764, "uuid": "0b00ee13-a2bf-4340-ab73-d1d6d3bc1bc4", "value": "T13DD61211B3E595F6D0BF1678E87992655632FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775593764, "uuid": "9f8dcf15-4649-45f0-8367-a79ec31ff287", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775593764, "uuid": "14665426-b73d-40be-a8cf-b4f5a50001ab", "value": "393216:UCXvI5MvHxBJkCXvI5MvHx6CXvI5MvHxnCXvI5MvHxN:UZ6HxwZ6Hx6Z6HxnZ6HxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775593764, "uuid": "0a1592bd-83c0-4b5b-8070-f7b0a90dde79", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775593764, "uuid": "a5ac33f1-4813-4242-881d-119e29ceb09a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775593764, "uuid": "577e67d0-a612-4900-a4b9-75d1d3a40d14", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbb4826-3242-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539869, "uuid": "ffa906ad-41bc-4f4d-93bd-05f7808009d1", "comment": "Malware payload (Mirai)", "value": "1f34ac77c25bc7d36cc1e0ecde00c17f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539869, "uuid": "be1b0346-d557-4d0f-aff3-f115cc9323ad", "comment": "Malware payload (Mirai)", "value": "dccb78ecfde0c12a10f1593fde4766ef7585759b5f02ec1419f2c2d094610e16", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539869, "uuid": "3c612c7d-ea38-4394-b57b-6a90cbc3ddcf", "comment": "Malware payload (Mirai)", "value": "7a160a0e9fc28859bf1667306d288a29a73c66c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539869, "uuid": "c94ee588-d20a-4cf7-a8dd-92241998575f", "comment": "Malware payload (Mirai)", "value": "d845301daa00790515c3c459a5ee37fef0e25e1c5a85076054f6de720e1e3cd3aba3649f3830c4498cbf9bb79818d568", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539869, "uuid": "60ea2286-285b-4005-a564-d4e19eba49ce", "value": "T1AFC2F10E97207105E3E40EF1A49BD46D9B53FE2986D5CA5BB4C0336C891FCE7256DC06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539869, "uuid": "20115949-f5be-41d6-a2ad-681a2b03dfc8", "value": "384:bx/dqnt9KQm2pefVZK512ISY3fpTZPwOGOJBqvQqrga+9UMehIEAhEwpqhTp/ft/:hIt9Vs9ZKPFS6p+OGWBc0Hq3RCqdRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539869, "uuid": "d1ad3679-a764-4899-a550-926e7d9de685", "value": 27100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539869, "uuid": "c74cc6a8-2628-4442-93c8-073940b29955", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539869, "uuid": "2d0d6c19-dea4-444e-af8f-0ddf8ec0e724", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d71012-327a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1775563621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563621, "uuid": "0cfa652d-8d05-474e-99f0-291db3b5fea7", "comment": "Malware payload (GuLoader)", "value": "6b2f3efcd3d414752a53aa1d0386b62d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563621, "uuid": "23c8a080-eb86-4035-9470-456455f84c41", "comment": "Malware payload (GuLoader)", "value": "dcdffd85c4610e6701a6e6d06649066dee7671026d4ea8578da7d26cb2439b64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563621, "uuid": "8b51bf1b-fe81-4f5f-b23d-078b75c0c456", "comment": "Malware payload (GuLoader)", "value": "60c9c8eee0c3a6a7e06e24efabce4328f3a5e920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563621, "uuid": "59f42764-32af-47f3-aaa1-2e94de74bdd0", "comment": "Malware payload (GuLoader)", "value": "d0828001d3f65d60d95901d71c72b7c89347cbf84cd5f5522bd1d8f4996652d97b6344a6fd3f80f26c00bdaf7d27e3e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563621, "uuid": "04a5bf66-7a58-4c7f-9b96-b619a43fb747", "value": "T171A4AD437D44F736CB9202F06A2DAC911672BDB1786FA5CEE3C13ADB96B1E8114392C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563621, "uuid": "7a0999b4-cab2-4a65-b0a9-17479f74c3f6", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563621, "uuid": "94f0c3b5-8e1d-4629-9cf2-52477cbf2782", "value": "6144:XR+xXQQwnYELpYJ7HAXy0ds6xHGyMI0Y2ofGcJHEp1Cpvv8R:BswnbL+J7HFCx0I0Y3GcJkOmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563621, "uuid": "7d69cf87-af33-4797-b058-c171916f74a2", "value": 456040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563621, "uuid": "a89dfc51-d05e-408a-a445-fc01e11ea6a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563621, "uuid": "24853d5b-6b18-48dc-9908-3c09eac2b21a", "value": "0009283Invoice0704202611022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29682aa-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552685, "uuid": "606e9a64-9f57-4d58-ac19-8994ce4ad595", "comment": "Malware payload (Mirai)", "value": "e19b36de9574d2f8b6e391e9cae2e02d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552685, "uuid": "596750f3-a07a-48a6-b807-5681307af980", "comment": "Malware payload (Mirai)", "value": "dd11762d1947cbdfb58f862389fea752f96cdf073fd91e01492b5ff432a4ddf5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552685, "uuid": "f3f86184-eaee-42c0-84c4-7cf026478933", "comment": "Malware payload (Mirai)", "value": "66c44581fb195b9807b49bf45e82e6bcd4ecc7e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552685, "uuid": "32778675-54ea-4ba4-b1f0-686912817c46", "comment": "Malware payload (Mirai)", "value": "47a6f6fe0a57708d29297a45e8fba7b2debecb1e53292ebd848960eed834989859ab7e164e6208ac4847bd99acb30696", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552685, "uuid": "3529ba54-d19b-4d3c-8382-f197c756ada6", "value": "T18DF2F132CBF82342E374513A49FFADA85352E82FA59A8270E19171364C5DF64613A2F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552685, "uuid": "7d6bd2ba-52ee-43fe-91d0-2c83ad46e30e", "value": "768:oT7+FNO2bFvWM1DuZpMe+hMPEPCLRkLkwHawTJx7fKnbcuyD7UtQRjl:oTAIM/unMBU5FkLkw6M+nouy8tyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552685, "uuid": "6f2ef351-2ea5-4cd0-879b-221c50a4479f", "value": 35264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552685, "uuid": "dcb43dd4-8335-4098-84bf-3d9867a1ed4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552685, "uuid": "6efdb9c8-6e6d-41dc-833a-8dcc02f303c8", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050b88a1-32a3-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1775581117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775581117, "uuid": "487dfdfe-6674-420f-ab9e-09d0af80f03f", "comment": "Malware payload (ACRStealer)", "value": "7ffa27339e0d992caf1fcc07777d9b8f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775581117, "uuid": "4d6edf7e-8835-463b-ac05-daea15586fa8", "comment": "Malware payload (ACRStealer)", "value": "de5691a05fff72c33b1a67cab94f0ce24a712fdf46e71d2cbd47bc76b634f54d", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775581117, "uuid": "584e85dc-5ad5-4b0a-b271-9e40735a34ea", "comment": "Malware payload (ACRStealer)", "value": "ba415fa3403a9f6c6a90629015c18f371104b9a4", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775581117, "uuid": "df0408ba-6b0a-46ef-a2c0-28b77bc727ab", "comment": "Malware payload (ACRStealer)", "value": "f515c9ebba6bb8d94d1a0643393bedd8f71464d3f6e110f03666cb0bdf516366ef7f320123d6f90b3d9be8715cdd14c2", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775581117, "uuid": "c5148753-f28e-4048-93d2-f9132fa072b6", "value": "T100F55B0BEDB98CA9C4E5B274447365077F24B8401B2263E72EE4B3682E737F0A975B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775581117, "uuid": "9d5a3e0f-fcde-4377-b3e8-fb47d7a24dd4", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775581117, "uuid": "8c3fda1d-4629-42c7-a639-1a59872b77b6", "value": "49152:aWgvfjLEs7eJiRxJf5Khi05QUS13njDnjN+QcjE:aRlJX0213Vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775581117, "uuid": "4c9abef0-9c23-46f1-8eca-0fc2b3fc79f0", "value": 3445248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775581117, "uuid": "0800fc66-8e27-449c-8707-07b12ecd5c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775581117, "uuid": "018e37a5-0411-4124-b8fb-4faab843c7a7", "value": "verificationgoogle.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4017c28b-3266-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775555016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555016, "uuid": "524aad87-2207-4492-9fa0-f68a85ec4371", "comment": "Malware payload (Mirai)", "value": "0b99e551a8cffd9860f730180faddbc0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555016, "uuid": "d56f31cc-441a-430f-939a-53f339d8cefa", "comment": "Malware payload (Mirai)", "value": "df9a1f8f9b1382f0f6daf3c42a4b17d456af2fc59faa8aa3d0d47fff85834a49", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555016, "uuid": "6f0e77cb-5f89-476c-b145-bb3f04dde0d8", "comment": "Malware payload (Mirai)", "value": "288caa81eec1abfdbb6d537177065161dbad6a24", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555016, "uuid": "592d53f5-c042-45e1-9c22-05679b284a4b", "comment": "Malware payload (Mirai)", "value": "5f20c0c547ff780a7ecee2d49b6fcf44e65c46275c2cf0749b8b23b7547b91f66d26fc2004a57cfc59f387024783f49c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555016, "uuid": "73ada470-a7f4-4831-969c-c8f96a18b77c", "value": "T1AD143B46AA408F13C4D6277AFBAF424533339B64D3DB730599286FB43B8679E4E72502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555016, "uuid": "d1757a60-c934-4bf3-aa03-c2b21c15aff8", "value": "6144:ZA4V6IO2l5gP3HbHQw4DaAnjKc4VjLrFin6M/9ZsuBwMWDM:ZFV6I+DQw4DaAnjKc4hgz/7FBwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775555016, "uuid": "0254411b-b101-48b9-ade3-3d643c9c3d70", "value": 199179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775555016, "uuid": "f3a42bb9-cb6a-4bae-bd82-4fa47c0b185a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555016, "uuid": "51070ee2-3c22-46e5-aaa9-031f95ed4026", "value": "rebirth.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23952f99-326c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775557546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557546, "uuid": "6b89adcd-b6b9-41c7-bdc2-8b882f6375ad", "comment": "Malware payload (Formbook)", "value": "7c6c99813787ee6b222fd613639eb959", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557546, "uuid": "2518e7bc-0ddd-43f6-84e1-5e255c7c2378", "comment": "Malware payload (Formbook)", "value": "e17e39d20c194119049acc304dcc9d183f6a6fc42026db415f71c6c6eb77a2b0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557546, "uuid": "5020f5be-28a2-4a78-9c83-8ef071d6884c", "comment": "Malware payload (Formbook)", "value": "4919c744d301ee5e415b266a2d6e960c1e6a7027", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557546, "uuid": "172a65ca-589d-4415-8a10-d39c95f72173", "comment": "Malware payload (Formbook)", "value": "d0c59ead7880200c7611139c02f17161bbace9d3e0b37b636eba2a240c6f79bc31ed209067d3dcf43a899c938d4a93e3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557546, "uuid": "307d860a-eb0f-46ad-91c5-77bf10fa36ea", "value": "T10026188023E01CEB4B635F94E275A7C6BDD758F768A9D436F15E4DE2E0B48049B31EA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557546, "uuid": "6a414ad6-4253-4db2-92f4-0c732a8735a3", "value": "98304:eFqPHvfkGyp9CAgwXWjesfq6s3v/QjCv/WiOmYWADYgLF225vzAM7brCGkcuf01C:eFyPfpyT90XI/QjC/TOmNADfJb5MYbr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775557546, "uuid": "95fa2428-957c-4d10-ad24-50e61ec367d7", "value": 4598476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775557546, "uuid": "33e11a34-f67e-4973-97f3-a4404c688413", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557546, "uuid": "8fb8f6bc-9f8e-46b5-99f7-457f3c1f9207", "value": "SCB 3668696365-006YTS76.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696bb9f8-3284-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775567971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567971, "uuid": "e5b7a907-bfef-431d-8c18-23fd46dbf692", "comment": "Malware payload", "value": "6535fe458d552a99e9272f53a1252a96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567971, "uuid": "67b476b6-f205-4f35-b8a9-07cb640f0d64", "comment": "Malware payload", "value": "e202a949d951e60178e0d4730531cacf2258f2435247a0d212f3ebe6500f0926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567971, "uuid": "7b19a19e-1516-4912-aab8-47401044fbcb", "comment": "Malware payload", "value": "40fc55b5a139da42b2ad5ed70151c6d98202d88a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567971, "uuid": "38b1f649-884c-4246-98b2-a3890eeaa0b5", "comment": "Malware payload", "value": "58a0327d5750bdcaa2cf0210b5485dd01b74bb049143e67c2bc94801f1479efe2d6c9b1038c6ad089cff2856c2edde77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567971, "uuid": "db071098-ea91-44c2-bfa1-c5da3df1d71c", "value": "T1ECD5FB12E7E52149F2F25E70DDF56837937679951B2EC98F24C01F4E08F2A805922BEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567971, "uuid": "5dd7bb07-f413-4507-be3c-d3aef6f4296a", "value": "053f233e499dd415931815dccef4f401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567971, "uuid": "d13e7ecc-dd0e-4029-86ac-6c81fac6eaea", "value": "24576:mcqLskPBFHyNzfSOPtx2wWk4INZg6nCm+USv:mcqzHQxPCwWk4INZg6CDdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775567971, "uuid": "90371433-48a5-48f3-a797-c5429c385326", "value": 2816512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775567971, "uuid": "1b0a8e27-63b5-4007-b782-a5e3075a585d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567971, "uuid": "597803a3-09d3-4540-8853-715409cf1fde", "value": "winmm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e43134-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1775553058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553058, "uuid": "2abdbc1e-c699-46cc-b966-521945a3fa2e", "comment": "Malware payload (GuLoader)", "value": "7a90e73fa51e82a7166503181e956259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553058, "uuid": "a8f44611-a035-42a3-943c-e9a488a79561", "comment": "Malware payload (GuLoader)", "value": "e27f6eb02ff9c26f25395dc4e5d91aa0aa8493d753e840d03c6582681a86970b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553058, "uuid": "d1ce6e7b-ea53-4bac-89a2-df818d80aa96", "comment": "Malware payload (GuLoader)", "value": "14e59731718cc7f838e81cf290a2a9e3da99754b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553058, "uuid": "52b6dfd8-6983-4c5e-9119-b75cc5fefcba", "comment": "Malware payload (GuLoader)", "value": "d7bedcf26775fd2a38a6d759957223eb7b3b635eee9f3b28c2bfb65c664f8a25f4a23effcf5b4662afaef8845ff144b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553058, "uuid": "19ae5da4-6a4f-44ae-9526-5eece2cb60d1", "value": "T1A4A40143BB91C6A7D8794732492F87536B71FC965B825B0B3348B31D2DF22921A0B78D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553058, "uuid": "b7ecee84-5c4f-4bfc-bd53-619d62234256", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553058, "uuid": "382cfc51-f357-419c-a3f1-3a8718732ddf", "value": "6144:m5lz/1R2mcE9JHEsXYPuiEhuEStGVuVLQBFc7BNXA4lECkzKyXIdLjxJ:efr9JpX+JEhpSMKkc97kzxYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553058, "uuid": "c66a7448-3bf3-424d-b9c8-22e8699449a1", "value": 488040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553058, "uuid": "5c49d311-3e9a-434e-9407-1ee4ffcfcec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553058, "uuid": "b2bfe48e-f48d-4f58-a5b2-d3337ccbde33", "value": "Red Titan- UPDATED ITINERARY REPORT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c14f13-324c-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775544075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544075, "uuid": "d4bfc546-0fc8-40b5-bda1-71dbd361b973", "comment": "Malware payload (RustyStealer)", "value": "9e9b83292b5d116958e6468abe60377c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544075, "uuid": "88e1ebd6-cd1f-4398-b8ca-b876640eefa3", "comment": "Malware payload (RustyStealer)", "value": "e2b87cd6770d52a3e1f26a65e4e36b5b9f3c77787b4b66b54b8000ad7723ce71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544075, "uuid": "d323878b-07c7-4e95-845d-d5f90043579d", "comment": "Malware payload (RustyStealer)", "value": "5858170e76a08e9e0d85ce29f7871e4383e145e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544075, "uuid": "62bf2d76-5d80-4c14-9190-be42092f5b01", "comment": "Malware payload (RustyStealer)", "value": "9771ee1796c819cb7c51d042898facaefb56fa22a6b0b1d0f96e8632127d5a1bc2e60392646f2960b584fe75912441a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544075, "uuid": "725b0340-2b61-4d62-a869-9a9de888e602", "value": "T144266B83F1A791ECC06AC074935A7633FB32784947246AF797D48B202E65BD06F39B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544075, "uuid": "0334a27d-706a-42bf-b878-405ee765bdad", "value": "cfe3d01c52f9580d83697ae80bda9e73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544075, "uuid": "04658c4a-9a76-4401-881b-1514ebd0dd8a", "value": "49152:5XmSdk1Bc8IxkOXEl1bcLUdE4fz6RaVJHcN8TlFJ0zjFzE6FUl/ryDfmUNsxpg3/:ZetE4vZzCxFUl/6NzN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775544075, "uuid": "74144fcb-74ae-44ec-8d37-8ea7839c4b27", "value": 4702208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775544075, "uuid": "eafb3e6d-8a5a-4831-b0b1-2e398aca1dd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544075, "uuid": "f76ce8a5-0776-4fa2-ab6c-f7e57303d2fc", "value": "clearpdf_v1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b4c4f2-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554214, "uuid": "b44096da-01b1-4a9d-8c5d-2fa12bc7d3ed", "comment": "Malware payload (Mirai)", "value": "8ab4a471d0a0bfd73f27db110fd1abc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554214, "uuid": "bd6a717f-3a9d-460d-9018-f4f5ee50786a", "comment": "Malware payload (Mirai)", "value": "e371f78a3f8f4ec991f961aa17a9dfd9f4a5a88447840dee2558fedebd2ca2c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554214, "uuid": "ef26be44-7b69-4158-aeef-fcd9945ae09e", "comment": "Malware payload (Mirai)", "value": "b3d7266de520e646a8a858ec6dd18948e9b7674e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554214, "uuid": "c960eafe-fc12-40d0-aca7-15203ce98064", "comment": "Malware payload (Mirai)", "value": "5fc224a0a253b95b69c2b07425b5811a1a29a0ba6b1c2a3f1cada291f716637916091224b062fa5a52a8271b30c4b0c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554214, "uuid": "174d9d0e-ab3d-4603-ad1f-37876b29ba6b", "value": "T103A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554214, "uuid": "4eab0bc1-d38c-472b-924d-28650d565631", "value": "1536:SpaZOuj/Q30SQXa1r3J62yqPy/RWLW0edmpwj62NYK:5ZzjJa1rZ62yqPy/ULWzj62N9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554214, "uuid": "ecb9ef2a-e26a-4240-b2d3-11a6b47166c4", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554214, "uuid": "96b09b58-2add-40a1-a1fb-5133eea9f3e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554214, "uuid": "16861d1e-d698-4991-8baa-13181e4b5c0a", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf91d815-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552680, "uuid": "d9a13801-ed16-4e12-806c-079ab75f683f", "comment": "Malware payload (Mirai)", "value": "17cb3eee16dcd44b619e6dfcf35223d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552680, "uuid": "c45cdf53-a8bd-4c17-93a6-df227d56a0b1", "comment": "Malware payload (Mirai)", "value": "e3ac1d28259031b2d1a535b6245c65171a44bc5f2fba364c042913572c267a60", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552680, "uuid": "1d297de1-6ec5-418c-9f7c-e948391ed8ec", "comment": "Malware payload (Mirai)", "value": "3c1fcbfd1d72c025ac7068672606c71bb1db0b73", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552680, "uuid": "6a962712-bb08-476d-aaf0-216cbb4d8f13", "comment": "Malware payload (Mirai)", "value": "6e52c35a521ac312274ad4b36112d196e722d49dee26047c46a22455015c021df0b01dd577468e93881495467a44d08e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552680, "uuid": "6a405215-5145-4a67-beb1-a27d699d0851", "value": "T12BF2F1F8E8E09B99FFA566B7EE41D7C0D3DA17BC3206CD954556CA820D08E170A09FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552680, "uuid": "3d7c3a3f-22a9-44b0-af83-5cccead0fbf1", "value": "768:XtuamiJLv9aBu2OF1NRDpQPnJexmoOhlo6X94uVcqgw093:XtuHy0qRRDpQPJeYoOhm6X94u+qgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552680, "uuid": "ae17eb01-3be1-4d29-8624-405a0ff255f6", "value": 36260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552680, "uuid": "b722bd99-9e2c-48cc-ae08-fbbeb43e9be1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552680, "uuid": "96875724-5d6b-480e-91f9-5c69ac5e6b1b", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac909c16-32d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775601584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601584, "uuid": "7ac06fd3-ca37-439e-8e07-268864378202", "comment": "Malware payload (Mirai)", "value": "0d5b432a91e8622499b2bf7f3d8d87e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601584, "uuid": "e31d1640-a001-4452-8ed9-3ae92180523b", "comment": "Malware payload (Mirai)", "value": "e428787b8ef1a9817f5f3629a1ecdd3271c368783153acdcea6ab35aa142f07a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601584, "uuid": "63b115b7-93c7-4a6e-84c4-fcf204ba3f86", "comment": "Malware payload (Mirai)", "value": "8c01386f6c99a41e848ff0a8a14e481ff41446a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601584, "uuid": "02a8cdec-6e61-47a6-ad1e-f9659bc0ed2f", "comment": "Malware payload (Mirai)", "value": "fa1af8412e7453ccf83171d3a0cfeef2fd461f9f0da4d493e397d62b36869d668697108b504b7c4a529b9fb3417be81a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601584, "uuid": "3a4fe3d2-1757-4bce-a61f-f18d2e0d822d", "value": "T1E8932B03BE82C9EEC49AD2B447FB6531DA22FC3A0935729D6BD4BD913A1ADD03D58710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601584, "uuid": "c18d2cec-ab5e-4a4f-b469-bf3ff7ccf5a9", "value": "1536:0BNhh+/hslQfd9YfFrHB+KLn5KOYoHO/t+h05ekv53hFpsRu:0xh+/hZ190Frh+KLY1o2t+h08kRhFpsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775601584, "uuid": "b1c95b50-fa46-4d39-b3a3-cb6b71d639b0", "value": 95328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775601584, "uuid": "f85483ab-876d-4b00-8a07-1d8917d7abc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601584, "uuid": "89c86e46-251e-4d4a-a78b-c68fe23c87ca", "value": "zyre.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906750f8-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553004, "uuid": "3a2803a8-4c1d-460d-8f0f-9a20edb6e1ac", "comment": "Malware payload (Mirai)", "value": "e636957e430dd654f1801c38bbc569c7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553004, "uuid": "2f3e5a2f-fd0c-4a39-92cc-b436a601c90e", "comment": "Malware payload (Mirai)", "value": "e5e8486459e2fac39d09e7ae62dbab06bf5ed30af06e2a139ec3772dad711710", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553004, "uuid": "fc152f54-8848-4150-8e1c-906a92092f05", "comment": "Malware payload (Mirai)", "value": "a7c7d41cfd987556bc9c288828b08c0913087ded", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553004, "uuid": "76478c43-7294-4a9b-a2b9-b0c328a321ca", "comment": "Malware payload (Mirai)", "value": "580b64d5665c7d9781c26b2ec5e560044d4cf45cfd7ae7b187339b89546b452c8f7be58e57d62d52b39a7a4ea735a825", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553004, "uuid": "75d7548d-9a92-427c-a312-5c0573b0c54d", "value": "T16123E132D6AEB424DB305A367D6552C23D6E0FA2B0E6B00F9191D0A8DEC65413F7CA57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553004, "uuid": "da66a997-d2a7-47ed-bf68-966c0b26558e", "value": "768:zZtr9dL5V90Q1kjyorYDkHmPMLbNAy1CJz8Mj/vATE9q3UELvl4CmfLCr+xd32Z:FFFVEv0kHUMn6y1ogMDvWLvlOpT2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553004, "uuid": "158d5224-66ea-4cb9-8eed-49a9b2e0c7a0", "value": 49312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553004, "uuid": "520aa62e-f6fe-42af-b71c-d72101c8d400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553004, "uuid": "4ef48f79-20c6-439c-8291-7253eaeb12df", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1981a1da-325f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775551945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551945, "uuid": "0b47e036-3078-48a7-8460-606e80fba72d", "comment": "Malware payload", "value": "0dab82e05622de1dbe93489d7a910a8d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551945, "uuid": "ab4dffeb-f168-4dda-9c6d-acf43df30020", "comment": "Malware payload", "value": "e63db5b389b212a302c2fda55e04be0f459a089e42f58a09dc981f504ecee098", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551945, "uuid": "762fafe1-b60b-49f0-9406-821633480e50", "comment": "Malware payload", "value": "2a4bf74e251b929de049b5019f02289f9175ce5a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775551945, "uuid": "a9871405-204d-47d8-8fad-3f4e2182d5e2", "comment": "Malware payload", "value": "0f8891407c4047f7368fd1a87e835efc2a8f3aafeccfc3b5b85d683550aff5188aa885d31d91a627ad402f434df6d3cc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551945, "uuid": "ea0bc342-7c5c-445b-905b-5cd4aa6746ae", "value": "T1EE318B1A7803CEDF42B683AB351B00C591D8DE819A9D85C2F110FC9478EAD999687B79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551945, "uuid": "93f5bb6e-2200-41a6-9a1e-d73d238b3eb6", "value": "24:4qhsB1dKL9yqlyqk6Q1lOMIl2u4fYTRQVDzRtWLf4bEwPFVZDEUV:WrsMqQqk68lOJl2LY1QVptQgVPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775551945, "uuid": "6ea0b997-747b-4a02-b116-8d2fa819d75a", "value": 1780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775551945, "uuid": "03268b3c-8b01-49d7-b264-6eea54070990", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775551945, "uuid": "c0703caa-04f3-425c-98fc-44ed975edfcf", "value": "e63db5b389b212a302c2fda55e04be0f459a089e42f58a09dc981f504ecee098.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fad607e-327a-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775563579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563579, "uuid": "7c35afb7-fd5e-4f7c-8679-c22d62f34ba9", "comment": "Malware payload (a310Logger)", "value": "12d9bfd8f2f4ffac1dfe72736c2d1ea6", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563579, "uuid": "5a57d8d1-f6a0-4f79-9c9a-afa2b814ea2d", "comment": "Malware payload (a310Logger)", "value": "e6979f6998630473fa68cebfcead55d05287ac750361e2dbb2fcdad5e20fd1d7", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563579, "uuid": "4778ea84-1540-4ae1-b810-0a287036e343", "comment": "Malware payload (a310Logger)", "value": "15b0c46d704cbbc6057fc097440c84f1bb03469e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563579, "uuid": "01f2e267-7a8c-4068-b625-35a07dc1217f", "comment": "Malware payload (a310Logger)", "value": "2c7446f2516edeff7a2bb93cbf9cae97ecb2dc9b6663ab0b8ce724845bbcb2c8b6ad0a111c6c56db29d8900496802dd5", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563579, "uuid": "e9a3ed25-8718-453c-b3be-a9d70f348657", "value": "T1A9845923EA50A12EF1A3C9F1B9A5A25728263D395A88EC57F3415F5834711E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563579, "uuid": "e930eed0-f1a7-4d80-a0fd-9723bcf8b51d", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563579, "uuid": "17eb8d63-1505-4cec-968e-489f9adb5a2a", "value": "6144:98d1/w5KA81IJ8GpF6nuTmOOUWToQ4NE4EnvFEsvyF6GCyHxxBT7k:GjYKkJj6GmZUWuCv0nCyHxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563579, "uuid": "5d6f7b0e-d58d-4b07-97b7-738967f9b350", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563579, "uuid": "b12392fe-0284-4822-8d18-150074ca8eb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563579, "uuid": "9b7dc4dc-306f-4728-881b-663df2a267d8", "value": "Salary payrol system update form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ce4948-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775562139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562139, "uuid": "27e7c9e1-38c1-4d61-b193-a83370064cb9", "comment": "Malware payload (Mirai)", "value": "fcfbac3cf0541c3ee1666983e8326cdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562139, "uuid": "95246c55-083d-417a-8a30-c4731f9a2410", "comment": "Malware payload (Mirai)", "value": "e69851ee248181295b30144b8ce820b6172db4c9b0df1ceed62d86dd237a086c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562139, "uuid": "bb0a9050-ace2-4677-832e-d5fcb4f3f0d0", "comment": "Malware payload (Mirai)", "value": "88ed062f86da447a80ffe8d3aa5aa469027d2959", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562139, "uuid": "bbdef853-5684-4875-aab8-282df480a170", "comment": "Malware payload (Mirai)", "value": "5cd23874fe9338639c676dddfe2912433553df099ed421c421799db14d5e145725eabc8241810db5de60704f1dea8134", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562139, "uuid": "f7bfcf12-c0ea-42cf-98bb-1537d9371519", "value": "T1CB9483139A254DA6E465CCB3127633416C8F82BB88E636E3E9768960FF2550F41FBDD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562139, "uuid": "b29a3005-f45b-4743-8ac0-160748cad986", "value": "6144:jPtm/9eYQpdYXyKl0vQAizrDktZ+joR2:jPtm/wnYZwizrDAUj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562139, "uuid": "a14c6886-319d-4a24-8461-e32ac8abbd9e", "value": 435620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562139, "uuid": "1b9dd26f-253f-4d83-bf40-81e84f064b38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562139, "uuid": "b7096a62-18d6-4344-9587-186904fbdc6c", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ba7248-324c-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775544050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544050, "uuid": "2cbd2e9f-78fa-4325-8e79-090355435d71", "comment": "Malware payload (RustyStealer)", "value": "6c67df9f7a29a94293c8c65f191b853a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544050, "uuid": "f39d2069-e329-4344-8d14-dde5cccc88be", "comment": "Malware payload (RustyStealer)", "value": "e6a5c6b09bcb8a7afd0360bb50bdaf8defcb75275ff93635fd86f043141d2803", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544050, "uuid": "44291c45-c764-4cd7-bf6c-f34ba23827b8", "comment": "Malware payload (RustyStealer)", "value": "4344ea3f6990e55745293ac857914b7fc3ac80ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544050, "uuid": "4cb2d0c1-d116-45fd-8339-8fbdd833aa26", "comment": "Malware payload (RustyStealer)", "value": "44dd9bd5c1a6fe9df4a5dce6961a1def6779f65362a1e469ebe433cd98c9e7deb8074fbc88557acd345a7de1626c3503", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544050, "uuid": "e9b40e61-4da3-4ff4-b0e6-fb8060370812", "value": "T10B566C87F2A795ECC069C070935A7233F732B84947246AF797D04B213E65BE0AE39719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544050, "uuid": "b14d298e-898a-4a4d-9190-1a6ed99e375e", "value": "42653c734255434cc453e3ffa3eba4f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544050, "uuid": "b7e03ffd-8fb4-439b-9151-5c2e8f76fd3a", "value": "49152:aee4WJaWhFCgRPQXnR+yldaH/XmDO+NHbVQa95TrvmCHkEdO0ArQXx3EMuTAJf8o:mHRPQpDDFNH7O5a3ESfz9LVOIbsAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775544050, "uuid": "e1e1d8f3-de84-46cc-91fc-4b0b2bba2570", "value": 6074880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775544050, "uuid": "45e5deb8-5ee1-4207-bdb8-34373ee26c1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544050, "uuid": "296c4549-0265-4d6e-ac1d-8ff4c373c009", "value": "paperview_v1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0971c1a2-323f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775538174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538174, "uuid": "33901c76-2b86-4b8e-86d8-a1eb66184665", "comment": "Malware payload (Mirai)", "value": "dac145b2b9dd3db1a59858d661366632", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538174, "uuid": "b15db6b8-e354-4043-aa6f-7059a03c3634", "comment": "Malware payload (Mirai)", "value": "e7278fb6844207420430193b758219c2d0506979a4288ed41e9ab3fd04f10351", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538174, "uuid": "0c45fd41-41a1-439c-9da2-e3240228b14f", "comment": "Malware payload (Mirai)", "value": "2b448c63386ddea905a999a8942fa428be7bf95e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775538174, "uuid": "533271e5-de5b-4482-9708-38aa6106808f", "comment": "Malware payload (Mirai)", "value": "c284fe080d05064d2bee6902a68b1121a5a0afe151cea0cd42ba8cfb29ac83e752d24330f097f6923b9ed451e6a7dd5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538174, "uuid": "ccd1c4e8-d3ad-4532-937e-68ed59286c7d", "value": "T11F247C036F854DDBC19F87B999EF97208623F0390716A78FB7A878E53E472C89D45608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538174, "uuid": "fdbf19fa-7dac-4603-bb08-8e1424dbf2ad", "value": "6144:3Hsrku/4mVa6DRvGVJzb45hHVLWZEfAOE:3sw846a6DRKJz85hHVLWZEfAOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775538174, "uuid": "5a1ec830-b2b5-43c0-93ff-1a90c81b35d4", "value": 226431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775538174, "uuid": "57aac068-5134-40f2-8551-50cf3f818e5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775538174, "uuid": "9e249f58-80a9-4d25-be00-a2253cd05486", "value": "zyre.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc26440-329a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775577638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775577638, "uuid": "ddfdee7c-6544-42e5-997a-1b45bb19f220", "comment": "Malware payload (Mirai)", "value": "6ff35892efef96bad1ced535fd4b9c4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775577638, "uuid": "5c1a123d-363e-4893-96d3-d345eb63803f", "comment": "Malware payload (Mirai)", "value": "e7859e4924d3858332138ec262af2308ffacab2133a6b3bcdfa92fcacccaa15b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775577638, "uuid": "8bbbf451-56c9-4b2d-bda3-6b623d71c90d", "comment": "Malware payload (Mirai)", "value": "ebd9f8c5342d3fa516eb3d6bb5e2478ec656ca38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775577638, "uuid": "54135cb0-554a-41c3-be8c-c366d412c7f0", "comment": "Malware payload (Mirai)", "value": "02914239ff4fe6cef6a1bb5abce4ff4f9e145b05783afbdfc4815f5deeae7b45b0ae5d86637ecd2d5cee338495dcc079", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775577638, "uuid": "ee3d4f67-47fd-4c69-839e-25d338630fa4", "value": "T1DC933B26BE324E17C4C2B1B511F30B31F5B6ABAB1C78855A7D622DCD9F142D032677A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775577638, "uuid": "7c639f02-4e1d-4741-a4a8-63098d25fa50", "value": "1536:TWZucnZ1bB1bnRMIRljZoHtNAtuVoD5/tAHK/O:CuiZJH1HjZoNNAMVo9SKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775577638, "uuid": "b8a5e5ec-d455-4291-a572-0902f76a6cdc", "value": 97452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775577638, "uuid": "53e95138-9b60-494c-bbf7-601e7a0e88c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775577638, "uuid": "023e05f4-2470-4c94-87e6-5557f1addcad", "value": "zyre.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26dc5f6-32b3-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775588253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588253, "uuid": "077ded84-4732-435c-a6b2-83b57964fc1f", "comment": "Malware payload (RustyStealer)", "value": "2d3bc02ef5bf84bede7fa0a950a0f431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588253, "uuid": "2e41313f-b216-4f48-b4d1-ae142e30be1f", "comment": "Malware payload (RustyStealer)", "value": "e840f81d512252df08b72a7f17c889ab8e5a241b83f3ca415d0dd7d2b4f1f9aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588253, "uuid": "649089ee-45a5-4e74-b180-76d68db181ea", "comment": "Malware payload (RustyStealer)", "value": "5a6cf2e433f8c6c8f6aff3138f9cdae9343c57a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588253, "uuid": "2bd683bf-0289-4baf-90de-be02f332884e", "comment": "Malware payload (RustyStealer)", "value": "8ae28326c60207b3d5073d4e51d2e3d1015a6e6bd53300ab49e826defba6b17e0b504d1353457e7e3d672bc1cc3407c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588253, "uuid": "8fdce965-f71f-4a90-bca0-1e9ac56e29eb", "value": "T1AB66BFB476147CFB6A6F037AC6967DED13263223439B9CCD6064E6C10A63675FE1B808", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588253, "uuid": "f2a319a2-cba5-4145-8694-65139821827c", "value": "ae3c2ea21d0a1fd83a33d73767c53bbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588253, "uuid": "ef3ddbf9-45f4-4eb5-9c4c-c9a16c13b07b", "value": "24576:eFqqQIYhAxv6sxUv6wad1QhYBs7ueBBU0G3RNN/gNBYE+3+xr1dCnLrIRry1vD3h:2U4nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775588253, "uuid": "09952df5-c3e1-4334-a0dc-7598aa008678", "value": 7042048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775588253, "uuid": "2b788dae-dcfa-4da1-b064-865eaa6c0989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588253, "uuid": "5365a6bd-1301-4686-a871-46ab1559a139", "value": "k3os0eju5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146e53dd-32d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775600899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600899, "uuid": "7ce3a2fa-d351-4f0e-95eb-8bc41c8299cb", "comment": "Malware payload", "value": "80ca7922834f4d56e12c0b27c4091ca6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600899, "uuid": "8e23e28e-d039-4c99-96eb-50a0cf04ad1c", "comment": "Malware payload", "value": "e9cff21e91ce80f33761642ee8dd103de41ba0c185e2b63e10bdee9fb5bbe52f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600899, "uuid": "e6c5729b-b8ff-4f97-a324-1b52135426b1", "comment": "Malware payload", "value": "59caf92326ff5c2e5a4a22da32c234ed29fddf94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600899, "uuid": "356a6f1d-8b68-4232-a7d3-37d0604b8680", "comment": "Malware payload", "value": "3a9b7f1068184469abc8b311eee657566cf2055a7040edb61bf685908ecc4eb04f1d731d36d1a318011788df2f529b0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600899, "uuid": "332c44a1-2bc5-49cc-9d7e-b4685b8d6ded", "value": "T108A30986BD428B13C5D221F7BBAE418C371657B8E2EB3147ED25AFA127464D70E3B610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600899, "uuid": "5af5e8d0-4184-4e86-a148-d7c66b65a235", "value": "1536:ytOf+ksjlyZBd51x0qhNX9FapB483XyREcQ9PVoAO3Zppp5VJh0nGzRSmgbj4z0L:Gf4SN/I94ju0PM50y5LXW6gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775600899, "uuid": "93b956ec-77ca-479a-bcf0-616e61ae22e2", "value": 105052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775600899, "uuid": "669c97c6-32ef-491d-88e3-fe029f7c7173", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600899, "uuid": "6c5beff5-1fb9-4572-8e14-aed17806bc4b", "value": "SecuriteInfo.com.ELF.Downloader-DN.52629546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2f6821-3266-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775555011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555011, "uuid": "30ec90a5-952f-4da6-9c05-13ab41af7711", "comment": "Malware payload (Mirai)", "value": "ec466b9145842291f9edf6caac228f0a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555011, "uuid": "9888d793-6ca3-4fcf-8f04-019612d7e84e", "comment": "Malware payload (Mirai)", "value": "ea200b4963a4a86a9906a90df389467e8db3cd963437fc6b44d5441e381d1519", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555011, "uuid": "67c6cda7-b07a-4a39-a4f4-260996694a9e", "comment": "Malware payload (Mirai)", "value": "3cbb349c3a5f717fc1bdc3cf01101e34982ee585", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555011, "uuid": "9d7d9a33-35a3-4daa-be4d-cbe0286ffc64", "comment": "Malware payload (Mirai)", "value": "9bdc88fa472f08e02db7d2edfff1765101b37b863a2e2fbf109342e00dbc391dcec3dc1c6dd1dccda4caf7ce1f220ab9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555011, "uuid": "ada963bb-6407-4aeb-836e-38536c20c0e6", "value": "T19DF31A45BC918F27CAD622BBFB5E428D332617A8D3EE71029D255F2537CA85B0D37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555011, "uuid": "dbfcbb93-839a-4289-bc8f-dda8e5c205ff", "value": "3072:rVZkrfIxfnYLb0Mwv9LF4HRH/n9TIX67:rjTf40fVLF4xH/ZIXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775555011, "uuid": "36b1b34d-882d-4bbf-bea4-8bb788c1af01", "value": 170752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775555011, "uuid": "665c91f1-dd25-4067-b79e-8b2d246d8ce7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555011, "uuid": "2c43b251-dd26-4856-8dc8-0ba7f21c5b5a", "value": "rebirth.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2129d5-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775562075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562075, "uuid": "759228fa-0760-441e-af0d-9ccb276da1ef", "comment": "Malware payload (Mirai)", "value": "c4abbe5f1166278f13bda7dba183008c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562075, "uuid": "3527d694-ee65-4c3b-ac63-3b614042d3d1", "comment": "Malware payload (Mirai)", "value": "eb1c21239802870fc0a3bd5389d115b2a9f3a8495d847ad0627b0bccad6e260b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562075, "uuid": "3725704f-0dec-4560-9b48-d1662f262da8", "comment": "Malware payload (Mirai)", "value": "0fe420362a8b58a34745a6231f749a53e24693a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562075, "uuid": "7d7d30eb-6b08-4e5e-b696-8e933f907d3d", "comment": "Malware payload (Mirai)", "value": "24301a1369c4db8af1c01b086cbe2c85934a8a0ad7c5a2d7543c43a183d73f7e249a303d12d8a62805e46738209d7087", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562075, "uuid": "6c4ba3cf-dd4d-4942-baf1-1df55f3fe7c0", "value": "T1A1849713EA1584A5D414CCF2137732559C47A3BF88A632D3EF5A4AA1FF2581B42BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562075, "uuid": "e1ea4f47-b514-4038-8af6-ce52638d3b96", "value": "3072:pfV3S4JhV1TloDbEOxRGD1ZRdgyX2r+q27Z2JWfD4BAVXNJpnkT/:RZS4JhV1CEfNXfZVD4BcXdo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562075, "uuid": "cfa84e24-7093-4a47-acd8-525390ce2c81", "value": 400904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562075, "uuid": "01b36b54-82d1-4559-9d8b-00baafa07f01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562075, "uuid": "e1180bd9-37dc-4eb2-a718-57fa67052b28", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37bddd76-3262-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775553284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553284, "uuid": "2fc5b00a-125e-4426-9e3a-5bea08417c9d", "comment": "Malware payload (RemcosRAT)", "value": "98c5bbc63f6f1ce8d619f8a00ad5796b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553284, "uuid": "cc160855-d7a2-471a-9a83-cf3bd449655f", "comment": "Malware payload (RemcosRAT)", "value": "ec597e6597d208829c1162c2b4079f04d5fe9ebf89fafa63fc97f6ffcd139d2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553284, "uuid": "39be07e8-5056-456e-93e4-6f1806aff816", "comment": "Malware payload (RemcosRAT)", "value": "e38448b2d2e0a916a45d74ef541af175a2e75cfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553284, "uuid": "eba520e1-2008-4bd5-adaf-9e117fe3b1bb", "comment": "Malware payload (RemcosRAT)", "value": "4a90145f5e024b3fa21cffc3d9c128329ec09801bc283c8de13535b2a299e0127484f5184e5258a3776ba18edf21900f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553284, "uuid": "f400709a-7dad-4e2f-9c17-993c2458f6c6", "value": "T1346501603A0FE681F89D4F711965F67987263EE9B800D2525ED8BEEB7BF67023415302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553284, "uuid": "2147e323-7a5f-40fe-8d3a-151e7ab421a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553284, "uuid": "74a12c7e-4e30-47ef-a2a1-ad04e177bfc5", "value": "24576:/Ye8+v9hRBQK5E9KhMF/AE8wR2g77azZkEgGpDKJ4e2SXS5c1DenwG4G0:AMvdOTztV77AaEuOe2+2I2x4G0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553284, "uuid": "06fa2d8a-465a-4d5c-a48c-1ad4b5c5a65b", "value": 1449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553284, "uuid": "f7ef295e-bbde-4c7b-8dfd-b31e6130582e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553284, "uuid": "b8d5611d-5acf-4feb-a175-15a0274e1167", "value": "specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d258c9f0-32b3-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775588333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588333, "uuid": "44a55502-f76a-497a-8a70-d88239da71aa", "comment": "Malware payload (RustyStealer)", "value": "cef1228c771ee9a2f4c043aecdbe87b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588333, "uuid": "bc477bc5-ad67-410b-8e20-686b75856e89", "comment": "Malware payload (RustyStealer)", "value": "ed56451bcc22bf64da6699061e8e749a82e6fa678b1108a0ba1049a68b8fd314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588333, "uuid": "99cc3c95-e3bf-456a-92fd-d71a35d42353", "comment": "Malware payload (RustyStealer)", "value": "5aa361ffe401c85557475e87cc0d246e73581288", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588333, "uuid": "1d7c8995-0789-4fde-bc75-060f176c1b77", "comment": "Malware payload (RustyStealer)", "value": "86dd33e81e2b8464420f81180c5c20f68b5a16a9df18b6c7f729e4b8b744cdb85b9dd39f46e7d82dbb91cfe8b1e4791e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588333, "uuid": "0826f172-ffee-4990-b183-c61882aa8a2c", "value": "T1DAC501CB91A97AD6EB2D5BF58D5CF13F887B90359A904ECD02E484BC2379634B702247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588333, "uuid": "df2fff98-a3d6-4a7b-9ec8-aeabf8c205cf", "value": "eb3d37cae5b55ff788a6ad9ecd9d46f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588333, "uuid": "29ae6ec4-ddfe-4eab-b819-a7dc83e724c8", "value": "49152:mDoA5qGiotEY3uNBDqQ3K0jSxRViPsd1A9D7qGu4HKLIStoJc7uZ:mDoA5qGtyY3urZOR8sD0/qGu3/x6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775588333, "uuid": "c8d10b46-974b-4bdd-a23e-43f6392edf2f", "value": 2696704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775588333, "uuid": "08d7f466-2005-4486-9223-c5ada27b2dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588333, "uuid": "c9a8e4bd-9962-4627-aea8-a450e46a2744", "value": "Xenostraprerer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc193ec-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552677, "uuid": "ae2e73d5-fc16-4ca1-8915-0b3225a37173", "comment": "Malware payload (Mirai)", "value": "8d33778d8c70f7f0f28639a1c367760e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552677, "uuid": "4e6b5d8a-605f-498b-88f0-d11f9575ee72", "comment": "Malware payload (Mirai)", "value": "ed8d37eb173b8352e57224d7f04e22ac24001c44b12f862e56760569b3a4ef6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552677, "uuid": "ac89d78e-64ce-4337-af3b-2de0228af0fa", "comment": "Malware payload (Mirai)", "value": "18cfda428d17b583c8ea9832c5e42e6123ac3b30", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552677, "uuid": "7d89eeb2-cb60-45cc-a7a2-285467837f54", "comment": "Malware payload (Mirai)", "value": "5ad685f863374b09c2c46ecf66a97df36c334fde999cc59ff2f3e6f24a58cb37d341cb6c41555ab86967cfae5155c45e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552677, "uuid": "0f36388d-dc0c-4768-a92d-938ef15fa9ec", "value": "T1D403E17DB3082A79D7DF1CB6222E12D85F5050906E575F0A13325DCCC98D6967E4E8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552677, "uuid": "d7b158c7-ea7c-4cc4-8ba3-0387145d39f5", "value": "768:aRbMN2q8qb06Ds/e/2OClp81+ws8iiRbhlv0J7RpPoyIW2:aRgzPb0POmnBiaDpPoyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552677, "uuid": "5071e4fb-5a7a-4710-855d-15a33180800f", "value": 40024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552677, "uuid": "715dd03b-e2e3-43c2-9e87-745ad1db0e13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552677, "uuid": "c6ccee2f-b4f5-477b-8dcf-2f28737b0f19", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75b6fdb-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775562062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562062, "uuid": "ca133ae5-79db-4ba9-aa61-aef83c971a15", "comment": "Malware payload (Mirai)", "value": "4a4e60ea111d652f52b880ea56c81087", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562062, "uuid": "172a7cc4-0770-4829-959f-f635c1dcf75c", "comment": "Malware payload (Mirai)", "value": "ee61f96f5f3c0ac1c754393afa219a83228af7e9fec786a125c40cfb1d6756b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562062, "uuid": "e042fd74-1fbf-4acb-84dc-55e4d51757b9", "comment": "Malware payload (Mirai)", "value": "084b8d4d83e1becd74beaf8d569e801013beb22a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775562062, "uuid": "32f8462c-9b76-4ece-b6eb-5ea9765ea520", "comment": "Malware payload (Mirai)", "value": "4d26bc0452bb4f6a23eed87b3fb692788e267f1b6f1df5b0991995b4ab52dba720155e9d42a161c6215f0080d64e0b93", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562062, "uuid": "cf8993ec-e0c4-4804-9084-a4ac8b0760db", "value": "T1EA5319C6E313C9F1E84315F002BBEB799A31EC721220D936D7A5FEA66D621C2704272D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562062, "uuid": "48016da5-34f8-4b64-9012-31bd26c11af2", "value": "768:P2vfnJtmMzfai62hdRijWY4V8ptnOQLGmXENzaC3/GYxgQZwu3CTNAqA:+vf+yF62hdQjbOQLGmXQaCOmx3ClA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775562062, "uuid": "6f956e98-e457-4674-bc11-56ccd9aab7d6", "value": 62236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775562062, "uuid": "aa4f73d9-9f74-4da6-bc1f-ba3984ac9e7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775562062, "uuid": "f19f93bd-8990-466e-9a30-4b1b7b8eb19a", "value": "nx486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642f9ea8-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561949, "uuid": "9fcb7b9b-c715-42f5-ab85-b680dfd2f621", "comment": "Malware payload (Mirai)", "value": "3435af7d04f2b727c426c0e519f98121", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561949, "uuid": "6377e57d-a3d1-40d7-88bc-84825020b88c", "comment": "Malware payload (Mirai)", "value": "ee70ee1d78b940920533c27ea45ec1a102b6710b2bace73313549ef97113154f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561949, "uuid": "07c12b15-6d9b-402a-aeb4-904d31d4c7ec", "comment": "Malware payload (Mirai)", "value": "8205ef308878a2392fc5c56c9960705ac7cd05d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561949, "uuid": "abee9cbb-a3d9-415d-a7b7-b71589f83329", "comment": "Malware payload (Mirai)", "value": "b2d6a2a586670231b1c9b3c9564f7dc18f66932373b6f244213241a909314e09d4348ca5d9ea7001dc907a69718f4f94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561949, "uuid": "a32cc13b-1f84-4616-8d39-99cab0f64caf", "value": "T126330256E1685F13CFA03A35DBB20B83726801FD96B731E5BCEC85092AC1A6571EC7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561949, "uuid": "3e125155-4148-4055-bb9f-6a9e05982b36", "value": "1536:0CcLlFa5aalj3ORZ9oGvNUvQbByfDKCJ3X0Oq/Z8e163rDV:0Fa5bjOPF3bB3ijqxBs7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561949, "uuid": "d2a6f6e2-7290-4c6b-b628-71c71579aba8", "value": 51740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561949, "uuid": "dca51e57-fca2-4a79-b199-c6611443d032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561949, "uuid": "a1833da2-e802-4e6b-81de-1e1589c2bf24", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31282c3a-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539959, "uuid": "6f155fa5-779c-46bf-a116-c042604b191d", "comment": "Malware payload (Mirai)", "value": "097d20a7446911f1c693422ab3031e84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539959, "uuid": "1fc9a84c-fee3-4fbd-b043-0062a00d7eaa", "comment": "Malware payload (Mirai)", "value": "eea1c543a131738e36e4e101f7bd4a6bcc7f3e30a6c699473efdaf91194f8d08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539959, "uuid": "7bd0802b-d891-41aa-b8ed-7049cb9f8d4f", "comment": "Malware payload (Mirai)", "value": "07dfc20f6d39a0a79fb04cb9db56b27e701b377d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539959, "uuid": "8d80fcf1-ce3e-4ce1-9916-35c678465e21", "comment": "Malware payload (Mirai)", "value": "3a28420928e0ade6490228194cae429659eb887de47956e3f79843e4abce4d37b8ec45bc6d2fb0b2c074fe474dd16672", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539959, "uuid": "c5081d7e-90dd-4fa9-bc99-be167be9c171", "value": "T14C8329C1FA8BC0F1D91B89304067F63FDB31E9295061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539959, "uuid": "ef2d9d2c-dd11-4706-b243-79f5929f6549", "value": "1536:LInlZzkj+0cO4xoPEw6HMAG5vpeIgWtyCKjfTsv4gz9F7Ei:LIlySh9is7HMAYxTkCKjfTc4Di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539959, "uuid": "02a9384f-17da-4017-86e9-85f91c955a4f", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539959, "uuid": "c54e85b6-8c23-4536-8e09-4845e4d64b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539959, "uuid": "b9c9192a-f0bc-44d3-acf6-59ced442db44", "value": "windy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab422f64-327c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775564645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564645, "uuid": "0f24f023-e6b7-471c-ad8e-5d0f076d518a", "comment": "Malware payload (AgentTesla)", "value": "b5c9262768f689fad5c727f94f3d5150", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564645, "uuid": "e78f71e3-26a9-4470-aa5d-bcca3a735176", "comment": "Malware payload (AgentTesla)", "value": "eeaaf1a831b3fb078825892380b43e6f8616edfe4434cc0950bcfddb289326c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564645, "uuid": "a76e7ab1-d2ea-42bd-931b-61a392060ca5", "comment": "Malware payload (AgentTesla)", "value": "43b27a68aac4280c507d8142847ca572977f628f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775564645, "uuid": "fd365db3-a22a-4287-a85f-a28bafc798e3", "comment": "Malware payload (AgentTesla)", "value": "b6c2b44b500c692d45f929bfe4d9485c6fd2ec77a5867676a3b630d0a1b4b5bf96558d069f2fd8e114a1db38cdf81c86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564645, "uuid": "eb22bbe3-ace2-45be-9b10-60479c716c62", "value": "T1CB35AE027381D062FFAB92734F56F6115BBC79260123AA2F13981D79FA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564645, "uuid": "52b077e9-4962-47df-91c6-69e192038d58", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564645, "uuid": "07af9fe3-0c7f-4bbe-a032-cc94e6e12aa9", "value": "24576:r5EmXFtKaL4/oFe5T9yyXYfP1ijXdaupyv9Uxuy0:rPVt/LZeJbInQRaupyv9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775564645, "uuid": "294e5719-5747-43a4-9668-a09fc615fd3b", "value": 1117184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775564645, "uuid": "9f148379-6627-4abb-bff5-300031be5816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775564645, "uuid": "4acf3279-213a-4050-901f-7c664a8dc6f2", "value": "PO - 40500108 -Len Chen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ff2c5c-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554654, "uuid": "c7e79b5b-3ad0-470c-9a8b-f07823b2d49c", "comment": "Malware payload (Mirai)", "value": "bec69a539ee1f62266eea0f2bbe36d2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554654, "uuid": "9e88d19a-6d40-4052-81af-65a8e112d92f", "comment": "Malware payload (Mirai)", "value": "eec75b78d511756863d55565fb269906e50705a61bc6f00e9c8fbca3d07e6fb1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554654, "uuid": "04a5ac6c-d55d-4da6-9a6b-48845dec4e56", "comment": "Malware payload (Mirai)", "value": "7609cc07aa4a28cf0076d984bf1415b08114b8ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554654, "uuid": "ea728ba5-f55b-4a72-8e9a-db791398f207", "comment": "Malware payload (Mirai)", "value": "b04ed2fc2024e9c9df3e7968e1ca4315fbfacc6537266c5322e29011878996abb54f96636085a7f291682380bc612ccc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554654, "uuid": "fd04397c-5a61-46e4-b78c-661f08562424", "value": "T19EE2F18C71315662C378B8B69DBCCDCE672152BCE2E5BA223D2541B1520ABCFC17A353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554654, "uuid": "d12596e3-0377-4d96-aac7-cdf8daf948c2", "value": "768:/Ud82887oq8knCPJBrtZq6+X2Dyx/d6jZs/ls3UozJ:/Ud8L87f7CPXtZx+X2D41QzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554654, "uuid": "c1fb8df6-d0f2-485d-82e2-f5be3839158c", "value": 33896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554654, "uuid": "43486833-af9e-403a-b396-fa639e249426", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554654, "uuid": "647e31cc-fa01-4a68-b91f-52b102a9e365", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a72471a-328c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775571462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775571462, "uuid": "2f9f75d0-35e8-4bbf-8b3c-2a728c3685d7", "comment": "Malware payload", "value": "3a39e975e62b04b49dbfe63b4410dcb0", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775571462, "uuid": "98f13f9c-a80d-4808-8caa-729cd512a5b0", "comment": "Malware payload", "value": "eee2d8effc5b0be997f93f1568ba228b997cd6c1cc59da635a862ad155dd1f59", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775571462, "uuid": "f2ad1099-a7be-4275-9d73-db6fe61da1b7", "comment": "Malware payload", "value": "cb042a1d93df206739930a10f062fbf33641b2d2", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775571462, "uuid": "53514b59-eb1b-48a0-8eb2-5fa101db6a8a", "comment": "Malware payload", "value": "a2f097e87e035072dd03930abb7bd81ae599fc0a68eea6e11c5de6ca4595a9450459438b06a81c77f37dc014272dfebe", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Suschil!rfn", "colour": "#3CC01D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775571462, "uuid": "c8362307-a29a-46ee-9e83-9639d4d724f1", "value": "T18EB433F5AC68721A176F9D13E762EBD03B7DC3AC265313C42527A2CC404B9AB116E3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775571462, "uuid": "dd04d118-25ba-48c6-8ea6-9bdecadf4af3", "value": "12288:/rLZ+vPYN9Vr64fQ/IPI2si0NdqFr04rxkF56zm5vi:zLZ+vwN9Z6qQQAHi0AgUmNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775571462, "uuid": "ffc00370-f6fc-4257-99ff-aab014e5bdba", "value": 538362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775571462, "uuid": "37de6e55-d7d5-4e44-b311-e10df3581ac1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775571462, "uuid": "4780fd0b-c5a5-46b8-a1e0-68032acb061d", "value": "register_codex_v3.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92180aed-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553006, "uuid": "82d6cfde-fed3-4046-8ccd-560f69504601", "comment": "Malware payload (Mirai)", "value": "b2057c919eb7d6acd8bc9fec70be3c5e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553006, "uuid": "d0807248-5381-4856-ad76-474dbdb79d1a", "comment": "Malware payload (Mirai)", "value": "efcd5063cd99fd1004ad219018ec14b4d893c9ae95fed3396c88b3d947f535e7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553006, "uuid": "9a97f697-14b4-428c-b063-fc2476bf1608", "comment": "Malware payload (Mirai)", "value": "649582460273c4b837372277524926913ff6d5b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553006, "uuid": "c4f20699-dde5-4207-9be6-01b926f1dd7e", "comment": "Malware payload (Mirai)", "value": "e43fdc1c017c76db044ef08db4ae34293026a2e16b5e7dd8f18f562fd65441a53fc060b06e4f03601af43a89444cbcb1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553006, "uuid": "302d30d3-4d65-4e85-b885-ef42ce319e97", "value": "T1E5C2D0843258A80DD25F933930AC6AB774F49C121E3B63CD36A5CA8CDF8307ED6659D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553006, "uuid": "aad99f45-d8ff-40d8-a90a-e8f54c25f47a", "value": "768:SJpWLGQoZMu612K3/4wSI3GqK3LIIkdYI0:SJbQpx3wwSI3zK3k3Y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553006, "uuid": "c52ae460-1aa1-43dc-ba0a-ec2e89fbe621", "value": 27152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553006, "uuid": "49ba8e95-4b98-4c31-b96d-ae78df0909ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553006, "uuid": "034fc47d-6716-4a91-8e05-e13a6b95dfb8", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b256b3a-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561934, "uuid": "856f64b9-4df8-4562-956a-d4cc495a39a6", "comment": "Malware payload (Mirai)", "value": "59ac15bbf6a4c87b42ac284411c559f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561934, "uuid": "9964546b-a5ec-4225-a610-4c538cec7536", "comment": "Malware payload (Mirai)", "value": "f0e5011177b72d836604ee4a559f49d6317facdc0d3acb83e8a3cdff6e95e511", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561934, "uuid": "b77db57d-cd44-4daa-bca9-d6588532f1a5", "comment": "Malware payload (Mirai)", "value": "e67d88c290d24af4bda424c532d17518fa4ed259", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561934, "uuid": "a3bf4080-b6fa-4d77-95d8-291a32beabf1", "comment": "Malware payload (Mirai)", "value": "de7cb8679469c6e35baaec396ec87c5ab153bd581c40bf544858f04366428a0477d6764ccdbefc0f68f054ac92a4bf48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561934, "uuid": "6e70d96a-2ff8-44bf-9cdc-9e32c873b99e", "value": "T18863F206FBA89BD4DCE696356E573A8E2030A44DEC111836AEC5B0F791F0F75FB84281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561934, "uuid": "2014a8b0-759d-45dc-8144-ae5adaa7a50a", "value": "1536:Bj9qmgwROfmEQt3eOm1KSEj16AyMCKAPGuonouy8jyY:B88Afm9eOm1KwAyZBAoutr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561934, "uuid": "f82f02b2-1949-40cd-97e5-4b1342ed500f", "value": 68140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561934, "uuid": "c5325a2f-daf3-41d9-a112-de5cf9d74cba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561934, "uuid": "20cafee7-7e61-48a1-827b-fd648deed25f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0be7ae9-32cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775599121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599121, "uuid": "782e1fad-9300-4f65-b811-320af630be48", "comment": "Malware payload (Mirai)", "value": "62f981fd6ebaf539078600e0155e076d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599121, "uuid": "27802e2b-42bf-42a6-9797-c5a67cc41181", "comment": "Malware payload (Mirai)", "value": "f353dfd83a50b2924f183f6b7bd4bbd9b8fe77698156b11d85959f86cac18c2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599121, "uuid": "38e21aa1-5e21-4c68-9c3e-54ed92b98dd3", "comment": "Malware payload (Mirai)", "value": "e6fa3bf9d72cb91bc648303923bbb379a7af9c34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775599121, "uuid": "ac1c0466-44f1-48f8-b9e4-6a4499b47adc", "comment": "Malware payload (Mirai)", "value": "eec6aaa92196ad4c64ffb1dbf122042b91bb2a913ced3d25870a6476ba210f7f64bb6c444ae58df94e07e0f91750e036", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599121, "uuid": "e62b2e4b-ae66-4287-8a7b-1447086215fc", "value": "T15FC3D94B7E228F6EF269C2704BF34A31975977D727E1C581E26CE9411E202CE641F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599121, "uuid": "f95f3f2a-5f73-4e02-a694-dd50821ac06f", "value": "1536:fNCzctQHCvVvSeojkFoUNo+d0LzSR/BMl/VdOsZc/RzWY2je7YIrjSDedz6v1Je7:fAzsdvxmu/BMx6WcVWr+NrjRz6tc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775599121, "uuid": "bca2e972-3fbf-4889-a6b5-5039a5e0e80a", "value": 121092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775599121, "uuid": "e80adda5-72be-4b28-ba49-0d1e31b27145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775599121, "uuid": "2c0e2eee-8c7d-4584-a448-5d98668a2b61", "value": "zyre.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1420fb81-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539910, "uuid": "6b10936f-cda7-4b52-b4cc-aac5650e2083", "comment": "Malware payload (Mirai)", "value": "75ea0ea259a779718f00bb4eeddd6b46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539910, "uuid": "2e2089b2-ea3f-4559-979d-6157fb25cd48", "comment": "Malware payload (Mirai)", "value": "f35d4171c82cfb785e5f97fc84bf852ee1511f8380d0aba66b672895d49673b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539910, "uuid": "384b8df3-c6b2-4be9-886c-3515b03f5985", "comment": "Malware payload (Mirai)", "value": "7768db1b5ac228a87a4c855079c97bcaed7b5f9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539910, "uuid": "6b311b57-dce3-4979-88de-306860eeae1b", "comment": "Malware payload (Mirai)", "value": "d02a0bf312c0de73ae2f7e4b296840c0da67a6db5b0a363ad9b3bee14caf40ad9ff3d72d8adf0d5c24e7c452faf22672", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539910, "uuid": "12421f90-56e8-4d6e-b452-2e014c7b6720", "value": "T1DA432885FCD2996EC6D013BAA72F358E33A1B3E4D1CA3603CC945B21738968F5D66B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539910, "uuid": "18003fa9-ad91-4f47-b19d-bfb88f4d4c45", "value": "1536:7ApDTwtNTTj7yEFMTgRAMTjd64tXD7tZ:7ApD0tNTT4M9PD7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539910, "uuid": "ad4f503a-7827-4543-9bc5-2cb18b95d848", "value": 55888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539910, "uuid": "3d50baf7-2927-4ed2-9602-ca4183508ad8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539910, "uuid": "a2ea71f8-3021-4d18-99ba-526ccfd22ad9", "value": "windy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dfcb17-32d3-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775601940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601940, "uuid": "f51d38cd-a010-4ffc-a284-674f6d55780f", "comment": "Malware payload (DCRat)", "value": "164b7705958249429c6486705110e510", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601940, "uuid": "0381a293-28fa-4dec-bdae-1a249973442f", "comment": "Malware payload (DCRat)", "value": "f362a701d5c9c44f523ed9b84c4122326c9c168c5b6adcf641242a9b0f12c60b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601940, "uuid": "807d0f39-b61d-4b20-84ad-91f43d214249", "comment": "Malware payload (DCRat)", "value": "6e45632d5caaa8102b9f35c195bfc529d2b650cc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601940, "uuid": "04ff8aeb-7ed4-49f4-b45a-bf90f4db67cc", "comment": "Malware payload (DCRat)", "value": "12cb1ca5afc46f013d6aaebc82b755e7d4ae20998505f5835437c6b71a7c0806d2bea80f434a544658851ef6d8178572", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601940, "uuid": "d2820266-40b6-4fcc-9eda-ce114ecda123", "value": "T1874538027E44CE21F0191673C2EF454847B4AC116BA6E72B7EBA776E5512393BD0CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601940, "uuid": "acae23a0-2934-470a-9c1f-76b0806c4426", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601940, "uuid": "4ec749b4-7351-4ceb-9e7d-c407d487cd5b", "value": "24576:U2G/nvxW3Ww0td+d4MYlaYEggADuGFYvuFHU52lL49G:UbA30ce46WuRUQ6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775601940, "uuid": "47301c2c-21d3-4f4e-b1d0-16912a83fa93", "value": 1164391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775601940, "uuid": "95256cc3-0c13-4ff8-a7c4-0b8e86df8eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601940, "uuid": "445a79e2-7ee2-4d07-919c-edd9c4694ff3", "value": "164b7705958249429c6486705110e510.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fc3a6b-32d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775600902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600902, "uuid": "b194bffa-3a45-4fb5-a391-fa0a60ddfe09", "comment": "Malware payload (Mirai)", "value": "088780e2a71c73dd0c32695eb14e403e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600902, "uuid": "4acd6cce-a285-4032-be0b-ff5c04a5e1a1", "comment": "Malware payload (Mirai)", "value": "f3e0e3a64129d9ab9f1f5f63c3234fc8cfefecd2e42e0e048fc04eb35be3094e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600902, "uuid": "fd228f7e-a50c-4212-a0ff-72d5cc36ecc5", "comment": "Malware payload (Mirai)", "value": "7467676b870dd68f3f3f2c6ae9324dcc7a0bdf2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600902, "uuid": "d42688b2-2c5a-4379-9820-e41151b754ae", "comment": "Malware payload (Mirai)", "value": "6a98a83b782475de2ea82d479006d5789802beb68b564829cfeac8e0bb1fd4d3d11fd56e11f7a1d1d20a6afc3f17d046", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600902, "uuid": "3b3bcc6e-6029-4c52-9e67-3f1462e11415", "value": "T175832981FA87CAF6D40755B001F6763E9E31ED2E0435D1AAFF946EB1CA1B9C17216318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600902, "uuid": "bcfd1dd7-9959-4191-80bb-e05ca398c692", "value": "1536:ito2G3so0k7uKjfzagj32CsMtOWdQY2nY0FbeA+GiGURg:2G3SkiKv3j3SMJizY0FbeNGi7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775600902, "uuid": "9dad652c-3c4b-4775-bd7c-b06a69fad2fd", "value": 87488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775600902, "uuid": "a17c7971-1301-402c-99cc-0e892a257d80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600902, "uuid": "8a6413fb-3a63-4fd4-ab0c-0bbdcd8efa8c", "value": "SecuriteInfo.com.ELF.Downloader-DN.43159674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9424c7c-328a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775570762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775570762, "uuid": "cd018c97-e12d-49a2-b515-e45b4a8dc28b", "comment": "Malware payload (NetSupport)", "value": "55f38a0df9db2b1e739c2ff00dbf0c83", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775570762, "uuid": "230b34fd-2411-4393-b9b9-f9ab69a5839e", "comment": "Malware payload (NetSupport)", "value": "f42a91e659ed70563c13dd533a936ac5a73cca623f9aadc0b1cbf2f353ff9fc0", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775570762, "uuid": "d671b47f-9750-448f-94d5-aff66f97e26d", "comment": "Malware payload (NetSupport)", "value": "b1c5a510b88020bb43da7c72717f18c647eb0c72", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775570762, "uuid": "9e9e349a-0639-454e-bb88-9ed5ba906b27", "comment": "Malware payload (NetSupport)", "value": "b73892bcab11847d918edf04bfac8654f2f950f03b746fa150a2d88b78f78891393594f903d3179cba07ce09c524621d", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775570762, "uuid": "eef4b483-3e02-40cd-80f9-f7fc633ff57e", "value": "T11DF54B0BEDBD8CE9C0A5A234843361167E35B8401B7173E72AD4B2A92F73BF09975B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775570762, "uuid": "79dc11f3-c946-4c21-a7b1-d6d9ca2fc7dc", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775570762, "uuid": "59f0a1b1-d556-42df-8a83-7c7de5c08e40", "value": "49152:RDWuJefm0enCm21Rgm9f+7Xu+EcI0jVnc8b:RDvn7Xu+EcTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775570762, "uuid": "28e459b4-f9e5-4d27-8f68-6004b1551da6", "value": 3571200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775570762, "uuid": "d51f2f06-aa07-493b-99aa-486a9e2ca1ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775570762, "uuid": "09442611-0eb5-4656-a053-56c6baebebd1", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26681bbf-326d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775557980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557980, "uuid": "fa4150fa-09d6-4f54-900d-d90d936269c6", "comment": "Malware payload", "value": "a7c1c21d572fdf2a4fc1ca9e99fd146f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557980, "uuid": "b6185b52-5f2d-48ee-b4b6-7d8998a9344c", "comment": "Malware payload", "value": "f42c2bbf20a6ff06dab5aed49404a95ca88549304a2dc30a5d6a72f2acd4c11f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557980, "uuid": "5549df80-844f-4145-9dcb-17542f06df43", "comment": "Malware payload", "value": "d5c832d0da068bdfce5a130d2e6a415993ce1515", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775557980, "uuid": "a668570b-e1e3-457c-9494-a1cfdea7f551", "comment": "Malware payload", "value": "1167aea26b4f28ecfc8e02d92bb1ce38fd445f0ed6677ff614be86a0b1d9ec641ded5bc03bbad319c09c5de9ac32f3cb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557980, "uuid": "8e650573-1449-4c91-bf43-544956fdb0a6", "value": "T1103198D5118243F46DE1E91B6BB5A6087186A0956CC27FCC78D8B8B8416CFCD9F41AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557980, "uuid": "585cfcc5-ffd8-4a02-a510-ebf3123a18a6", "value": "48:iXR1X27X+K+AXppXgPX3/XOzXeTe+X17XIg:i3+pr0fGuK+Jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775557980, "uuid": "1b405135-d067-4a5a-befe-4d3436ba50b9", "value": 1797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775557980, "uuid": "0f4a8fcb-df26-4fd5-add9-10c47ab11e6a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775557980, "uuid": "38f23976-52b6-49fe-8e5e-6a7e28546647", "value": "jew.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe219ef-32d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775600892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600892, "uuid": "04ad6df6-ce62-49e0-99da-55a7fd9ab9c0", "comment": "Malware payload (Mirai)", "value": "fe4df1e50245d166ebe31ccb1e2e2336", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600892, "uuid": "c118c561-af5b-4295-a07e-87a86e869dfe", "comment": "Malware payload (Mirai)", "value": "f4e22081613108997397cb9f06a085560dc0b5df24bcadf95b19b7d7eddf8977", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600892, "uuid": "77dac06a-df7a-4b47-b8ab-17615c167ccf", "comment": "Malware payload (Mirai)", "value": "31b693fb5139323deb08b857690968c2d7e1ef1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600892, "uuid": "69f9c557-fc65-4488-8350-f2d1fa8b594c", "comment": "Malware payload (Mirai)", "value": "4d61b8bd8d36d2f9b46435731524e177da5c13e81c2a4b9c0b7282ac62baf4d483a3c5094975166feb1497b6ac004494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600892, "uuid": "dbc83896-f482-4008-a033-6c9ee3c0121a", "value": "T10BB32A4ABD418B12C5C221B6FE6F554D33136BF8D3EF31128D24AFA463864E70A7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600892, "uuid": "e8b61d06-6e02-4f00-a6a1-1aac533ef31b", "value": "3072:r91oweBTdjCFLdSj/LaH0L/vOfU7JF0/iEa:nsC5dSjTaULXO6F4iEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775600892, "uuid": "f219aa94-aa61-4947-ab70-92cbaea07537", "value": 111524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775600892, "uuid": "dd585add-b64d-4ec8-85e0-d252d53eee0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600892, "uuid": "6bcd91ac-3752-4174-ab51-9a34c3db1452", "value": "SecuriteInfo.com.ELF.Downloader-DN.58978769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2538a8-3265-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554659, "uuid": "edea15f5-183a-42e1-af0a-555d511cf902", "comment": "Malware payload (Mirai)", "value": "c090f8e30697f54f6f12392268a1e7fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554659, "uuid": "40ee4e65-ed56-4116-8248-6f37d19cef82", "comment": "Malware payload (Mirai)", "value": "f56bd9b536daddf32e277cb6dceaa901c060a3729ac15b017d356df0b89a3c68", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554659, "uuid": "be69d9c2-c124-4de1-8299-8f25e831fd9b", "comment": "Malware payload (Mirai)", "value": "bf2d848314b1d3c1bda93977a16dc69810505489", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554659, "uuid": "07de0b03-1c90-46a0-8922-46885fae6157", "comment": "Malware payload (Mirai)", "value": "e98c8de6a3545821fd733a3b2c6eb065e95c7a84ba6c889a735974ac26ecfb73863bc72c284c393fc44d050817f8a804", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554659, "uuid": "db21030e-59e3-4563-9db8-0522c9556536", "value": "T1A103E16EDB94B8DFC55C8A77768E8B299F343582B2474F6CE2104C5CB5730AF66884E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554659, "uuid": "5ce3a02c-70d5-42ed-99ae-1fb487787d7e", "value": "768:jVyIwYjG0JFwdZ6e10PMaucNddTxVabLmmPnrhsID8CUnzle/Wk:jVyYjXJQHCPM4dT/abLZflD89MV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554659, "uuid": "a0ca22bb-d45d-4b2a-996f-14403f8092ff", "value": 38096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554659, "uuid": "3e158dc7-7291-40d1-96dc-8e6b2db9e024", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554659, "uuid": "8d4a7ac4-cc3e-43f3-ada3-de78777644f4", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4ca187-3264-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775554149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554149, "uuid": "e601d4a2-d339-4960-ac4a-9c50ef0a5dce", "comment": "Malware payload (Mirai)", "value": "50d40984cb44a78c044af17c9256e821", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554149, "uuid": "b0fbf638-36b2-4715-9653-845a3c87c2a1", "comment": "Malware payload (Mirai)", "value": "f5c554861be14fb0de39e3093ba66f4995f0d4932f21afe0cd20b8f39d011b13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554149, "uuid": "a4d8667a-432e-4467-b5b2-c97a67c1f84d", "comment": "Malware payload (Mirai)", "value": "2c7fe4673211f9e43542d0d81f38b10b2073f20b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775554149, "uuid": "f0e9c349-8391-4db3-92a6-de297d95a834", "comment": "Malware payload (Mirai)", "value": "461c618c2542c4d1877728f76a40d14410181b5a14fa4b5d113e8fce568ba2df1f0be297820264af9cebca757e97d7d8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554149, "uuid": "546fa836-a6df-4f25-958a-d5f8f212a007", "value": "T147F2D1831879410CC57F21B90C67FD8A88A09979C56E89F20B98B423D927FAC7D9479E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554149, "uuid": "6f664d37-8a44-403b-8b5a-05291c8a8cb2", "value": "768:WCkGi0D/4BfI7dZnRh7/IN0BIesyoXKot5V4oEAIph+836B8mvnbcuyD7UHQRj8:WBGbyqhXrTBrQX4oEXmvnouy8Hy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775554149, "uuid": "bf9aea1f-3356-42d7-b2bf-015413e1a035", "value": 34912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775554149, "uuid": "35510681-2e65-4dfd-8e61-07b0c083e92c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775554149, "uuid": "2b723200-237f-4f47-a398-ad5dd9326054", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bda8e1-3243-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775539940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539940, "uuid": "bcefb48e-873b-4256-99de-9de33ed3d7ee", "comment": "Malware payload (Mirai)", "value": "546f431539a0d3a799d963391c5a6e07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539940, "uuid": "24c32659-2f9c-4a68-b274-cbafeed2023a", "comment": "Malware payload (Mirai)", "value": "f5cedaa103ae7b99806d45bfb590ddfbc584d7e6269a53cbedd93d798e6bbb3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539940, "uuid": "ee454f33-72c5-4550-aaf6-04f2039b0688", "comment": "Malware payload (Mirai)", "value": "4f2eae797f5793d448e4ca8921333e769e5c91f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775539940, "uuid": "26ec41b4-d1c7-4d03-81f0-799634656db9", "comment": "Malware payload (Mirai)", "value": "e98328f79e4db0ff085de6e8ef8d29b862f2279ff86fb15ad5bea09c5b0a20b52733395c24b368bab09204d699305ba2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539940, "uuid": "a0c5a2d2-e530-436e-93e7-ff42843b8256", "value": "T162B3E84E6F318F7DFBA8C23447B3AA21975923D227E2C685D19CD6011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539940, "uuid": "85993f7d-d26e-47b4-a713-e68d347eed4f", "value": "1536:KEkWi8LiZECcpHOWWJDman5Pd1Oe4a/7QhfUxI+E7OTeVutW/HeAB090xS0n:44i50poRb/EhfUQ7OTeEtW/c0xS0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775539940, "uuid": "c61eecb7-60ac-4c2d-bbc1-3004822151fc", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775539940, "uuid": "c5b2065a-8124-40a4-9bf7-462a15bfaab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775539940, "uuid": "74f9fff8-c089-45ba-b05d-999b212d527b", "value": "windy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb83c554-32b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775589261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775589261, "uuid": "2e1e896d-317e-48b1-81b3-de1ea5a925c3", "comment": "Malware payload", "value": "bd71aff018e322e57292ba34f48191de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775589261, "uuid": "9264d6ee-66f7-4deb-abe8-2cd2ae9b64b4", "comment": "Malware payload", "value": "f6a02666b49de9f444eef5d3ed6d810e8fd4e1251913db7c03f134478eb56efa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775589261, "uuid": "343a820c-10d7-4837-9a24-18ae7cfb272e", "comment": "Malware payload", "value": "637441f2a844c172c7a98ed89bc7d461158ce526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775589261, "uuid": "1d75b933-3437-412c-bf36-bf8d677ce06c", "comment": "Malware payload", "value": "6069d39785f3ef184d309cc97dec27b3801daa1865010785ed6b9c39d547294d4ba554dd212f6d3d2bfe3ee2150b2b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775589261, "uuid": "78dc279f-2433-4a16-bd8b-f79a0a0ed8e7", "value": "T156E2A40077F89669F7FB4F779DB295104B33B8164963CA0E0E95218E14B6B94CB60B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775589261, "uuid": "65af3e41-460a-4937-9708-678d55db286f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775589261, "uuid": "0bb34cba-ac70-4671-a962-25869fcea515", "value": "384:3BV9QLz6vGCFc/+hM5tDVoambJN9HlSCbaZ/8lb6+hGxIH0ZPZdq3ZM8I:3BV9+z6PKTDMbtykx6+hsIHH3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775589261, "uuid": "eb1f4776-8048-4811-9904-77f6f2fccf7c", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775589261, "uuid": "1fcebc45-1b4c-41e8-a995-8ecc84c7d20d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775589261, "uuid": "83083900-0680-4cbc-acfb-3e43635275a0", "value": "RansomWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a432d3-32aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775584127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775584127, "uuid": "ad874312-3661-4cf4-b4aa-21d6351712f5", "comment": "Malware payload", "value": "c1ccd8e8170ee99026341e77f74553f1", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775584127, "uuid": "2af3ca0b-b960-4e10-a9a8-66d58c8fdcf3", "comment": "Malware payload", "value": "f6e5f4638a2529210ae7c14e5360bb1ef81f83ca2a97a365bb603809c2fead23", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775584127, "uuid": "f485e434-95d7-4de7-9f2c-adee3f37663d", "comment": "Malware payload", "value": "79a2bf963763f56fedcaec40b9fb08bb192b86cc", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775584127, "uuid": "85902121-8f0e-49c3-9e25-44b03aedfd63", "comment": "Malware payload", "value": "4db7afa9b430c407e42e51f51cec17e2a42531b48ef99b0b704229289a0a35901b22e46d182420df935f98c6b3580ee7", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775584127, "uuid": "8674bc88-09b5-4495-98bd-7d4705445dfc", "value": "T125C13A3B2DD6EABEBB4AE66359489338937076577150EC42F54C20C0DF8E781C6229B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775584127, "uuid": "33f5efcf-dbd8-48a2-b2de-f88a632cb79f", "value": "96:v/wScq5N8HtKP/WJkUr4IyFe/mydoCCJ81qgRjc6wSmeXCb1r/14Ly97QqA:v/PQAWGE/m4oCCJ9yjckybht4WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775584127, "uuid": "aa4c4e30-0134-4fff-a360-b6c3f52a06e8", "value": 5789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775584127, "uuid": "ef0930ec-50c7-410c-9d4e-2dc9a37205ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775584127, "uuid": "19a95286-5bc3-4182-a6e7-797ea0b03e70", "value": "main.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9546797f-3266-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775555159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555159, "uuid": "bc8427f6-3c2c-47e2-80dd-7203ea2e92d9", "comment": "Malware payload (a310Logger)", "value": "31a7dc434275505ad79b4ec5403f8d08", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555159, "uuid": "e2e7b485-0716-4081-9af5-f8ffda2e7986", "comment": "Malware payload (a310Logger)", "value": "f72f4cb0391da991e2d4f333de0062729cd50ea7ce07c2836547d1bb2802fd9c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555159, "uuid": "aabc2556-0f04-41d1-8376-ac9517031023", "comment": "Malware payload (a310Logger)", "value": "a6ddbce733ccc5d0e9c29640a25f684075418608", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555159, "uuid": "d45034c3-79a9-4e95-8387-2da4830ddaf8", "comment": "Malware payload (a310Logger)", "value": "e0046ba9cf3af98389c13f66d88a41a7f38605714546585ea3b1694262d4ac930f4398101b684efe3aab5fb20d560c2c", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555159, "uuid": "0592abc4-6c89-47aa-9607-351d6cc69999", "value": "T16B55CF0273D1C066FFAB92334F5AF6115ABC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555159, "uuid": "3292b8cd-dd2a-49c8-9a7e-6fdb918b160b", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555159, "uuid": "cab85d96-a2f1-4142-a048-d861c753957c", "value": "24576:U5EmXFtKaL4/oFe5T9yyXYfP1ijXdaU2RKqdZWwis8qlkM5p1W:UPVt/LZeJbInQRaUvtfvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775555159, "uuid": "23355f56-430f-4621-96ff-2ac5924742dd", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775555159, "uuid": "17fdfb9b-082f-4027-b5d8-d716a43bed8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555159, "uuid": "3b1094e1-b230-4cae-a703-67edde11d739", "value": "INQ-RFQ-D-0022026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51499880-32a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775583392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775583392, "uuid": "4e38466b-5891-409c-914c-03f904b7edf5", "comment": "Malware payload (Mirai)", "value": "e4c70f25ae70d1525f32a7e916772330", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775583392, "uuid": "444cc36f-c8a8-4a49-9e7e-61df1d5ea4ca", "comment": "Malware payload (Mirai)", "value": "f7a49b6ab9eb1b400ce26b4db8f176ecfcbff4b2037c1393edc76eab2ca5d037", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775583392, "uuid": "704cb17b-8e92-4445-bd61-ed6d91a5082a", "comment": "Malware payload (Mirai)", "value": "ad7900d59bd80978c2a472397032689da7515414", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775583392, "uuid": "3ebabd02-cee3-4dbd-87cf-3049df5fef2f", "comment": "Malware payload (Mirai)", "value": "658dd954aa2ba1eddf06d949132268d1a1462812900d4bd84ee697372086043f6aecb2815eb25b3d7482ecc7332bd37c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775583392, "uuid": "ebe1b254-46d8-4afb-b74a-f8a01cf69484", "value": "T12BA32A8ABD418B12C4C215B6FF6E554D33136BB8D3EF72128D24AFA027864E70E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775583392, "uuid": "9174675d-361b-4e17-8905-8d3df8cd60b1", "value": "1536:mInYoLKsXZduTlQPXMR962yKWagHrJ7MUDdtGfIz3/z32q+y3iaZq8Ed+9Svnh3L:qTaqgXRMkG3/YatHyA9eUB7MA7Stqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775583392, "uuid": "9b5eb84f-3f64-4f0b-b499-80ef7984256f", "value": 107412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775583392, "uuid": "19350b3f-31c0-4feb-83b1-ad2fed39f36b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775583392, "uuid": "ffba5264-e696-4128-9d22-f429ee2dee02", "value": "zyre.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8813f12-324c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775544025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544025, "uuid": "e1994335-8bf1-481d-a426-8328a9c02320", "comment": "Malware payload (Formbook)", "value": "3682934f867931d0774a053587458eb5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "studiogioeli-it", "colour": "#3B13C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544025, "uuid": "9f35285b-8bd7-4a22-910f-3189217643d6", "comment": "Malware payload (Formbook)", "value": "f80d48fd9da246ff8ae107a28547269af8a6043597b381d1d8bbd6de3fdf5dcc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "studiogioeli-it", "colour": "#3B13C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544025, "uuid": "edc7b40e-a38c-48ba-9759-2b7bd5e7c051", "comment": "Malware payload (Formbook)", "value": "e7876cda9263a5d9500d2b866089727d6792cf19", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "studiogioeli-it", "colour": "#3B13C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775544025, "uuid": "ae8b6436-54ff-4471-baf3-9788bab1875a", "comment": "Malware payload (Formbook)", "value": "587e16cf1e3929d9f36da4a762615d9f2baf26f91b488986988b83e4853f71472286f62d3741c82eda80ae71a82109b8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "studiogioeli-it", "colour": "#3B13C2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544025, "uuid": "16a648ad-a60a-48f3-b0cb-7307c98f541f", "value": "T19CA5318CB248B14463C7F968EC10F4E65E5E34CA2AF7D8889CFDB7915D40D0528BABB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544025, "uuid": "c5d8fb44-afe8-4546-b684-43156426f8be", "value": "1536:5eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeS:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775544025, "uuid": "20d9ae6e-b2a9-4e94-9095-825a330bb4c1", "value": 2065992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775544025, "uuid": "0bb88253-f48b-458f-a47e-06eb2e879e6c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775544025, "uuid": "a849f54b-0e53-4558-b9ef-d3a18e3ff97c", "value": "f80d48fd9da246ff8ae107a28547269af8a6043597b381d1d8bbd6de3fdf5dcc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d7e7de-32b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1775588307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588307, "uuid": "244444ad-6f1f-4604-b61b-77754c6bf314", "comment": "Malware payload (Prometei)", "value": "cb4823165b2d585f56f93b4b271c8c34", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588307, "uuid": "ccb1758b-8dc2-486e-b10a-01f6e5642786", "comment": "Malware payload (Prometei)", "value": "f841ed51ccd14906e5446284ea7fdf6d42a2e1da3acbbaba321841718fe738ae", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588307, "uuid": "c90c326a-b9a8-4b1d-9758-db67b282beae", "comment": "Malware payload (Prometei)", "value": "c04d587a877562b8ae473d5b8c7eddcde0869e66", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775588307, "uuid": "76cbb185-850e-40fd-9936-fa32a92d8d86", "comment": "Malware payload (Prometei)", "value": "8e82d5f91aaec974dfcba7e5445fd61805719f8096e8c35cc83acff73dfa7460c2f99ce4cac9ab12a6f47b1b29b01abe", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588307, "uuid": "fb694f97-121b-4c3b-b145-0940f7548e87", "value": "T1A174CF3331B8F25EC84517728F62C7C263A97F55C992805F3EB4630F2A278595A36B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588307, "uuid": "c8ab85e3-992a-42e3-a8de-d579ae7b4011", "value": "551920a564f0da077e7c568c1940defb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588307, "uuid": "660451fc-c62b-493c-b5be-dcb3bdab998c", "value": "6144:hxFm8jr8dmxZc+92bOiRRFsuNfgKk5H4RlANeKmFDhkMW:hxY8H8dmxWWBivFBNGH4cNQR1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775588307, "uuid": "09f698a0-48b1-493b-adc8-457dcf5da1fe", "value": 339561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775588307, "uuid": "8dd76bdc-d79d-4e26-b96a-bb11f9b90f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775588307, "uuid": "55fea629-5abe-4f85-a943-a749bc847f22", "value": "f841ed51ccd14906e5446284ea7fdf6d42a2e1da3acbbaba321841718fe738ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611c5078-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561944, "uuid": "1ff2d985-48ce-4524-824c-12306aed7bc5", "comment": "Malware payload (Mirai)", "value": "c8690011ff6d15b71379f3653f19af37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561944, "uuid": "cb0a2ddc-80ea-4e5a-b63b-05dc78b8d50e", "comment": "Malware payload (Mirai)", "value": "f8780141618b4e3474a62041845f15c2e1e2c31e4f3cf54536213d4c75e067ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561944, "uuid": "201d804f-0786-4376-bb18-eeb747d4aed7", "comment": "Malware payload (Mirai)", "value": "e7a45251b83d14c34fae3d413db126a7e8e7070f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561944, "uuid": "4aaad6c7-7e9e-4651-b774-c88403e15c32", "comment": "Malware payload (Mirai)", "value": "d58263a53429c5ebbe64afde513baecc8af1bcf79eec5c29508536a07fad6a0cd1b21170b94dc8ecca37b23d7346847d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561944, "uuid": "e71edfc3-267a-4906-9c16-fb6c7c61a30c", "value": "T1CE93121CC413C4AF8EE84B772793C18A4E492BB584F204B953762778B1D2F5C42EE9A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561944, "uuid": "6b847a7c-d0b0-4cab-b2d0-cdced7b03416", "value": "1536:bljxnEV5hSZDDYF3IgwX71Bu/i4hFm5Cr4JYT+XehLjDpB2/+PyXpdFc7X:5G/hSVUpIXpBu6UU5COYT+OhLPpk/5H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561944, "uuid": "db81b788-feb4-41ec-9f7f-17aa52ffc0bc", "value": 92480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561944, "uuid": "f356f676-2c4c-4bb4-a159-fbb08d2d709a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561944, "uuid": "8f42ec81-63ac-4c30-a9cf-0dab87796f75", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc256254-3275-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775561667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561667, "uuid": "0638e10c-7868-48a4-82b4-2eb9e6b851e8", "comment": "Malware payload", "value": "8ced06c048e7945cf2992f3963703831", "object_relation": "md5", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561667, "uuid": "2b6e1a60-0d2d-43a4-ab59-4739f8247817", "comment": "Malware payload", "value": "f89aceeb29c1be92a9f598699ee09e45ceb4d58e1afb0560a28c610ebe2d5ea3", "object_relation": "sha256", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561667, "uuid": "6a949a89-ba26-4718-b2d4-dba99cc38554", "comment": "Malware payload", "value": "4108d84cf542af839ca66ddc211d8051e12dc09f", "object_relation": "sha1", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561667, "uuid": "79218c74-4284-40d8-a65c-370b69239769", "comment": "Malware payload", "value": "f8c3d076c1dd3eb3aa2c9306a805433c4e7a262dcc07f83daec6aa0059ce6ba06405bbd25a98866363eae193eacb3666", "object_relation": "sha3-384", "Tag": [ { "name": "European-government-espionage", "colour": "#47B415", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561667, "uuid": "a8cb61ca-e142-4d43-acb5-8a94443ac97e", "value": "T12965338EFA65A174C605B7F195520F4CBB78DEF9D743141229EC79AE8CB2D82D822C41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561667, "uuid": "6156e0b9-d115-43a6-b172-bea8e6091c8a", "value": "24576:ACaeC+O7ZWnHVDRb7ozvkk5QTDPQaFB1gChjgejzuD7AL9aPmnNVEmPEpA3QeXRJ:AFZWnFRbnkUFbxjgUziAxaPmnMaEu3QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561667, "uuid": "b7d812ac-c89c-48f7-a9d5-f026d419e65c", "value": 1463899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561667, "uuid": "70c574dc-b69c-444c-8058-9263c669414c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561667, "uuid": "b1a7df34-01b8-4b98-96d9-66ff49df4f8f", "value": "f89aceeb29c1be92a9f598699ee09e45ceb4d58e1afb0560a28c610ebe2d5ea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7723280-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553150, "uuid": "02d27c13-24d9-4b54-9f40-193648400b31", "comment": "Malware payload (Mirai)", "value": "699f3177e43b8283caf75533c11f52d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553150, "uuid": "cf799263-a5da-46d9-b85d-2211bb791b17", "comment": "Malware payload (Mirai)", "value": "f9387aff34757870e3e90b8c739055ea8640a5f2ddf382fa2772bb47e23a259c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553150, "uuid": "328016fc-ad8a-4be4-982b-d32626a98f96", "comment": "Malware payload (Mirai)", "value": "b3b63f21eb11a25bc7abaea0f34432f6e3aa6a92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553150, "uuid": "473da8ab-40eb-4b6a-aa14-743a698485d2", "comment": "Malware payload (Mirai)", "value": "4b3c68a3c7ad7aba0ec92933f09a5047b5f87ec2410257aed304ef5ac1806c4685c313d8ac908e7fe1b14ab24bbada43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553150, "uuid": "498a13b1-1d1b-4dce-a54f-edf9c4331433", "value": "T1C2332AC5F98B85F5C94B4D3050A7F23FCF32E9794071869DEF4AAF31EA67901910229A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553150, "uuid": "1f6ba403-918a-431e-9bf6-68298bc7e498", "value": "1536:CNbSsgiY5+IQOZq18LjQR+K+nhktxtCblEbr:CNdY5lQOZq1us0NnhktnCblEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553150, "uuid": "f52c22c6-3b61-4fbd-8f36-bb5bc89fb7b5", "value": 54048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553150, "uuid": "16cd598d-68b6-4276-8487-aa5e9c44c683", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553150, "uuid": "43279338-f544-4a56-b637-9a62e6e74108", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a330c64d-3272-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775560337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560337, "uuid": "3ee51d3b-2b70-4e6f-8f90-feb01a0f2b9b", "comment": "Malware payload", "value": "23ee6406000e8c3abff110254fac49d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560337, "uuid": "a81c64fa-445d-420d-9382-9ac0370ed4d8", "comment": "Malware payload", "value": "f983be47b3f4a902d981197f7f7da1da24c6aab6582beb95a1c595f8bd5174fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560337, "uuid": "b244f296-fcf0-4b0f-af4f-8292867f5eb0", "comment": "Malware payload", "value": "aea7b4e02ca1e165bec10044e7672b893a0772c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775560337, "uuid": "7b9d46bd-4bc5-416a-8e74-a1947e4689db", "comment": "Malware payload", "value": "f664d3abac3a10bdc9c7fbf92d8b8066609f9e9703069437fe23726d3b477beae7cf79d1095909c4a2b6e40e97d16f2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560337, "uuid": "76d28915-9ccb-40fe-b36f-8adff2615410", "value": "T1D15493AB79924886C8E83A7BFC6DC1C433571BB9A3DE60555E06CD3926FE9DD0A34310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560337, "uuid": "34d3a09c-f389-4855-9905-36b7f8d3efb0", "value": "6144:5nHeqCy8OCSLm9OORndHVqK9Wjm0LFRMTisrevKsHc2RvoBWH:5XC3ODLy5RnZV130LFaTisr4KetoBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775560337, "uuid": "43a704f1-d2ad-4f9b-99ba-c456932c1a61", "value": 305296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775560337, "uuid": "e0a1924e-ce91-4bae-9785-18be1db1be0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775560337, "uuid": "1a5f2f99-26b0-4fd5-b90f-4299be71d8ff", "value": "mtdarm6n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3363f06e-3268-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775555854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555854, "uuid": "0c559dc0-87b4-4d93-b714-e5abc377e061", "comment": "Malware payload", "value": "eb27bbc29b36ae9c66970654925d8c3b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555854, "uuid": "7f02607f-4930-4672-9727-ad7a344a4d80", "comment": "Malware payload", "value": "fa3a1153018ac1e1a35a65e445a2bad33eac582c225cf6c38d0886802481cd43", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555854, "uuid": "2c3ae7ee-0395-4a02-99c2-6b17a46be66d", "comment": "Malware payload", "value": "e3dc5ef72a9d08790f2f21726fa270b77dea3803", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775555854, "uuid": "658d467f-052f-48c4-9d85-ef257cf21b6f", "comment": "Malware payload", "value": "3c6284a77125670af19c7d07b6dda67de249d6213632a75b1871e9f02b9c9306da52a406a998e0aaea194a40cb587782", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555854, "uuid": "b2891542-1a93-4fac-a6c5-0f48b1007e52", "value": "T1E401974823FC0604F2B2DA3ABCB6E30289B67D464D21CF0C02814B0D4D6AB14EC34F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555854, "uuid": "150c809e-1587-4aa9-ba26-42282890a7c7", "value": "12:8d/KiNFQuVk1Ki4u5YoDbTWlTv+UcWf5F4SelvlEfbLVj6h0bdpYrn1Il6:8d/X/FIYoalTvdcWYs/Vj6mdd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775555854, "uuid": "b2fffe24-f8ca-4bfc-90df-b76a3a20e2c8", "value": 851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775555854, "uuid": "90935902-6383-45a2-8d8b-ab8a0c0a7564", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775555854, "uuid": "8e8505c2-50c7-4ce1-8e4c-9f1a8aa41569", "value": "photo_2026-03-01_01-20-48.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b58beb6-32d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Generic)", "timestamp": 1775600965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600965, "uuid": "ffadc452-8115-4789-96cf-ba918234b6d5", "comment": "Malware payload (Adware.Generic)", "value": "2e992dada36d494ff216f45cc0c8587d", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600965, "uuid": "77303fd7-9396-47a9-b78e-7393320cfed7", "comment": "Malware payload (Adware.Generic)", "value": "fa68320fd6c7ea9849145066b7b13507cf4186900a218cdc67d387341632d825", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600965, "uuid": "edc85824-e15a-408b-9940-66aaa0082ccc", "comment": "Malware payload (Adware.Generic)", "value": "fa56745dfea8905738a3bea64753025ffcd9e07b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775600965, "uuid": "78d82cb7-0309-4dbc-ab28-605297c62737", "comment": "Malware payload (Adware.Generic)", "value": "91d2690f002b569cde4b6f5fd578a61610d767d8cdc7fd993075bc246fd7c65223e7854887eb25d364ba140d82a62225", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600965, "uuid": "6cbe1d8d-f5f8-4f53-816b-aa868a35df36", "value": "T13216023FB268653ED5AE4B3245B38360997B7A61781A8C1F47F4080CCF664702E3FA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600965, "uuid": "204405ae-d907-48ea-8441-e48020802771", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600965, "uuid": "98201f8b-f447-4ef5-bb29-7b3eca263093", "value": "98304:FkLu21R7LJLebwDwaVYwJX/mDaJ1zC4XYZ:GuuR7LJLRwUYoP/c4XYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775600965, "uuid": "e2766925-b6fd-4134-a5ba-8a1327bda316", "value": 4187928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775600965, "uuid": "4503bc00-58e3-4f7d-9191-5a4ebcd9dd8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775600965, "uuid": "ee992877-26d4-4132-87c9-d7fc2a4058a5", "value": "KeePass-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ce227d-327a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775563715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563715, "uuid": "71f96484-a918-459f-a53c-f47a00a60707", "comment": "Malware payload (AgentTesla)", "value": "7f8ea0df17ad7196e1bf4154aad01978", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563715, "uuid": "c53444d0-984d-48b5-a414-adda26f303d3", "comment": "Malware payload (AgentTesla)", "value": "fa896bde7e5b0df86638be400f3c07bc493164e2140ec02bf1305efe09d4a7cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563715, "uuid": "01fab824-edf9-49fd-b883-ab88dc65d63f", "comment": "Malware payload (AgentTesla)", "value": "9e5d5769805e73cc211c03cd49fb8f35612decdc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563715, "uuid": "0a9f1d76-2faa-464b-aa01-f841f80f6c52", "comment": "Malware payload (AgentTesla)", "value": "ca5b0bacc878d45915eb6f94e865fecb7edb1810901e709e4f39ba56dac7140a30776a22218e83d684b61fb69768b308", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563715, "uuid": "c41662ea-37db-4604-ba97-b4393efdd427", "value": "T1F464CF42E2F91014B8FF5F98857A85815976FE662E2ED4EC14180C6C8A68F46CDF3B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563715, "uuid": "661154ab-f16c-4060-b9b1-0fe0c8c42f57", "value": "6144:XoLwDYT3dDDnTNNZwK45C4ouvXKoLBt+0G4TQyi8J432p3Rn:4Lw8ZDDnTNNZPwC0K+I964qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563715, "uuid": "7cb5f689-f34a-4fc4-9678-13a649d0d51c", "value": 325718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563715, "uuid": "c90c4988-f0e0-4634-a1fe-69b2cc0a84fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563715, "uuid": "d2acfccd-477b-47bf-bb7d-e2e5f32b0c0d", "value": "SO# A56DX04471.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1745584-3279-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775563340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563340, "uuid": "dade8d5d-eb05-4b57-aa77-596ab46a6fda", "comment": "Malware payload (AgentTesla)", "value": "fe11be2cd9276ab64a70159feb45fc4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563340, "uuid": "036f0d31-5a31-427e-980e-58ca65eb8e27", "comment": "Malware payload (AgentTesla)", "value": "fac2970d3071597d5fa8272eede43c2731bd44ec42e8cdcf66961dff07e67957", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563340, "uuid": "ded118cb-a06c-42f3-869f-b53897b79202", "comment": "Malware payload (AgentTesla)", "value": "2be7368e2c810eaa093c986cb22bf4d50ac8cf4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775563340, "uuid": "cb594b77-36bd-4980-8d4d-153bcee97968", "comment": "Malware payload (AgentTesla)", "value": "f26748bbc39d4178b60a0e26208488b3ee35317aeb1c1ccadf1e1f972dbaac028e192ee61ede37f76742ab8dea978e45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563340, "uuid": "6c18da4d-4ecc-4f18-8ba8-8c4742c46d5d", "value": "T1E665021189C42FB9CFAD161D40FE160E93F14A8F542AB989FB73BD47AFE7644061B188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563340, "uuid": "aa3156c7-8c09-4e49-aeaa-14712f28c4ed", "value": "24576:/wJU7ysbHag8wzG3vfCTvCY2MGr9d/tXuUPqo/:/wJeym7K/avvri9FZuBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775563340, "uuid": "acd8d926-e0d0-42fb-aaaa-d92b04095db0", "value": 1445051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775563340, "uuid": "89aa725a-2462-47c2-9b49-66d0f51ea69f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775563340, "uuid": "4e57d9aa-0476-496c-845d-9f57bddc5bc7", "value": "Credit Note A12345-045_20260403.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e623d83-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561912, "uuid": "6914aa7d-7d80-41d3-8200-651270397c51", "comment": "Malware payload (Mirai)", "value": "7fb1f23c921d96c73e8027a411e6876e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561912, "uuid": "350bc672-cd3b-43f0-9a78-5a1fa91b886b", "comment": "Malware payload (Mirai)", "value": "fb23d25776eba426752a7733dc5828d1c149696b0a7926cb579239efadd55bbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561912, "uuid": "09108446-3510-41c3-a67b-b1b75b838d23", "comment": "Malware payload (Mirai)", "value": "a3a9b925d864f41c1fbd5eb8c59d7c0ea1a6b687", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561912, "uuid": "6b22372c-5e43-4ccf-85f3-70810a1921b7", "comment": "Malware payload (Mirai)", "value": "4cbb4799e71c0df42b09aabf76fbf7c9603e5d1ebf09c24ef892def1008e51533e4914f2753895db441e4e9444a23fe4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561912, "uuid": "4c603a4a-a901-4d56-b170-ec7a19b921da", "value": "T17B83E745BA819F01D4D622BAFB9F414933137BB8E3FE7102DD246F54238A99B0F76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561912, "uuid": "9ae3cd45-eb5c-42c6-baf6-b46db1e0ddaf", "value": "1536:3jn1qHMQUa90duHvPK480v1JnteHqbCEmk5K0Nyam/pJvCltsYJi9540o0LSW:pqHMQUaSdO645Jnzb/mk5K0Nya2CK54I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561912, "uuid": "7db4242d-7210-4c7e-b358-a8caeb169e37", "value": 87572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561912, "uuid": "e07cf391-571a-4385-aa6b-24d3fceae0ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561912, "uuid": "ddb78ef5-ada7-4621-bb33-16f5489e4add", "value": "narm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6bfdcd-3219-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1775522103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775522103, "uuid": "dfab488f-1767-4333-9117-e0507fe53876", "comment": "Malware payload (LummaStealer)", "value": "2c38d87650929640b2f04d813e1e6224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775522103, "uuid": "78098ac4-d1fb-401f-8b98-83c30209d5da", "comment": "Malware payload (LummaStealer)", "value": "fbd439ccc92eb7001421e0cd50efaffa599cc4d3856e65799e51ed64a93bdf1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775522103, "uuid": "8b164d50-8a05-4424-b107-31b6dedd37c9", "comment": "Malware payload (LummaStealer)", "value": "79d60d51ec47c32fef7c69746b91cbe2c914f85f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775522103, "uuid": "4ef25c6c-4cd6-4fdf-8f8c-4e7ff7f8c812", "comment": "Malware payload (LummaStealer)", "value": "700da0598b8110f8e4e1f0d564eb3213dbe2ec303aae1db81f3585627494eac0aaeb25d691f27f2801b2a1f434583e4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775522103, "uuid": "c09788be-c840-486d-8b14-cb9883dcc14e", "value": "T176B49E88F293726DC783453067BA6B7E9FF639258325CD83E697C788196B5C38933901", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775522103, "uuid": "61bc82d6-a102-48b5-a141-4f42473b1830", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775522103, "uuid": "24114bd9-bc2b-4a94-867e-717b3c38c93a", "value": "12288:SjPkKh6c5bCYaF824EMQ+hCZIqfBACYccvvm:okKh5OYceEMQ+h0qvvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775522103, "uuid": "22ea4ee0-519f-4618-bba4-eb508d23dd51", "value": 536723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775522103, "uuid": "3a62fbc7-efcf-45f4-a798-a1d1e29d8864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775522103, "uuid": "f190d1f0-40fc-464f-8c91-69b2e2ee3cf9", "value": "fbd439ccc92eb7001421e0cd50efaffa599cc4d3856e65799e51ed64a93bdf1f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17194006-3247-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775541633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541633, "uuid": "f5ef09e8-0e3c-437e-b7e9-b1f47183cc2c", "comment": "Malware payload (NetSupport)", "value": "061b7a14e3f2b013dc62ae5c41e8b601", "object_relation": "md5", "Tag": [ { "name": "94-26-83-20", "colour": "#C23D3B", "exportable": true, "hide_tag": false }, { "name": "lusnyak-xyz", "colour": "#4D5563", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541633, "uuid": "37e26d53-326d-4025-97c7-ce8035d91249", "comment": "Malware payload (NetSupport)", "value": "fc235ec697acfa821e1245579d3fc4be86088ab79d4180a5befcc44b0069103d", "object_relation": "sha256", "Tag": [ { "name": "94-26-83-20", "colour": "#C23D3B", "exportable": true, "hide_tag": false }, { "name": "lusnyak-xyz", "colour": "#4D5563", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541633, "uuid": "4498c677-16d5-40b8-aa50-fe968d416cc6", "comment": "Malware payload (NetSupport)", "value": "dae2a959650616320112e0c9483bc91b4efa1636", "object_relation": "sha1", "Tag": [ { "name": "94-26-83-20", "colour": "#C23D3B", "exportable": true, "hide_tag": false }, { "name": "lusnyak-xyz", "colour": "#4D5563", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541633, "uuid": "843f9626-2f5d-418d-b74c-19583af9c5f3", "comment": "Malware payload (NetSupport)", "value": "8998296a41fe648d1dea52da1fe199e44315f2dd5033b03e1e2fa911a1224e10c8e6841fab0e6371082e4e8f72a09fd0", "object_relation": "sha3-384", "Tag": [ { "name": "94-26-83-20", "colour": "#C23D3B", "exportable": true, "hide_tag": false }, { "name": "lusnyak-xyz", "colour": "#4D5563", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541633, "uuid": "986ba031-db5c-4a18-963a-970879b82e11", "value": "T106A2D116B69C7562FFB56AB5244246004FB3B80F23EB2490EBD0DDEAAC716784BC3452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541633, "uuid": "c91203f2-b15a-4ca2-b4e7-f4813c201a90", "value": "384:M2+jA6n6T0ruSFj8EOFHXKF9Vmi77lez+SnrODAgVS4jTuzMp2Kk3RnOSfa3nQ8:M2+x6TLKQXK1myQCSr2VS4jTXaRnPC3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775541633, "uuid": "a6f0dd6c-c9ca-403d-9a31-5ef7b3861959", "value": 22193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775541633, "uuid": "4146117b-9e86-4e91-af28-4656ce3854a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541633, "uuid": "1ad45eed-7eaa-4b44-8cba-8b5414e84586", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551adc46-3246-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775541308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541308, "uuid": "6b6b4dc4-cea6-40c0-90e1-324543e55ace", "comment": "Malware payload (RemcosRAT)", "value": "a06461e4c35debb2a0be838262086d64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541308, "uuid": "9a19c407-ebbf-48dc-9e1b-78866c8080af", "comment": "Malware payload (RemcosRAT)", "value": "fc354d36fa0a0097ac98fb1a0e2862c82c1f9c536277257096d3f10eccb571fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541308, "uuid": "7f35d321-abe7-42f6-8158-b18879dfc063", "comment": "Malware payload (RemcosRAT)", "value": "fd6aaba1d716a9d0f4eea9bffa88b0691f1c03a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775541308, "uuid": "609f06fc-81d9-4ff7-bf54-d8b4504d748d", "comment": "Malware payload (RemcosRAT)", "value": "0d93ac5107d5b4e05769d2595a585a50d684c7b95f576655a73bea6b25e8faf723ec5dd8c9efd3775337786b84c86246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541308, "uuid": "dfbd9714-63e1-4aa1-a068-84d951a5b676", "value": "T1C1650162391FD181F8AD0F311A69FA3987257ED8B800C2069ED8BEE777F2B513416752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541308, "uuid": "48d3cd28-8529-4cc7-bc5d-92b0b8a36405", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541308, "uuid": "28fb1501-0f83-4a90-8c90-638550672700", "value": "24576:fY58+v9/cd7qCpgNNP5gsHytsgMixL85F3c/iHq5B2e6peZt5xrMz:gDvtolp+N3HyOghOUqDnqtgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775541308, "uuid": "e7cabfcd-09e5-4715-b3bf-11c661dde57c", "value": 1451520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775541308, "uuid": "55b1353d-1416-40b8-80fa-f181790e1c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775541308, "uuid": "87007c4a-8bf5-467f-9151-81241262416e", "value": "dwg.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83389ddb-32c0-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775593784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775593784, "uuid": "43d92df4-a154-4950-bffe-2b429caec95c", "comment": "Malware payload (ConnectWise)", "value": "f3db7c92f3cabe1e4d1e6736929e1ed5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775593784, "uuid": "8c2276e8-5983-409d-a7e4-df57b99f84cb", "comment": "Malware payload (ConnectWise)", "value": "fc5e9eef257be1bd7a4ad41092587d3dd1e2d36705f4aaa8bd64677690892eeb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775593784, "uuid": "2f3480f2-3929-42b1-8307-6bf4d89dcd96", "comment": "Malware payload (ConnectWise)", "value": "717a1a615b822d524620cb06c2f1d165058a789a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775593784, "uuid": "b5de1955-7c90-4988-97f1-03c2e6e2635e", "comment": "Malware payload (ConnectWise)", "value": "6db18df15d0313da8caa0893a92a1b279b5d437b4437967f42f924ada3f09e4794fd7a376567faa4ed940de89587c5d2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775593784, "uuid": "563986ae-9083-40cb-b33a-7dc82f14777b", "value": "T1B7A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775593784, "uuid": "357bdaab-4bb2-49cd-82d1-16135ac86d68", "value": "196608:TnCtVYqI5MvbWEpKkq2IJqKFnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqMnCtO:LCXvI5MvHx2JPCXvI5MvHx6CXvI5MvHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775593784, "uuid": "2038a92b-8c01-4d7d-8546-54a23b36b72d", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775593784, "uuid": "db329ffe-2532-4b23-90a3-f2c4da6017e5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775593784, "uuid": "962b3578-ca96-441c-a333-ee152e417faf", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c51b68-32d3-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775601922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601922, "uuid": "54ce4812-f84b-4c1b-b811-d5567315fbb6", "comment": "Malware payload (DCRat)", "value": "12c98e1e800ae21b28b869428d8b17b7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601922, "uuid": "1f3fd1cf-9c12-41fd-b3e0-f28b16129108", "comment": "Malware payload (DCRat)", "value": "fd143774daea49447ddd9c344fda8562da66bce8c18f49d6d301b55bde5c2d4a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601922, "uuid": "95f841b9-0bb4-44cd-9fa4-882879b5a3af", "comment": "Malware payload (DCRat)", "value": "42fa745418dcc48901100ebbabdff89f2b578bba", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775601922, "uuid": "e9d635a0-9b6a-4e0e-92f3-864152a60f17", "comment": "Malware payload (DCRat)", "value": "8af332d783ca353a97dcb47edf1b525c6f85374b1c0194dc91a927ff2741ad3706af6ca554bd3ad7e5aee70ef4f53c27", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601922, "uuid": "a75e77b4-fdee-40f7-94f9-7aac8c227a76", "value": "T14C05E6027E44CA52F0091273C2EF454847B0E9516BA6E32B7DBA77BE5512397BC0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601922, "uuid": "6c945472-7f17-45f8-bdf9-bffa3a5b474c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601922, "uuid": "7bf91141-29e7-4027-9407-fd2682cd15ec", "value": "12288:TPsnSOklUxcnwxYQiZMYiJrqhMmR/dpwHJ4pyD4yKhUMsXYg+ljp:Tj3lUxcDQimeXCyyWUMfg+Vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775601922, "uuid": "c33d3c31-496c-4365-93e0-2bda513f2f5c", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775601922, "uuid": "0ff8c34a-9dc8-4a31-86f1-11878dbca280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775601922, "uuid": "cb40ffbf-ad85-44d7-a69a-deec219e48ab", "value": "12c98e1e800ae21b28b869428d8b17b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becd7914-32c8-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775597320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775597320, "uuid": "e304f663-c130-4043-a8a9-5c059d080385", "comment": "Malware payload (RustyStealer)", "value": "1089e06c2e68a41955f35c606fe932b6", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775597320, "uuid": "f20a5f6c-d9d2-4131-9cd2-e9b3ad3ea8f2", "comment": "Malware payload (RustyStealer)", "value": "fe614d1ee6ad1f37cc2f41d24cfbbc374e1366a87b86da67a1ee03c7b0091b50", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775597320, "uuid": "2cad4db9-1eaa-4de9-a1e6-b783a3aeda59", "comment": "Malware payload (RustyStealer)", "value": "cedf6280e8ac168ee57ce6655afa3a3c6f2fe815", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775597320, "uuid": "1660a763-f3ae-4c2d-9c54-0e3f5b3b7e42", "comment": "Malware payload (RustyStealer)", "value": "10418ab7b3d454f480280f9af5f826b78b0ca9046d9cdcd1e4f63123da2999a03fd3c84ef96f001a39938283da847369", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775597320, "uuid": "c80ff802-aaf2-4d87-84da-4919a029e95d", "value": "T14DC5E082A3F5E0CCE295013248C78AEB39336ED945647F8F9322C1790792D559E73DAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775597320, "uuid": "bb82bc67-1e52-432d-a386-7998ffadaf61", "value": "944a358417389f0d0bc02b5eede0017b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775597320, "uuid": "274b550c-c7e3-480b-9d78-d5033aedcba9", "value": "49152:hefmDu9EG8O3T1LUvvH3p8vnXFJ3lwcXSqG5RoeYDXh5UHHREcUXxOGO0bHtewYq:hYEQUvvXp43ucGfRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775597320, "uuid": "10e11776-0d73-42fd-9c97-3cf26c95b566", "value": 2699776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775597320, "uuid": "4bc54cbc-3771-4f95-ac44-1a85b19ab5ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775597320, "uuid": "a53f7f34-8b55-42d7-a319-fb0e0a4ae5b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d49df4-3261-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775553100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553100, "uuid": "aab2fb19-bc8e-4bed-bd16-099e9a165f5a", "comment": "Malware payload (Mirai)", "value": "b8715b923fc09a5486a57c34d484db53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553100, "uuid": "824bec12-e9a2-4b90-9b0e-46a09246922e", "comment": "Malware payload (Mirai)", "value": "ff54d4549d50b5842d9326b5f9de8d50e2037c838cace94787f01567ec05f9af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553100, "uuid": "5b2533ea-40c5-471c-8743-d5c248aed2aa", "comment": "Malware payload (Mirai)", "value": "9961033c13c6ce0cf3f18eb45c5e524a7c654ea9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775553100, "uuid": "2abaf65e-ad43-47b5-82c9-6574fd643839", "comment": "Malware payload (Mirai)", "value": "6a43ad95339f8c86f729f7f12ebbf9bf61a15b94400ae84e0ea7432c920688b4de1f61cf3ce9c85c719b9ffbc08fd427", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553100, "uuid": "174eadde-fb5f-494e-b7e1-f940694d6b24", "value": "T19D331991BCC29912CAD42376FA2E01CD332663A9D1DF72179D216F1137DA82F0D7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553100, "uuid": "fe7033e0-b18b-4f1b-9c69-df45344d9351", "value": "768:B3oGCh6mppCK2FdThNutUGUiT5lBCC/L0wIefWBJNoiiCQBNwoxBA1sH9ATE:9oGaTDC7F4Uitl0K0wIefAJlSxey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775553100, "uuid": "7f2ba87a-0866-4c27-ab9b-c3c3e06e0c3f", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775553100, "uuid": "22d005b3-561f-4538-bbf7-9b0d19c9f497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775553100, "uuid": "53cede2f-1199-4e7f-999b-2179b495c4f0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32252d2d-3226-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1775527505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775527505, "uuid": "678d6ecf-1b08-487b-97ec-30e4213687e4", "comment": "Malware payload (Joker)", "value": "7f567069738c4a4758dc22fac85df569", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775527505, "uuid": "9d53ddce-5afa-4651-98b8-3cc4b49c8757", "comment": "Malware payload (Joker)", "value": "ff646d00330c7c39068e15dbb78b1bc596610b3bdf5a2b3876e8090faacd7c1b", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775527505, "uuid": "a3e02f32-7b99-4819-9fc4-33390d0620a2", "comment": "Malware payload (Joker)", "value": "3e59634f70a8b3b86a08e310b15ef653a85adb47", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775527505, "uuid": "b8254b03-13aa-4ed8-92f4-15ab7ae3b9e1", "comment": "Malware payload (Joker)", "value": "5e1789133474365b2663841b04d791dcc8f84db4d8f47166a1f1a474c1bef09a62abf74b6748f06f64970f0c02da186d", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775527505, "uuid": "97bd0c3d-c25d-4a9d-aaed-ab6d6b56a209", "value": "T19D27120AEF4C7C2FCDB6B4784A99923178267C699700C7E7A911726CBE739E84E113D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775527505, "uuid": "65711498-82f4-4f10-8cf4-1ffbb52525cc", "value": "393216:cdjAAEAYPOC/HUF4SpMy6ycLKPi9bT3eNoEQX8xiLGGYLmL:cdjAAETOC/O9pMysGP0332QX1LGBLmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775527505, "uuid": "2a9de007-eb51-488a-bc22-258b1ab721b7", "value": 21899508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775527505, "uuid": "1bb7113b-14d5-49a7-8bb8-80cfe05c870c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775527505, "uuid": "7eb4595a-ca44-4361-8b39-3a4705ce7756", "value": "Pure+Junk+Cleaner_1.4.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17435436-3284-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775567833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567833, "uuid": "c88e6630-3b13-4d62-b5e9-94ed2003a434", "comment": "Malware payload", "value": "dc5ca868b0c799e5d554e61f78bd683f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567833, "uuid": "b998601d-04b8-426b-b339-0ad9eb33b1b8", "comment": "Malware payload", "value": "ff6b1ee65ac21ef700d342f5d58e4f907bbe62816cd6a52875fc3cde1c8ec905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567833, "uuid": "e11d6b8d-b547-4a4a-ba0f-89b43b0917a7", "comment": "Malware payload", "value": "4af9f0d29cb6c8e10f10171da8b2261336edcb51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775567833, "uuid": "5217fe80-9d9a-4b5c-bcc3-d8524b607741", "comment": "Malware payload", "value": "10e5236769cd54dfab950658220c86a8ecd041820a14e70d8c14150cf5cded99fbe97b5053ee0fb20dddcd17dc540c9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567833, "uuid": "0213eb17-c098-412e-befa-87d6f6cd903d", "value": "T16208331A5074C08ECAFB18BE46915952BBFCF61361CA3C2DB35C90743DD3A89D5826BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567833, "uuid": "3803f1d5-4fb7-4ce9-adce-1cfc9efa3922", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567833, "uuid": "7dcfb73e-79d3-45c9-992e-d5fb684e33b8", "value": "1572864:Nt9IKPsiFfRWYlekfXFYQWwUrFJ7M05Etl/5r+v/K7:NUKZFfRWfktYQWwUx+4shrc/K7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775567833, "uuid": "0d5e4dd0-fa2a-4fb9-abc8-850fda154879", "value": 77489046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775567833, "uuid": "2336ef51-16e4-485e-8ee3-26880ecc9696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775567833, "uuid": "b7642b04-3b44-4406-b82b-124bdb748c2b", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dbf62d-3276-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775561975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561975, "uuid": "46216044-bf6c-404b-bc80-6233d2d8ed73", "comment": "Malware payload (Mirai)", "value": "5fbaa7f329211c334a103a18905f7650", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561975, "uuid": "e0c291f3-9bcc-4483-b25d-e664fe892b05", "comment": "Malware payload (Mirai)", "value": "ffad0f3c1ce11a68483857f866efac8afdcda20c2ca1f1faecb79d99757d0140", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561975, "uuid": "917ef076-3f0d-41f0-84bd-12837f7299e6", "comment": "Malware payload (Mirai)", "value": "6397051549f51f4505124a80ffdd0ca1e0acc9f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775561975, "uuid": "720d8b9c-238d-4a0e-ad6d-6bb9dd987f97", "comment": "Malware payload (Mirai)", "value": "638113c91567bda0c6dc21ef37581c1954d81997523a721e0c7deff698afb8aa20c7ab1ed66f97e5ca96c089eb5afb8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561975, "uuid": "69de30a5-2ca6-4184-985c-86b009ce9133", "value": "T1429302A0E9276172CB61107B8B12C11FE7DD379D981C2192946C9B287AC75E71B30FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561975, "uuid": "f415b660-f35e-4e18-9e50-5204e8c05aab", "value": "1536:jbSaH2As0Jtqm5Efj+85fZB4EdKKakwZOQC+v73MnT2rq5sKU7Uva4DLy:XSaH9seqCIj+ux+ew1ZiTYq5sb7UvXLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775561975, "uuid": "62db2b60-c06b-4f09-8428-9b217dd11508", "value": 93896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775561975, "uuid": "f7d5d0dd-59d4-416a-b365-fd3648d8858b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775561975, "uuid": "d44956ba-d3a1-4936-b20c-944c35c6412a", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca74d1d8-3260-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775552672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552672, "uuid": "fc80c2ea-d414-49d4-a6c8-af759fdc59aa", "comment": "Malware payload (Mirai)", "value": "bfdd8cbff3d4e01c82dab8b24a3b27b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552672, "uuid": "a86cf72f-8a65-4a50-bed9-12f7d28a816b", "comment": "Malware payload (Mirai)", "value": "ffd5ee4b0efbb32595646f2aeb16476a79332a9b6f84245a52e14bd4cc897a91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552672, "uuid": "d94ba04e-a129-449c-8969-dbaac3863439", "comment": "Malware payload (Mirai)", "value": "0a2851d23123dc919a1eecab7e8f554ad42857eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775552672, "uuid": "74d2a363-f8d4-4c02-968d-847854d2d703", "comment": "Malware payload (Mirai)", "value": "f4a6ccc900b1e1f18394206d5087d8ac88ff8ba239054e78474b4ade1fd92504a89292f6fa6c290a8c54b01b3be26e7a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552672, "uuid": "801517aa-720c-4972-a0ff-8997404bbf1d", "value": "T1885301E1AB9234F1F13094F37E7888037C3FAFB054EE75A7A660949458F12941DE94A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552672, "uuid": "96b12b44-4a01-4897-9eb0-20564b5c6350", "value": "1536:kiduWD4PayiH4LbKsrhNR9Vx1sLiIm2oSEkQySNrb6G:Zdu8nyR/Ks9X0Lrvopjy0X6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775552672, "uuid": "f85acf45-3871-49bf-8428-28bfc74cba53", "value": 61876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775552672, "uuid": "77501aa6-42c2-4f8a-b3a8-d0a30e978907", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775552672, "uuid": "39ebff70-adbf-46a9-80f8-8fe4b87bb306", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c2d6c8-3269-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775556209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556209, "uuid": "32521a3a-b5bd-402e-80c2-ad4ba369e0f8", "comment": "Malware payload", "value": "7c1a801cb5ca5b3fca96901eabd52dbf", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556209, "uuid": "14f00714-826e-4f1e-a119-aaae394056fd", "comment": "Malware payload", "value": "fff7864019b651bea2448228d6557d995edc929276bb9d8cb34c3c280a42684e", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556209, "uuid": "8f7207b9-0ea3-4b0b-90af-119498adab02", "comment": "Malware payload", "value": "40c972a1413cf9a842da0e448e4f84659aa5512f", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775556209, "uuid": "808dee9c-e95d-41d6-96fe-3070a897a92f", "comment": "Malware payload", "value": "c4d5e9f552360ca19c35f5f5889fa8d8ae7e7238d9bf468ad19b991daf79e8be18bfc5a6c1bd920147cbb7cf23b81d91", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556209, "uuid": "eb2cf9b9-d6d1-409b-a57d-c3415826f9bd", "value": "T1FC853330DB4FA1ACD139E474EAE19C74D55DF4196A324E9A60B3C3C36C985B090A3BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556209, "uuid": "8bea46f0-f854-47ac-95c3-a3bde757a9ee", "value": "49152:tMHOmy7CPzWqfkXjeyUXf6/PIz/ZzUVO30hwbba:SOmy7ClskoAz/Z930hmba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775556209, "uuid": "b4d258e2-84fa-4c42-bf38-6f314513e1a3", "value": 1769722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775556209, "uuid": "cd190baa-3596-497b-b665-2774169765f8", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775556209, "uuid": "726afb67-20a9-466d-ace9-1232b02d1cfd", "value": "e-Fatura.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }