{ "Event": { "published": true, "date": "2025-06-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-06-01", "timestamp": 1748822581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2d3b6365-a5e9-4f8a-ae42-6143866d624e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb01f0dc-3e80-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748738413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738413, "uuid": "6389ae22-49a6-4528-b918-a3fed5b2c634", "comment": "Malware payload (MassLogger)", "value": "6c1d2024b2b87cddf29d02c5a16a3471", "object_relation": "md5", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738413, "uuid": "c966b216-0262-41d4-94b1-84e57222ce5e", "comment": "Malware payload (MassLogger)", "value": "004fabd65412e1bab2743ca00bc950ef89d3f4bdd48430b43b0e35f969781ab5", "object_relation": "sha256", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738413, "uuid": "cb322eff-4562-43fc-9fde-f052b45ad8f8", "comment": "Malware payload (MassLogger)", "value": "6b29e85627c999635872d1c18ce173962ed6a685", "object_relation": "sha1", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738413, "uuid": "a3f30879-f799-471e-b59a-ea9cbeb75bd8", "comment": "Malware payload (MassLogger)", "value": "226150f7b29d2496a500e3af0d4e5153ae9856114b7fe42001962b025d7be5bb8b4aa779e2465f4a11bd8d8b1a9c0d31", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738413, "uuid": "fbd549a7-d52d-402a-a08d-efb34b3cdc47", "value": "T19325BF1373DD8361C7B25273BA26B701AEBB782506B5F96B2FD4093DE820122525E773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738413, "uuid": "5f0f9735-9647-452d-9a7b-d7ae7b39ff73", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738413, "uuid": "2e3cc012-8861-4776-829f-1d9a8f436427", "value": "24576:mtb20pkaCqT5TBWgNQ7asRk+9gnfoC8aH6A:TVg5tQ7asRk+OQC8s5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748738413, "uuid": "dddc8fb0-b230-4173-b628-c97d19269188", "value": 1038336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748738413, "uuid": "d444700d-33a8-4535-bb9c-ea0c8bf6353f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738413, "uuid": "4f732c49-1ee1-408e-b044-077761f63302", "value": "linkingff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7e97d2-3f0e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748799027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799027, "uuid": "377c6e85-1c7a-4152-a958-3f95cdc8a3c1", "comment": "Malware payload (LummaStealer)", "value": "1d52f6d27cf67db7af9e6eb849ef534a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799027, "uuid": "1867a8ce-8ab1-4a3a-b1c2-bd7724bd63e9", "comment": "Malware payload (LummaStealer)", "value": "00a52b97eba83caaee8c9d597f832eed56373ac1b73c905dc9de7337973cb7be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799027, "uuid": "d2abedcc-e48b-43d8-9d55-661422b12b81", "comment": "Malware payload (LummaStealer)", "value": "e289d9bb09cfd6b487eb09adc2e6e08e45cdfa1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799027, "uuid": "d816b02a-388a-425d-9cf7-c2fb622baf5b", "comment": "Malware payload (LummaStealer)", "value": "902a826dbe8d679fdd10b4460f7bdbedac9c1f8db1a5bb86e24e53d1b3f7b8313238c3441b32eb6e337634ad25c1efee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799027, "uuid": "31510cb4-6ff8-46db-a714-a57e6f2b6f89", "value": "T1FA044B1A77AB90E4C963C03C8C36A347EBB974A127225AFA41D84135DE26560FF1EF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799027, "uuid": "a4a172e1-9e41-4931-82ed-db5a916ee8d8", "value": "a76da95c1253a4f485f962d308485406", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799027, "uuid": "7371fa28-0a13-48d8-bbea-a35dd39c4a88", "value": "3072:vYKSOcCXhdB5/KlhvvxbJvHrwK+wKBYNc:QKSOcCXhvkll7vH0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799027, "uuid": "4f92b9cc-006c-4fdf-808a-c6bffb40096a", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799027, "uuid": "2e92abfe-13bc-4255-a801-baf201d610d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799027, "uuid": "04551843-fe84-49cf-ab0e-09dade3ae61b", "value": "1d52f6d27cf67db7af9e6eb849ef534a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc356e63-3ec0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Akira)", "timestamp": 1748765849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765849, "uuid": "288d101e-ab43-4f3e-8936-7dfbd6590030", "comment": "Malware payload (Akira)", "value": "b0b9a31de4dfd11bf267dd781b47230a", "object_relation": "md5", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765849, "uuid": "c7c1a343-d904-477b-b047-eae31919b107", "comment": "Malware payload (Akira)", "value": "00fd368983e0825b36e03a014e1bd5f622fb880bf17082f89785b829fe2d0d80", "object_relation": "sha256", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765849, "uuid": "8a8ae029-c2ba-446b-8bcf-dabfd835ad4b", "comment": "Malware payload (Akira)", "value": "35541512f4451b93052e30eb5747e35fd8ad16b2", "object_relation": "sha1", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765849, "uuid": "abf68a54-8e34-4e9a-961e-0b68c84c1141", "comment": "Malware payload (Akira)", "value": "c3e3d0a84130ec95290cb7b73b18faede77eaa9b0d979f758d2e3e49c49be73bd461a7181faf441850c214a73c893ae6", "object_relation": "sha3-384", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765849, "uuid": "6977b264-3aff-480e-a352-eb5fef436569", "value": "T126351841A4164AF6F6528ABD4922C12FEEF736050B10EAE75581B23E2F070ED2F7C759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765849, "uuid": "9f193138-9f14-4469-a074-b4c391500302", "value": "9b9e1545a27f74c7e825990e6d713212", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765849, "uuid": "3d134d8a-0926-4a88-95cd-89905cb8f5bb", "value": "12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTdUf:Vpp+Q+u5bUI8pij1NkshdMf99etb5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765849, "uuid": "536602df-2605-4368-933e-917c566e22b3", "value": 1074531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765849, "uuid": "4be186db-7fca-40bb-99fc-dff87efa166e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765849, "uuid": "9e57a545-dd4a-4138-8d2f-1fe7a861676a", "value": "00fd368983e0825b36e03a014e1bd5f622fb880bf17082f89785b829fe2d0d80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16867888-3ee5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ACRStealer)", "timestamp": 1748781409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781409, "uuid": "62baedd0-ddd0-41c2-9031-7c2f1e6f6074", "comment": "Malware payload (ACRStealer)", "value": "bd5e2fae489115dd0cae5d537080e474", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781409, "uuid": "6038d5d8-0da7-47ff-973f-45b0f4dd3ecc", "comment": "Malware payload (ACRStealer)", "value": "0212ebdc4263a9134f3697f12ae73e7185f8bd558c1bbc71de117e69f44532ba", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781409, "uuid": "1da185a7-015e-441b-a868-25b90d180ce0", "comment": "Malware payload (ACRStealer)", "value": "641fe403963f2bd80384be367077e692ce49af62", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781409, "uuid": "1c00bc94-7e19-4dbe-bf11-20473a3f41d6", "comment": "Malware payload (ACRStealer)", "value": "3da8325d78915fd74a5624a1e5c0882e6ef77f64e7a8418b368b0038217cb6470eed1b3204bbfe7a99a6e8144664709d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781409, "uuid": "77c22bb7-cd67-453e-af73-e159976c2fe5", "value": "T18A163A317762867AF57162B1293CAA6E442978710779F4CBC2584C2AEDB8EC30E35F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781409, "uuid": "5cae6b90-1775-4ccd-9c8c-f7d2d86b7811", "value": "a808bf13b36a9a40af14764d13d4ceea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781409, "uuid": "a05696b7-964e-4e87-851f-ec3a60e76e60", "value": "49152:SbuAO2gfU8yih0xSamkElINJYlhOoe8QUvrKqXYuWNrD3yrw3wTYE2VSjRmggDS/:zMCKSb2+3jjz2Qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781409, "uuid": "830149f9-e7a7-4ebd-8530-d39bf740b845", "value": 4093896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781409, "uuid": "205c468e-9e4e-4dfb-9698-18adda242606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781409, "uuid": "b82f348e-0b1d-4c0a-b97c-5e97be79d385", "value": "Full-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747701af-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748800035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800035, "uuid": "0dc67f0a-c96f-478e-be8d-86a0e66dc122", "comment": "Malware payload (CoinMiner)", "value": "139993dd8e6de02e0ca4719c4059bd2c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800035, "uuid": "67ba88ca-839e-436f-9e7d-bf7827787711", "comment": "Malware payload (CoinMiner)", "value": "02707c3ddf2dbeed4756aad1ce72bcb1321962f3b679dd3c65cfd907498fcffe", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800035, "uuid": "7ead2953-fc9e-4a24-b728-4caadd59ca11", "comment": "Malware payload (CoinMiner)", "value": "359281e3fa8fd326dab25193d5185b6dbf82d099", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800035, "uuid": "265d0325-0e17-4e26-84ad-db9698d9e87c", "comment": "Malware payload (CoinMiner)", "value": "5be026ada4c3113d3eb452f942578e7d5c04f0e5b1628fafd09e5ee9f84f51308f8cd3180ea841cae14c48183a11261d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800035, "uuid": "2468d257-80b1-474b-bf04-cd5c7a3007d9", "value": "T1AED53382F0F428B2D14EAFF4D4BAE6F664DE5E6BB61025A2820E17554A7DC027FC5C1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800035, "uuid": "7de92497-ec22-42db-b2ae-01d219a25114", "value": "323fcaf6a109cbcd5a90f19dbea399d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800035, "uuid": "b2856757-4bb9-4a56-af5f-c6b621951a07", "value": "49152:cnTDqpFT+t2h3f8YuHZtS2mF2OlTTbqTEGhqRKct+xi:cn+FT+t2hPL0ZtCYkqTEGIRxmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800035, "uuid": "623f456f-b3ee-40e2-b4db-62b06b3a03fe", "value": 2857984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800035, "uuid": "e3552834-5033-4b8d-8aff-e0220dca250a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800035, "uuid": "54274c91-8371-41a4-ab0d-bbc9238c0ad0", "value": "addon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb30b59d-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748798892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798892, "uuid": "9896b4d2-bef3-4ba3-8366-264bcf26d2a1", "comment": "Malware payload", "value": "fba2c254e617dd07e1dab9cd8300fd98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798892, "uuid": "ef564b9e-aeb8-46e3-b4d0-80682119a645", "comment": "Malware payload", "value": "0293276933caf9446922cb739626f81b1afba793d3a143d1631b199fd1d6f564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798892, "uuid": "50685412-9b4c-4573-a8d2-0ee452b9435f", "comment": "Malware payload", "value": "903359ce085a1fe35aa481397ee21793aaae5202", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798892, "uuid": "e0fec3bb-ed73-4e78-9c0d-e9ed425b6e90", "comment": "Malware payload", "value": "7a3f6c61f1e40e10794ab9cff17e2723a581c06b55114333d45671a023fbdf242074b2b39dfea56a29e06698421271cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798892, "uuid": "f945df23-5a73-42f3-977f-14014373f887", "value": "T14926337735332CBFD65946F8A4E2AC13CD461B0E18960DA4F28E07E5389335697E9BB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798892, "uuid": "625e0af7-30d2-49c1-a73f-1910a8318cdd", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798892, "uuid": "fc7e2522-cb51-41ff-938f-9677e1da5740", "value": "98304:BndIg7Ja3OZN+cnBRYPDfX04ij8hyCWoqO09k:B+UCOZLnBqPDfX0Twh3W609", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798892, "uuid": "df9d8dee-bbb8-4442-ae19-e347c9fb072f", "value": 4777472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798892, "uuid": "57290af3-1131-46ec-8f21-089c28b3972c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798892, "uuid": "a2f6bd2c-f20f-4f69-a5be-c7fc63794847", "value": "fba2c254e617dd07e1dab9cd8300fd98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223490dd-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748807198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807198, "uuid": "4a0dc075-df07-457c-80ce-c07720a170d7", "comment": "Malware payload (Mirai)", "value": "929e1927d11931278347810206a95a1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807198, "uuid": "5fcaa11c-e80a-4297-bd5e-f5e3de079ce9", "comment": "Malware payload (Mirai)", "value": "03732ced040c955e7e2d3a16ad026758cc25d3b1355608d4492ae590846682b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807198, "uuid": "fed7a98a-df87-4a32-9131-7a58922e8a27", "comment": "Malware payload (Mirai)", "value": "72aab0190e5676afeceb02ff40fa8abab8f7f191", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807198, "uuid": "5f644371-a848-46cb-b8bd-aeffd5b5b392", "comment": "Malware payload (Mirai)", "value": "122dc361ced3083f8c6c6a5c31d81b23dcf3823fc2a509df7461309639689d2ae28f7cad5a283b4f70359cdb18363ea0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807198, "uuid": "8d7b562a-2ef9-4743-9c9e-cb8db1747a4e", "value": "T140B2D03C2B151B98EA1EC0BD439D1B603CB81B359282AD4B6207EDD7AF568747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807198, "uuid": "fbaf0386-713b-4b67-8f7e-c8350e061f09", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiKxmdzJgGlzDpH7uNj1JAv:neD8ZSWvZHZbs1row697qohQvg9Kxizr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807198, "uuid": "089cc928-ac3c-43d4-84b6-44722376ad33", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807198, "uuid": "98cf3611-1df0-4473-a359-11148c80a51f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807198, "uuid": "238b041b-8e96-4210-8140-9306ee046e3a", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f88125d-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748798738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798738, "uuid": "6fc497f7-8705-4125-b4b4-b59c7f9cead2", "comment": "Malware payload", "value": "43577bd5512396c8b5ed917b4a8cf594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798738, "uuid": "832e2329-c781-44c3-874a-9aba923114d5", "comment": "Malware payload", "value": "037ce5f7f67d9247b3eeb3c7707dc70c7f0f0d4f3faf6615ecf64890d082fe05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798738, "uuid": "a07c6729-ca92-4e3d-8399-a39c4b1c3550", "comment": "Malware payload", "value": "369b9bcdf2f80cb3ebed1ffb30e5b6db8135a0d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798738, "uuid": "3ad8137d-989a-45cd-8928-117da2ebf08c", "comment": "Malware payload", "value": "b0301aca03b66548a4f151ad2046532bc6c46cc4be24e0b10bc9fcb6f95d20b431ab6ee656023fb3d85be4ea57799731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798738, "uuid": "3568b6f4-ab2b-4780-924f-0b9b2133a6b9", "value": "T1042633AFD8331D5BE90068F9D8C11176EE8E170C0AF7DD81226D05AD3A862774B61BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798738, "uuid": "3f8fe359-c324-4878-aa11-54ac3571897b", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798738, "uuid": "d056eb55-a9c4-468c-9f47-6cf1720d4613", "value": "98304:U9Z1gJ79ANfdKUxC1amB/wt0xHnnZNbmGBcAxzsfGIxJUH4B:EZY7IKU41HBYonnZdbZsPJUYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798738, "uuid": "23596b1e-c1b1-4d2a-9a3a-9149153f9307", "value": 4734464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798738, "uuid": "af55be4d-e1ac-4ee0-9ea0-531bd9d0428c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798738, "uuid": "bbd01bbd-bf96-4bd5-a0d8-d996b8d003c0", "value": "SecuriteInfo.com.Win64.MalwareX-gen.5881.7621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff8e22e-3ee7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748782284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782284, "uuid": "33cce327-c60b-46b5-b3ab-cc86556c634f", "comment": "Malware payload (Mirai)", "value": "764bab3106539a524807883febbe6e76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782284, "uuid": "20076817-e60a-4b29-91ad-b8deac401d7f", "comment": "Malware payload (Mirai)", "value": "0383603650e7ac2422926bd93cecc65f5f49f9217fe6e2a06f517130f52d8825", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782284, "uuid": "e8557617-74e9-4dc3-9b14-64cf6eac4057", "comment": "Malware payload (Mirai)", "value": "d1d77975a7df0907392f4a15ab3d9ce3e775fa99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782284, "uuid": "daf498e4-7635-44ca-9619-f9be29479908", "comment": "Malware payload (Mirai)", "value": "d342c3e31331ca75f3a95b835b15a8e01c602e3f4c949477fba934088d3755bee69b193d408a67b9a94a439d5af9fe05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782284, "uuid": "a87cca15-0955-4012-bb98-4e4f993e2228", "value": "T18BA35BC0F643E5F5DC4B05B9603BFB365B32E0A9112DEE53C3689E32AC91951DA0A79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782284, "uuid": "dd5db4bf-dfa7-4afc-8052-c34c143015be", "value": "1536:Lcv27fE0PTBP2etZuBn2yAUi78gmcEggsTnN19avl/23i5mdGSTkrwI:Ly27fE0PTplyAD8gcggsrZadu3wy/aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748782284, "uuid": "1fc793f3-9848-4ee2-a107-4d55916a4ff6", "value": 104904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748782284, "uuid": "5dcbdcdd-e6ba-40c2-9e69-6a02d7f6bc8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782284, "uuid": "480cda6d-1bca-410c-a61a-95984931353e", "value": "navo.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74e3c46-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744769, "uuid": "073ccd49-f6e4-48d8-91aa-1968630e9fc7", "comment": "Malware payload (Mirai)", "value": "7851ac7a9865c231a7c770a7500a3046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744769, "uuid": "03817640-ec16-4ef4-a487-6a67d53f4473", "comment": "Malware payload (Mirai)", "value": "03e04617de4df5be1d6237fb2f37dbb730f3dd3ad96eafd88bb29af497c7391b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744769, "uuid": "fa628dfc-27d6-4975-b176-7059fbf0a481", "comment": "Malware payload (Mirai)", "value": "508a54b238973e8231bde9f4d5a63d5b98e68838", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744769, "uuid": "a63ec72c-800c-47d3-9112-ab7047707adf", "comment": "Malware payload (Mirai)", "value": "8d30693e801ace92c4b94ebdb1be0f2d99872d54cf1583358dc16b319ff18d850f5927574764b8382efab5c519c10693", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744769, "uuid": "903097e5-1ce3-4e99-b216-d1a5c9a360f6", "value": "T19C63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744769, "uuid": "ffe00543-675e-49d1-9a83-768f515df335", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAi:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzpL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744769, "uuid": "fa788ab6-3654-43ca-a7ee-0a4a52bd3989", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744769, "uuid": "e40112fd-660a-4e84-970e-9f4004ef1322", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744769, "uuid": "32eec799-0443-4959-9632-f432d00b57de", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8302453c-3eb5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760975, "uuid": "9a4abd47-65f1-473f-a1da-3c040a98a326", "comment": "Malware payload (Mirai)", "value": "fd7575c61812d8fc056a2ae65c906915", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760975, "uuid": "5cacca12-b02c-4089-8b50-37d6d54a86a6", "comment": "Malware payload (Mirai)", "value": "04af16891a4c08b4ea34bc2304b240878d4b141a3de14af7aaddb1ae8db91dc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760975, "uuid": "d004d44d-a83f-4f52-b04f-26c3d0237ab3", "comment": "Malware payload (Mirai)", "value": "24ceee3919d512625befe35a4e69aac9c51105a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760975, "uuid": "5b2ef40e-8297-41a1-81b2-fd6b6d0bdbea", "comment": "Malware payload (Mirai)", "value": "0acf29a1b6779b282ef58be8f15512ce5e569ef5a3e4b5a266a489d2a7f013951addcba43d6a6491739dab71c04cffb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760975, "uuid": "e28c790a-8cf6-46d2-b4d7-2484cdb7658b", "value": "T1D2A2CF320799DBB1C1B0A63E0F78C7D979964535C1E23A3659E8006C6D8B4876C6FB0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760975, "uuid": "690424d0-a8f5-43a6-9803-94b730818aa2", "value": "384:+XWVp9hEWMapxXc6sckWhWAhmtpx2RR73lCmq9otTtWhymdGUop5hSn:5vdMapSBcvm3x2Nl5Ws3Uozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760975, "uuid": "008e1974-fd8d-4f8a-be93-f403632ed370", "value": 22756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760975, "uuid": "7259f662-025c-4085-a939-bc60f059903f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760975, "uuid": "6ee551ff-72ed-4fb5-98b3-f3b561bdb956", "value": "neon.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7ab6a1-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748786548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786548, "uuid": "6aed1683-fc5b-445f-9ac2-01e027d9df1a", "comment": "Malware payload (Gafgyt)", "value": "cff2009d0fcafc4044995e34092d3fba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786548, "uuid": "633c33a2-74a8-4390-96cf-d92fc8e2b78c", "comment": "Malware payload (Gafgyt)", "value": "0543dafd7f4b51224db5ff07fa2a0afb8e09aa36c69dc196e5c6d41aee377f48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786548, "uuid": "57ff203b-362c-4fe2-8c21-93f96f352020", "comment": "Malware payload (Gafgyt)", "value": "619ec1f1b4fc9b5dca035f8b936eadf6867a3e68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786548, "uuid": "fafa43b1-961a-4239-a84b-d4dff81720ca", "comment": "Malware payload (Gafgyt)", "value": "91e12d9ded4fb1930c66669f4441e782e09959431f21964c0e5cb8e47a0042ce6186a1b45b757e36aa2ee39f1c3e0d8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786548, "uuid": "e6c4898a-65d3-40f2-96d6-9cc329bc8e0b", "value": "T1C4F33A06E4404663C1D22BB6B39B528D77235FB997CB3311D9287EB02FE1B9D1A3D990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786548, "uuid": "4af92a66-8f26-4593-aeba-562cc8abb21a", "value": "3072:Ix+Qge59mUDyjOE8QmiZaRT9OpGGHkOWKgetJ8add9QzxsEjzjOZiHmyOQ0LOXDT:IHQmuaZ9nxOWKgetJ8addQJjzjOwHmyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786548, "uuid": "3771f3ad-19a1-4524-bdc2-02f7dc89a6d9", "value": 164549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786548, "uuid": "60b7667d-94f7-4ca9-914d-16e081dc5914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786548, "uuid": "d752efe8-6a58-42b3-92d0-7babaeef0249", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb614758-3e8b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748743111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748743111, "uuid": "76b530c3-6d69-48b3-8443-393e848c7ef6", "comment": "Malware payload", "value": "2648c64711a910797ec85e145d45fe3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748743111, "uuid": "405e6a46-5cc1-4d34-9fe5-1c15b50a506f", "comment": "Malware payload", "value": "057c3508b21674c3ab95c4c0f26a7195a6aba8d35464dfc97d96452479d430de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748743111, "uuid": "d58dff6e-87d8-4b0b-b927-0f341cd5ff82", "comment": "Malware payload", "value": "bca3cd7091f73be66213f7aac1bef1be1527bfb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748743111, "uuid": "bc659933-f776-4fb8-9d5e-0e3c754a4403", "comment": "Malware payload", "value": "5fe62684c5b277c01146af3ad5e72019a349405222ecb464621909ea4fa06122eb017494da1c387fee3ecd90d41dbf74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748743111, "uuid": "c0f35d36-7d74-468a-88c2-9b4535bc84e6", "value": "T140D533911ED8B43BFCC527B954B513628B2639561D2C22FB328522FC4EE55A8B37132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748743111, "uuid": "31b885f1-48b4-43b5-a4eb-f82df4a37b59", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748743111, "uuid": "6c9ac5d8-f44e-4d82-9625-2dccaeae1602", "value": "49152:ROnDZlOiVb/3pYBZpUh0QuM5enR/Iy1TqjUC6R5SAq6Iex20AB4T2zQbk3G4QZDv:ROzJVb/3QGgnR/Iy1TEUnbqiI0AB4XkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748743111, "uuid": "f913e69d-1217-44cd-92f0-9f7031a059be", "value": 2839552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748743111, "uuid": "ad6fda62-ad51-4eb9-af65-3db459a0df2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748743111, "uuid": "0445c3a3-8689-4549-82c9-0df786934645", "value": "057c3508b21674c3ab95c4c0f26a7195a6aba8d35464dfc97d96452479d430de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc05391-3eb7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748761877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761877, "uuid": "4b2fb02d-f65f-40c7-bd6b-566a4258f896", "comment": "Malware payload (Prometei)", "value": "6f85529d46b7bc500bff391cf1f32b52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761877, "uuid": "c50e7da4-8cc8-4ea8-ab70-16dff71ff4f6", "comment": "Malware payload (Prometei)", "value": "05ec8215fba7e100a536575969dae6282931236c000d5273e2aeb5049c3f46e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761877, "uuid": "b598427e-fffe-41ee-a1e0-e0c6636e2aad", "comment": "Malware payload (Prometei)", "value": "b060a618aee72267f91f0acc43ea8337306d0aaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761877, "uuid": "631f7568-e236-4800-8cf9-a1ed2f5883b8", "comment": "Malware payload (Prometei)", "value": "a844b576927a3900b3054db3cbc81d75dbcf013d807989ac41020d4165ba5adec20a57bf60ff494d9baea54d2c2b4e24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761877, "uuid": "6a36499d-f09b-4194-95bb-ad539e5a4196", "value": "T1BA9423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761877, "uuid": "0bc68939-3465-4d8d-af92-eac9b8611a84", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgH:25WOSACZSV6eKRH5EPiamb4DsDwwcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748761877, "uuid": "7dcf4d16-fcb6-4d68-9fb8-59ec31859f0d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748761877, "uuid": "4ba7e519-cd1f-462e-aac7-5bcc1494349c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761877, "uuid": "6e66e343-c390-4b24-a3b3-398b620b1370", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f28694c-3e90-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748745077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745077, "uuid": "2a4180a2-7e5b-4787-9211-1ab18c59a0a3", "comment": "Malware payload (Mirai)", "value": "92a77a422f19dd58c7f6668879f2a0ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745077, "uuid": "d3886f4d-e05a-49db-bdb8-26cc7aeb7180", "comment": "Malware payload (Mirai)", "value": "060912bc707d4387a91e9f8950a2b03a5496bd0bac6f23baa1f218ddd0acf745", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745077, "uuid": "8ceefb22-5a11-4059-b9c0-5a1772797f95", "comment": "Malware payload (Mirai)", "value": "20414f8c3be3af92134fd1038da8232ea767e47f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745077, "uuid": "0e71d059-5ee2-4233-afd3-d197fcf76191", "comment": "Malware payload (Mirai)", "value": "7339f80a760ec6fa3a62662b94d7b22a6e57f80337b6021b5df203e7095cbc2f2117cc0e6ceb56290625bda892f0c8ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745077, "uuid": "b7f4b964-b427-47fa-ab10-854aa683e704", "value": "T1B4C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745077, "uuid": "92863110-a712-4dbd-bf4d-a8c9f016fc92", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoorScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIorSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745077, "uuid": "714c9faa-5b9d-4d14-af26-f9ab17c24b13", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745077, "uuid": "481e25eb-dc5f-4989-b1c3-c0db08bee6fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745077, "uuid": "bb1b2907-f9a8-4f90-874b-3568b5c2cf85", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834de197-3edd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748778156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748778156, "uuid": "be2276b6-1406-42f2-927b-ceebf699e81d", "comment": "Malware payload", "value": "50d29f92a1d8e0da19c47c6a3e836727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748778156, "uuid": "7ebc12c4-cf4a-484f-9ff9-b04707cfcf9c", "comment": "Malware payload", "value": "06eb0d93abb7f1065e967d4aec60c70ff5cff7d05bdd735f60997580c77d1e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748778156, "uuid": "452b57e9-9226-4e61-865e-55ab7037ba35", "comment": "Malware payload", "value": "cce01b9e2dfdc39ab51c56a80e3d3cae4f61ceff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748778156, "uuid": "1139a96d-5605-45d1-927e-1404d2e38d96", "comment": "Malware payload", "value": "712dec302ee538234c88f2e4e3977a622eecaef32b944fd59f5dd100538f5fa1c8f38e3814b1552950f0aa50a26d5447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748778156, "uuid": "246cf9f0-be22-498d-bc01-846d06fff13c", "value": "T130D6028671ED41F9C4AAC23452077A0BF6B1340B43785AFB26C489127F73EE1957EB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748778156, "uuid": "3762ad91-13c8-48e0-a568-21e36e133e20", "value": "196608:tcWqbPTGx120wYaoe7w+FFdOfsBLpbcQe9yrpZ7vSQLydYDYMm+qXU:2pbw120dQrFFQk8Qe98qQmUqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748778156, "uuid": "3c8481c5-13d0-49de-96b7-f938b8018104", "value": 12683776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748778156, "uuid": "5a11c080-38ae-48d5-b117-1b81d1772db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748778156, "uuid": "689fc573-4fe5-47ee-9e8b-2f4c108490e3", "value": "primordial (2).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2b8598-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748799595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799595, "uuid": "b1479f7d-a415-41ae-81db-b219c183f6a6", "comment": "Malware payload (AsyncRAT)", "value": "3b11e260f7c280022618dab517bc7ca1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799595, "uuid": "86a46327-8bfe-42a9-9ba6-d302e32944a3", "comment": "Malware payload (AsyncRAT)", "value": "07bceb052fbbadd1a7bddfcbf27791c64a6a8dfd547649b11244ffd9a0547141", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799595, "uuid": "c2633505-55cf-4509-b991-9b78cc90fffa", "comment": "Malware payload (AsyncRAT)", "value": "63f1ed34645f0cc7b8685ffa38894c2f0349cf4e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799595, "uuid": "d360dc1d-d874-4883-b8b5-6ebf7d7b971d", "comment": "Malware payload (AsyncRAT)", "value": "f73c6ae7bbfa09511d6115b3d00be5bf979f5c367dcd85577fba3fe404ad072e2845c6fe0d28ca426fd8a508e033b43e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799595, "uuid": "41e6b192-267f-4c47-bf39-8acdc72499ac", "value": "T1D795E7AD9F861EFEF82D6963ED9636BD04236B80FED5F4DC0A5326A3131DF0A2100955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799595, "uuid": "faa6a84d-e03a-48a8-aa6c-bd5a79d91f94", "value": "12288:mLZaNCQ1ae8ZtJ73hvoCyaneglcO1LpcqfbwMi1jFUMy8XwN0RwGUhPK1FHB4N0y:m193hgTnzMSvdwhsh4WvKQwiSgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799595, "uuid": "a82eff39-b8f1-4376-abc2-aa9058eb6ba7", "value": 1917015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799595, "uuid": "15b6c34d-401f-4f8d-a2ed-3536a26d2f7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799595, "uuid": "6fdf87dc-ecc1-4002-a730-a67075590811", "value": "ukr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a75d605-3ee8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748782892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782892, "uuid": "2ba107d6-298f-45da-9c30-f664a1034588", "comment": "Malware payload (Mirai)", "value": "b152d1812fdf935acfa499784a49d6cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782892, "uuid": "7c45345c-d295-43cb-afa5-224002111723", "comment": "Malware payload (Mirai)", "value": "07f6d68bbfd15a15e7353f5b8c9f6b974e4ad2c3f4180af21d0ad7bad5b48134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782892, "uuid": "096a36bb-ff8c-4395-a148-57f62d28274a", "comment": "Malware payload (Mirai)", "value": "c7f9d8b6fd63aef040bf9a7e59cc1f1cc075b72b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782892, "uuid": "0224f8d8-9ebe-4d1f-a200-9f79bd01e384", "comment": "Malware payload (Mirai)", "value": "32886d732ce2c30165e6ed26a13c4e0937719413e18f2678e19fc9506f24a05fb467df8e921160b47662aa37645f9904", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782892, "uuid": "852d8304-09c5-4c2a-9ec7-6e3027164a87", "value": "T1F314C716BF610FBBD8ABCD3706E9170129CC654B22A43B3A3674D528F94B50B59E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782892, "uuid": "d6b43485-b68f-4d6a-a3d9-b9e243435922", "value": "3072:minrHzL/5PiAgu2CYh6u7ZfnHfNPUfpuG8tmi:mirTL/9iAgrZ6u7dH1PIuG8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748782892, "uuid": "4c34c2ea-3198-400f-82d0-68f66ebd29fd", "value": 199372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748782892, "uuid": "8535cfc6-07f4-4680-8422-de1fecc1f93a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782892, "uuid": "1d28fd99-2605-4767-b119-7c842db61372", "value": "navo.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ee1206-3eb3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760071, "uuid": "cfdab47a-d261-4cfd-807f-e99def99a6de", "comment": "Malware payload (Mirai)", "value": "02fb64e866d7eef063123a2fbd1a0a21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760071, "uuid": "f5b841ac-615f-400f-a9d9-3ea04f523b48", "comment": "Malware payload (Mirai)", "value": "08abc1a89e2cddf3850e8b47419679b639acf9ec4794d31bf0bdf0f258a86de5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760071, "uuid": "7ce016ab-af9a-4272-891e-1eddd7daaac6", "comment": "Malware payload (Mirai)", "value": "f18fa038860079f6016cbdc11ebe13ced2354a45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760071, "uuid": "7ec6df43-10bb-48ab-a764-319cdde5e570", "comment": "Malware payload (Mirai)", "value": "d2c0b6d091253ba401cc6b58088e471e0fb5828fe8692cecc271a3092144ac2485d827e8918f07937a6c189544723410", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760071, "uuid": "9ade20c0-a12f-44bf-a7e0-32990c3b58d4", "value": "T15DF2E1EFE17A467BC032B0781ACE0590F6618096052E536F1ADC91FF8BF7D940E61E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760071, "uuid": "633a7853-4c12-4ee2-bf9f-f9096b5556c2", "value": "768:VzyaM4sX4pBHUTO8j5RX8InQJH/2Zlc+Cx2yvx0Kw:NyR4BHUTO89x8IQp/2/GxXPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760071, "uuid": "f02a60f1-95d3-4073-b962-490f187b714e", "value": 34740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760071, "uuid": "af2245bd-c785-4a66-aec0-f791e2e31593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760071, "uuid": "40d6402a-af24-462b-a140-29e4badf363e", "value": "neon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a29e59b-3eac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748757122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757122, "uuid": "2b9c0e87-ce55-40ea-90f3-960412323f6d", "comment": "Malware payload (LummaStealer)", "value": "fed5f41f6160d4cf86812160bdffde64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757122, "uuid": "6328f3d8-b1f7-4e01-8dec-16bc391bc65d", "comment": "Malware payload (LummaStealer)", "value": "08adad19176726a36a3256a26a95bb52d2b7011d6681d7c36f617492e29dc112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757122, "uuid": "3090af65-c059-4a68-9029-6979f58b162f", "comment": "Malware payload (LummaStealer)", "value": "57ee160d8de8a7d24ca5952227f68cd1a53e1bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757122, "uuid": "db1fadf9-d6ce-4281-aea1-424a9afe1c62", "comment": "Malware payload (LummaStealer)", "value": "e559c7daa7f094b8b1d05eb68da23d149469f1672c64dd182bac0e1ab2567ab92e8b3cbbf2516b92b5289164cc774119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757122, "uuid": "26cc1452-9200-4c8b-9542-710bf2e10b39", "value": "T1824523534174449ED8734C71A9F6ACEE6EFEECF414A06ED58239749A3F32246922D3C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757122, "uuid": "62b02cac-5156-4407-a408-05ff8211153a", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757122, "uuid": "af5c6085-ba97-492b-ab12-b47643af7577", "value": "24576:C0a+9sCiQM+yNBeAjgIKW0DsNk3yp/615QFYwgtrG73CUxIytA:CydiQqNNj9K14NGY/g5PoxIym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748757122, "uuid": "805e4f7f-a915-409e-91c3-ea065d5a3b43", "value": 1194507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748757122, "uuid": "f4c93caa-5120-44fd-ba7d-8e937c6eedae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757122, "uuid": "cdfb2aab-f86d-4a76-ada4-8cbc6e69fbe8", "value": "VistaLead.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922d3318-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806957, "uuid": "ee6808c4-fedb-4cee-ade4-c4383759cb78", "comment": "Malware payload (Mirai)", "value": "104dd5284c6f0c1f5b50e9419eb2a405", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806957, "uuid": "517628ed-1439-4d7a-ab98-be66dbbdb392", "comment": "Malware payload (Mirai)", "value": "08c2122f79d9c6dd192f60ee49e596af965b20a4f836f611efb20152afe4cfd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806957, "uuid": "f9f983b3-2682-40c1-86a0-7e8cd4ccf8f8", "comment": "Malware payload (Mirai)", "value": "915764c7640ec4026a1dda6a07018855eb9041b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806957, "uuid": "869ed8bd-9a46-4c10-8e5c-646f28736c0f", "comment": "Malware payload (Mirai)", "value": "5c04a760811128365cae4f362e8b3bbff51efb2b1a1cdda6e7508fd7f47cf6110a59c279fd6cabcc173be1ffa7deac58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806957, "uuid": "2fc2d5b2-7368-4d67-910b-6f50e385e0b9", "value": "T16EE34B46FA414B13C0D2177BFA9F414A3322DB94A3DB730689285FB43F86A5F0D63A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806957, "uuid": "651da542-2d65-4033-9841-0a3fabe8e8b3", "value": "3072:faSB8kY4RZeBRlgV8XQfl2sYgI/pwYk/ZIXSDzuz8M/9WaogV:faSB8kY4RZevqL4snI/pwYkBHDzuYM//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806957, "uuid": "afb915e5-084a-487f-9ee7-f5048175027d", "value": 147082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806957, "uuid": "81a7a2eb-b8d8-437a-8464-4121c5632ae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806957, "uuid": "144f8202-79e6-45a2-91ea-00d68262529a", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe93ba0-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748799779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799779, "uuid": "e1ae6f42-a345-45e0-b1b3-f578425a8bde", "comment": "Malware payload", "value": "9e853926cf8b5bc9cdc2a1d01037730e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799779, "uuid": "fef2925c-607d-4bf6-9b9a-288080b117b1", "comment": "Malware payload", "value": "08f053178be834469340c2fbb2cc1b842395052b53d5120891154b9118bf0d3d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799779, "uuid": "33406aa4-01f6-44b5-8e27-b96cd7cd082f", "comment": "Malware payload", "value": "c86917b1df0ca9a1316c80ced545bd682dd31d90", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799779, "uuid": "db50eb75-1e56-4075-987e-0039db253e14", "comment": "Malware payload", "value": "29fffb76eaea86fc7cab50ca9e3713b704b193f9c1ce94f3f23a652b9bcddfb9ecc0bd5bc874c98bd7bee645adfa9b20", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799779, "uuid": "ff4ac4f8-bcbf-4134-8d73-ac0d1e7cb3ed", "value": "T1DD3106280DE112EEF677C7B9ABF8B3B38511FB82DD654BBD014062451722110F8A3E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799779, "uuid": "1387d597-db8a-4f9c-b9c6-fe4cfab5967c", "value": "24:8y/BHYVKVWO+/CWmO04UvOWkb0djUIbsrsysh6FtmuBarab/BiT:8+5aqT4U2WkQdIIAQVh6FtmA4abBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799779, "uuid": "e42883a7-4acb-492e-84ee-b171c76d58bf", "value": 1622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799779, "uuid": "35a1a44f-7d87-4e82-a40f-32e01f29016f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799779, "uuid": "760742a1-9b33-42cc-a8e6-4875d71297f2", "value": "UltraViewer_setup_6.6.113.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876c50c9-3ee8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748782887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782887, "uuid": "a2846092-3632-468e-b225-53527996273c", "comment": "Malware payload (Mirai)", "value": "7d3522207599e13353217ceeb788b2f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782887, "uuid": "9f28ae12-aabd-49f7-93f6-00afded2201c", "comment": "Malware payload (Mirai)", "value": "09befe06e046e0ff65a4a479cfaf1b5eed92eebbe49e8d484bcd870e26d05a37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782887, "uuid": "a4875b52-613c-4fb4-a14c-ea4e7f3e64d0", "comment": "Malware payload (Mirai)", "value": "86f213ea36540f53db552461ef38b31872f71502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782887, "uuid": "b7516ee1-fefb-4414-9c07-9ce4cb43caf2", "comment": "Malware payload (Mirai)", "value": "74b23894386e560073a9205456bb6be8ba80b1fdd7bd0d1cb4658dd62520b1121b82b64a4718fa3e5c33af01fd0536c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782887, "uuid": "c3171ac7-92fc-4edf-82be-2dab19875b75", "value": "T1A6E31845F8405B23C6D712BBFB9E428D372A17A8D3EE72079D216F21378695B0D37A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782887, "uuid": "8b58d89b-607a-45fd-909e-76616bbae41d", "value": "3072:xK+pWe7tPOJHcM51rPKYu7CrjW4R3qUem+n1mqwzIm+C/vbL:xK+p7tkH/GL4Rb+nEqwVP/vbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748782887, "uuid": "75abdc35-7f54-4aa3-8f0b-e827cf67a367", "value": 150336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748782887, "uuid": "1a6ffbef-5aa2-4997-b8f7-1dcc3a0bff07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782887, "uuid": "57b46f0a-7ca9-49ef-a3d2-66673f7be0a8", "value": "navo.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce19c374-3ec2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1748766685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766685, "uuid": "b55c3702-a167-4001-965c-943d60286e12", "comment": "Malware payload (Vidar)", "value": "e76289fa10f1aca28b2c4c6d5c295314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766685, "uuid": "c21dd437-9aaa-40a3-b0c5-b90d0eaf0770", "comment": "Malware payload (Vidar)", "value": "09d74e4be2a2bdcc024b06f897be54a6e8a2c07ecdebb3af1c8729708ce62e4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766685, "uuid": "319e22f3-b044-422c-85fe-075c174cf891", "comment": "Malware payload (Vidar)", "value": "4e08fdae15c326abc3264752abc5d72964091d93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766685, "uuid": "822a2fd2-78f0-4f94-b2e0-38d14b8171ad", "comment": "Malware payload (Vidar)", "value": "709ff3b480beb709a7f387fe9c0107bd1c05a94b475449df0f78bfa8ca0684ccd92c2560707db99259a460d5da4ba219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766685, "uuid": "56d7d617-44fa-4c33-97fa-97d2f5742a56", "value": "T17176BE22B690C837D4734634CC2B97F5653ABE24AF248697B3A17D1C3FB5390391629B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766685, "uuid": "1bb343ca-f75a-422e-87ea-2f14399d6f7b", "value": "f1e2c9e818d06c90325f37537c041206", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766685, "uuid": "e2ba588d-b648-4d79-ac3b-be06b3bdf6f7", "value": "196608:UXJyG+CS3QYEoMxlsjtYbeTwDjYOu/R45DbLJOwQG5e7Q:UXJyG+CS3QYEoMxlsjtYbeTxz/R45wmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748766685, "uuid": "a2cf04d5-7aae-4d45-a797-1d7c509ff4e4", "value": 7728520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748766685, "uuid": "2547d665-291c-422d-a877-8a4b84d9da2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766685, "uuid": "bb236b54-7726-44a6-9c94-7c52b79cfc36", "value": "SecuriteInfo.com.FileRepMalware.7728.22475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f69d1ea-3ee3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748780780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748780780, "uuid": "b8fe9ad4-47f4-469b-a985-4d2b33f47e86", "comment": "Malware payload (Prometei)", "value": "3ad7ccd3770f3e2e816a66c7499ed23c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748780780, "uuid": "72f5581e-a952-4a2f-ad5a-1abf77827166", "comment": "Malware payload (Prometei)", "value": "09f9e2ea0609b59fb0ec879ecf34aeb726018a8eafdd8b158816c236352d8dc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748780780, "uuid": "c8dcc829-5d2f-4d93-86d3-fa913e55f12f", "comment": "Malware payload (Prometei)", "value": "8d8a96232a857d84d66141397449c957dcb2da86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748780780, "uuid": "d85c0c30-123a-40b8-880d-59981d454833", "comment": "Malware payload (Prometei)", "value": "449dea99be1453e16c6f609c897b5dc335eccedfbe34d57999519c671cbdf4965d984538e457b19724bb8790cc7f288f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748780780, "uuid": "32ba79cb-4e05-4fb8-865c-801f7113e44b", "value": "T1629423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748780780, "uuid": "683b50c8-f027-4d96-9736-cb844d58f6b6", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgE:25WOSACZSV6eKRH5EPiamb4DsDwwcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748780780, "uuid": "e64ca929-8f2c-4658-b926-a403e319743d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748780780, "uuid": "5c856705-a908-4e79-a77a-e2fdebf9e3d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748780780, "uuid": "f6d18b45-5072-4922-b132-b7cefee2d83e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78578875-3e90-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748745066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745066, "uuid": "bbbd4bfe-08f9-453b-98e4-60d84073767c", "comment": "Malware payload (Mirai)", "value": "0dc9ec9b352818a4e6da543061467ba2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745066, "uuid": "0d2e543a-922f-4f30-b864-753f93444704", "comment": "Malware payload (Mirai)", "value": "0a41dc9546781b34ef1cf90dc57a83302469c04d7501c7fed31324c0a8b235ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745066, "uuid": "65ddb484-a2c4-4ce5-9602-0e62e78bc977", "comment": "Malware payload (Mirai)", "value": "27ed2fb98a05191253d98d86d35eec1588174471", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745066, "uuid": "624770ef-7757-446b-84b8-2c67c5f42b53", "comment": "Malware payload (Mirai)", "value": "f8104beb30bdd0ba78594586de3881d2044f5f4448452ca00be49140e7dabdc2ac7000eeb20aed3e6ff5d4c1b1a33e35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745066, "uuid": "3afd16dd-2e96-4185-a7dc-ebb97398b8fd", "value": "T175A2D029D3456EF4DFAF9C9452C2C2C276E547C7278AC8E340EEBF022906046B789D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745066, "uuid": "e53db53c-6876-4aac-9977-23c59c12d661", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5uwM4uVcqgw05VxJfw:9RxsSVsMD6xiJJE5zRWNy4uVcqgw09tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745066, "uuid": "bdc4f7ae-ac9d-4563-a244-e24d7fe74412", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745066, "uuid": "20ae6733-3bbd-4c36-9df7-fe595ce2d0db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745066, "uuid": "2aef2f79-9ca8-4e50-95c2-046e4f1e767b", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dd723a-3eb9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Latrodectus)", "timestamp": 1748762891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748762891, "uuid": "79309874-4573-4553-bbf5-d7f4e3f0fc56", "comment": "Malware payload (Latrodectus)", "value": "326d523fd53f5d3b72fecdc1a6fb7574", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748762891, "uuid": "f4bbaa51-b101-4feb-9775-5c45cd4d28eb", "comment": "Malware payload (Latrodectus)", "value": "0a54750e93f9e716b3ce206933b0c8d0d4b2771696ae0104478fe009879b0ea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748762891, "uuid": "479ce0ca-f2f5-485b-beca-1687b39ff56e", "comment": "Malware payload (Latrodectus)", "value": "6ab68498f86f6e643bd719307b7d510c59a4198d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748762891, "uuid": "129990c4-c19f-408f-a4d3-04306155b9fe", "comment": "Malware payload (Latrodectus)", "value": "cb89dc147301d0fb1b2e7bcb024119b5b1d4c3b34cedc436600425a70f7b63e74f0e38255f1404a23e93187d0fe975c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748762891, "uuid": "3ef96f61-2d30-4749-a1a5-e9fcdbb04c84", "value": "T1BD869D69A6BC00E9D4ABC1B8C68A6217E771B81517B057CF1A6486FA1F63BD01F7F700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748762891, "uuid": "2f756ae4-1f0b-4c27-add6-2a3dd987b019", "value": "9f4f6bebc128afddef95b3428263f352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748762891, "uuid": "d18a7950-a6a4-46b5-bb0c-1e292882dfec", "value": "98304:E5PBOGvYvd/i/THzyhdlAx9q7KLEYnAur+ib:qP/vYvd/i/THOLmxGcEnurz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748762891, "uuid": "56b50aa8-23d8-4484-97da-beaa548d0b2b", "value": 7946816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748762891, "uuid": "4218cf3a-2fbd-4a59-82fa-b94fd41238d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748762891, "uuid": "d5723cb6-e28d-4e27-a4a6-11aabf569919", "value": "326d523fd53f5d3b72fecdc1a6fb7574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2b21ed-3eb1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759163, "uuid": "72e95035-dadc-4877-8c3c-3969306bc0d6", "comment": "Malware payload (Mirai)", "value": "ab6b40fbe192d1ce70441298a27caf51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759163, "uuid": "91e47633-ecf6-40b5-9571-d55e3493deb1", "comment": "Malware payload (Mirai)", "value": "0b542de25c02373c7497974aec8daeb2402a0b2505c32d78ebbd3269d317bd6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759163, "uuid": "5cbc2cc2-ae17-4dfe-a6b1-6113b03bdb5a", "comment": "Malware payload (Mirai)", "value": "1e66abbf53a8ec41d177da647e2f2b49ba83b823", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759163, "uuid": "30da2a2f-12ac-40f1-aaa1-059e5fe2de48", "comment": "Malware payload (Mirai)", "value": "d19fe94756ee245227bc69a80d390446af3b269483e9a8975c619cde94907ad6919b8eebab835fbedd09a775be3a3239", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759163, "uuid": "8e0b6cde-4e63-4b2a-b6a3-22692906d20b", "value": "T18DC33B46FB818F03C0D627B5BADF425633239754D3DB33069918AFB43F86A9A4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759163, "uuid": "56da6762-af18-4e4d-861b-7ad136c7c464", "value": "3072:PhJG2pKg9iPbeDyaO/yMvvd7HZ/Tap9TzM/99xJjP8:ppKg9ia7O/yMvl7HJaHPM/9RP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759163, "uuid": "60f2bb8c-3762-4949-b55b-eebbc7f098ff", "value": 119064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759163, "uuid": "4f47b492-603a-4860-88c3-9b47307df2bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759163, "uuid": "6db78952-8cd7-4de2-983f-0d6b72ba4bc0", "value": "owari.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5bc12f-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806952, "uuid": "e104cdef-ee32-49ca-a24a-63d258b49b67", "comment": "Malware payload (Mirai)", "value": "d156725e4963c1a47a2c57251433d074", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806952, "uuid": "27da45c1-1ff6-4d20-b5a9-e20fd10a25f8", "comment": "Malware payload (Mirai)", "value": "0dcd6618e5062f44d80be458716a12b0407db1cca8e0eed94bb15d420a86450f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806952, "uuid": "b2783b46-398f-4fc8-b4f1-ba6617995ecd", "comment": "Malware payload (Mirai)", "value": "8b5b98ebec2549642a071ea65ac916a3fe2d8804", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806952, "uuid": "3e4ca8bf-79e3-41ce-9df6-ce99a6f76eb5", "comment": "Malware payload (Mirai)", "value": "2f4874ac5b3af43f94b327ba26558cb8fd4159fe3835562c645f6f2730ff2f7278c495c16e40c55847cfbe7e21e5faf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806952, "uuid": "aa224fbb-afe0-41ea-9443-92b3c65f64a3", "value": "T1D1630945F8814E26C5D5127EF92D128E372227E9E2DFB223AE205F203BC652B0E77D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806952, "uuid": "e47cfb05-182a-41b1-92eb-80b5a0945589", "value": "1536:6tniOsEFM80acW/lqehlW4LtdB8yB1DcEIji1uzrAZZp:AlFh0Y/lNHvpuzrAZZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806952, "uuid": "d76f8887-dbee-44ed-a3d1-0b78a687331c", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806952, "uuid": "44671db0-87d0-40c6-907e-4dcca5ed3354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806952, "uuid": "049cf47d-74b4-4d33-aeb5-67fcef9c5795", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f739634-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786632, "uuid": "6d7b5e27-1f24-4c8c-a97b-6a23b8d48df9", "comment": "Malware payload (Mirai)", "value": "cce5ccad49f5743f72ab89dcdd2fd238", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786632, "uuid": "a17a39e0-543c-437a-b8d3-46dc63694e0f", "comment": "Malware payload (Mirai)", "value": "0df2764e6faf3d8e02c3322cb940b544e2ec337a217f92254f57cad3ff19d19f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786632, "uuid": "235a3958-9719-4057-9f1d-173aaafae0b6", "comment": "Malware payload (Mirai)", "value": "ce01027ff5d9753b448229b702d58dc86578a0e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786632, "uuid": "9a2b7077-1ccc-4f2f-bbe3-cbdc34735449", "comment": "Malware payload (Mirai)", "value": "dccde8c3facbaba87ca511164c3544ebcfd132641efef9109b40ac532ca8fde269622420cf86700cd9c8630fd10f9107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786632, "uuid": "0666ec8a-d191-4e00-bf85-163313545e04", "value": "T134F32A46E6418A13C0D6177AFAEF424533239B64D3DB73069928BFB43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786632, "uuid": "96162f1f-9030-414b-8f4d-8bd888c1e338", "value": "3072:w7Kw4zl/RF4fapH9VFj4xRSAZFO7sa8E5BXNLxG5M/9PO8m:w7K1QfapH9VFj4uAO7B8EjXNLxsM/9mD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786632, "uuid": "3fd3f95e-c5e1-488a-8cf3-5569b2d0bb58", "value": 159402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786632, "uuid": "ec24b574-4958-4f32-8592-b2a76b76a5d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786632, "uuid": "3db0d9eb-f8df-41bb-b22c-e5230786b44d", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfc5b56-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786575, "uuid": "0aaf474e-9672-433e-b011-09ee5a3d9236", "comment": "Malware payload (Mirai)", "value": "5f40590a558af40dee2ca0396c01db55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786575, "uuid": "064c58e7-9c13-43b9-87b2-84d8e506135d", "comment": "Malware payload (Mirai)", "value": "0e0614dd88ca7deb2070fce26f1551470cdf009fcd079d7ce6c4aa31d714f6c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786575, "uuid": "09d80f79-3219-472b-a2ba-1a51174f7ac2", "comment": "Malware payload (Mirai)", "value": "975d46c216297d02ed604950cf9ccabc35e0fe32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786575, "uuid": "86b61f77-347e-4b6d-8451-8a2ab59005e7", "comment": "Malware payload (Mirai)", "value": "ef48834d0a1e297d36f5e829dd63bbaa7ae5a8a64d55d8b9f708865076f0d584cb5bef7bcf7685d5a82e7095576bf7c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786575, "uuid": "d572eacc-99eb-4a55-896c-e2f89724b6c2", "value": "T1D9A3C81E6E21CFBDF769873147B78A21A35833D627E1C685E25CD6005E6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786575, "uuid": "decf281d-52fd-4b1f-8f14-63ce831e3700", "value": "1536:BwV1/2jCx2pBSlBb6irbvrAG+CVehpciUIu8OwYd:q1/2jU2pBSuirbTAGJvln8Ohd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786575, "uuid": "5caaaec5-9557-475b-82a3-1b63acbee551", "value": 97876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786575, "uuid": "7c23b741-1562-4efd-8dcb-332ac58918bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786575, "uuid": "fcd2358b-9ad9-44d0-ac46-c90e4c100f3f", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dede7ce-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748765181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765181, "uuid": "7c7fe766-cc2a-4a2b-93be-85f9fd94d68f", "comment": "Malware payload", "value": "5968a98adcff717b29286f2edc2c3e4e", "object_relation": "md5", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765181, "uuid": "00b907d7-f57e-4c8f-a70a-a2f113e26b61", "comment": "Malware payload", "value": "0ed7cb393265ab39e865525e51a8885b311cae6b69c8f91b4f459b2e32d6f20f", "object_relation": "sha256", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765181, "uuid": "8734b37d-855f-4386-8a20-62fe0449d0ec", "comment": "Malware payload", "value": "9d2f6d0a4d6c35a5b27b95eb57b8019297319cf2", "object_relation": "sha1", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765181, "uuid": "4c40cbe9-e41a-4c84-b294-a5df64a34865", "comment": "Malware payload", "value": "c0a736472fa025fa6464d34f4c6d77b7d9189b7c32f6f727c4d07cd6c2a02d4ab84ceaa71cfd841e13acecd1ef60f8fe", "object_relation": "sha3-384", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765181, "uuid": "09262f71-a0c3-4520-8183-44eab0a76830", "value": "T1BAB50A4369DB0DE6C9D67BB8A1D31335A734FD748B295E3A6A08C2325D536C4AE1FB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765181, "uuid": "43e15faf-30a2-4cbc-a095-0072db69a1e7", "value": "92252a4850bc383934957c5b7c9741c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765181, "uuid": "70bfa7e1-31c1-4c90-86b8-1b3701d3f852", "value": "24576:pZnmqR2qweOm1PFzPyEsBl55TFscQakQIE2J6clMi81s3AAA+TLHm:pZnmqdweOm1PFzc6wNAA+TLHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765181, "uuid": "3f350076-b515-4dac-b49a-218815cf23fa", "value": 2458821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765181, "uuid": "77e3d786-10a8-48e7-96cb-5445dd9cb405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765181, "uuid": "65a26b79-daa1-4545-82e2-04e2ab227aac", "value": "t_vnc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79cbe37e-3eda-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748776851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776851, "uuid": "edf42592-61e6-4502-a064-7465f7724e35", "comment": "Malware payload", "value": "66d09a3c4cb713d9f9ffc4743ceadcbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776851, "uuid": "52fde7b8-f62b-467f-86e6-d9083fc3f935", "comment": "Malware payload", "value": "0fac84f7ed058060288c6250f0737719f824ff022c5e3c450134b37bf8fa6a49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776851, "uuid": "44ed4350-a8ce-4552-b35c-7824f3adc1d5", "comment": "Malware payload", "value": "b95c5c97b8cd229800a10ae87061ee333b16b350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776851, "uuid": "d7328ee3-2e14-4c17-8c52-31b07f891aeb", "comment": "Malware payload", "value": "6376a38b2c38dbce3772c034885bd2e5d27353c925a86e9e038bc9e65d8cd66f26b55a8e310e87938ed637fffd84931b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776851, "uuid": "5928e29b-9b25-4dfc-8ba2-360f47ce79d9", "value": "T16AF733B53B719E81F414BFEDD973BB0A2786402398B54D01A7B4AE112FCDA89FC1E905", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776851, "uuid": "db703f50-8db3-465c-be29-f52a0d2befe4", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776851, "uuid": "f8172875-a249-4b50-b952-88cd51ae9efd", "value": "1572864:L88MmDXZVkhjjYz2kmxq3zJ/WGsZ1+ZjlG3GIG7pnvUpvOqVxCGtsmtMuvLwm:L8yDX/khjc2kqmV/Gj+XFFvUpnDCGt7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748776851, "uuid": "2468e124-dcf3-4c45-bd76-998ed1acc586", "value": 74163008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748776851, "uuid": "a6f925f1-3679-477c-a906-238342298a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776851, "uuid": "d537f968-85fc-4259-818a-41916256044a", "value": "FortiClientMiniSetup-Windows-x64-Enterprise-7.1.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edeaf6a-3e81-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1748738554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738554, "uuid": "6f810238-fa4e-4cbf-98e4-14e3443e65c3", "comment": "Malware payload (SnakeKeylogger)", "value": "9511552eae788728ad6c40bb4d0920af", "object_relation": "md5", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738554, "uuid": "e52eee2f-ed1e-4cd5-b66c-307fb828f586", "comment": "Malware payload (SnakeKeylogger)", "value": "106fb0a22e67fb36e2b03052c8e859f1ee979b5d38fea03c8012dabc5947ed2d", "object_relation": "sha256", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738554, "uuid": "8952ae4f-4230-4136-96aa-fdf9108561da", "comment": "Malware payload (SnakeKeylogger)", "value": "11e128b9c5d6eff014a57bb5a100ad379d3674fd", "object_relation": "sha1", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738554, "uuid": "e73942a2-6c92-43c1-8cb6-94e15068d608", "comment": "Malware payload (SnakeKeylogger)", "value": "0f0149532c69833c10c80275df6721933072247338c96fd252cdecbad87532c2315b9291d67440d4fcb5ca42e8ae5ae0", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738554, "uuid": "f90e4f9b-8b29-41ca-be4c-dbe302b58e80", "value": "T1C025BF1373DD8365C3725273BA26B701BEBF782506A5F56B2FD8093DE820122525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738554, "uuid": "95cb3f72-d58b-49b6-872c-aa5d8c7bc91f", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738554, "uuid": "6377487d-ab8a-428a-91e1-1835ba21aa1d", "value": "12288:Dtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaC7FQAeNolzuZ6A:Dtb20pkaCqT5TBWgNQ7aKFQAe+lCZ6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748738554, "uuid": "b5724538-d481-4ac7-bb81-1880afaa1090", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748738554, "uuid": "72f14819-6b13-494a-92b7-e5f19c8e4a03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738554, "uuid": "e364d8d9-a5d3-42a3-9717-c34ddad98f27", "value": "obiff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb8d979-3ed3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748773687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748773687, "uuid": "ba36a11f-3a60-4bb6-a1de-b2ccd28243c6", "comment": "Malware payload", "value": "993f5ca48cb50b9371e7ab9d9b9d3cbe", "object_relation": "md5", "Tag": [ { "name": "107-173-47-153", "colour": "#23EBFB", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748773687, "uuid": "42722636-27a5-4c67-b970-12b41c662ee8", "comment": "Malware payload", "value": "10b714a1b718584830046bd521c7968b9e32ee301ad3b0712ceda6c0385e8846", "object_relation": "sha256", "Tag": [ { "name": "107-173-47-153", "colour": "#23EBFB", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748773687, "uuid": "b9fa3002-505f-42ab-87e9-0764768a2c53", "comment": "Malware payload", "value": "597cb776684503389811a670719f2619cacd59c6", "object_relation": "sha1", "Tag": [ { "name": "107-173-47-153", "colour": "#23EBFB", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748773687, "uuid": "832e4934-4f9f-4bb7-8584-9ffa7acbe80c", "comment": "Malware payload", "value": "413a3a9e14697edebb35f0fc649d32747ee34b3788f9659bdbb20c0f4ed4c52fd0137b0fb4e3fdb78732663793bd4d64", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-47-153", "colour": "#23EBFB", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748773687, "uuid": "8ff81cda-acd6-4042-9478-58894a56823b", "value": "T10D73F66DE74F0915EF51A77B035A4E4949FCB33EB38540A139AC87743BAD82E462287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748773687, "uuid": "ba23dd05-17c4-4bf6-88f5-99f8091f49da", "value": "1536:H+V4khCJ6FSG5Xcs5iaP91f4tzVsgUkrd151T4dzgEyBMn9JkQt+yBI0cE:H+V4khDFSgXcs5iaP9Otz/Z714dzgEyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748773687, "uuid": "225e5130-1e81-4890-9df9-4e9b5914d34e", "value": 78970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748773687, "uuid": "c2f306ba-b086-44f6-8fb3-428ce9172a13", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748773687, "uuid": "9a6550a8-0a73-4fbd-9570-1a62b0c44402", "value": "greatnicedaysarecomingforhappy________greatnicedaysarecomingforhappygreatnicedaysar_______greatnicedaysarecomingforhappygreatnicedaysarecomingforhappy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3391ff0-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744762, "uuid": "8fae9595-1010-4a99-9bb8-c4b2717c8cb3", "comment": "Malware payload (Mirai)", "value": "716191a7a16d0d8a7b973a10082a59e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744762, "uuid": "a1d991b5-3da5-40e5-b449-fecfb35e9be8", "comment": "Malware payload (Mirai)", "value": "10e2c62344b85be8ecd6cdbfceb0c72ed1cb68aa5cd97bcf3476e23823079243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744762, "uuid": "2c1e9277-a5d8-404d-a7bd-27a8dcdaea71", "comment": "Malware payload (Mirai)", "value": "dcbadd19b2eb2da94047bc3e651dff22ffe02c01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744762, "uuid": "f56c8b3f-2808-4493-ad9c-1c666d32bc4a", "comment": "Malware payload (Mirai)", "value": "a69db4948ce48342d86e1840cff5f682ff2d6c6b0f4421334c93d1a2300d6a4a439f56f64b5760122196c7e578aab5ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744762, "uuid": "077bef7d-5fdb-4c74-b129-9eca2dd61dc1", "value": "T16DA2E019BF1C868BC8367A7555D9EAD21293BC61F29CDC0D2940D16FF0A33A91830F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744762, "uuid": "3d6c75b8-8315-4a4c-a85e-0de079b1fcdb", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTo:O98o08kxofBE+ZkXaITbp2F2TWul0c5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744762, "uuid": "d7601765-6d56-472d-af93-2b567226f232", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744762, "uuid": "c25feebc-d43e-48a5-b16e-e11f18785268", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744762, "uuid": "b5b48bed-fba0-4c05-9906-01f2d0796b5d", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba366f1-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806892, "uuid": "f70ff9a7-e44f-4216-855d-9e2e55863c3b", "comment": "Malware payload (Mirai)", "value": "aabb487d463e40c1ee847d752edbc00f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806892, "uuid": "9cc80477-98bf-4fe7-8d5d-4f432741b151", "comment": "Malware payload (Mirai)", "value": "11c1a423cf09c4150ac3014c85535e99de7f7b492ffc0834f490ae1ddc4df454", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806892, "uuid": "cc2eb3ed-aab6-4efe-9cab-aa2cf5df5dbc", "comment": "Malware payload (Mirai)", "value": "00fbc8546274ab3e93b87b34c2313cdc31061143", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806892, "uuid": "f98dac5d-a14e-491c-8b54-7b2b09053f05", "comment": "Malware payload (Mirai)", "value": "58c5eb27e23b111e9cf64b94b48a9f63f11d9a7795636c3ce17feaa2c1bad5f1ac3ce5f0cb40c497b0fc3db02ef1ec4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806892, "uuid": "f2966a4a-c178-4142-99f3-7ecfc35d5f5f", "value": "T1D3739409BF610FB7DC9BCC370AA92B4539CD550B21A97B36B934D918B64B31B19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806892, "uuid": "f0f71e11-1a11-4f45-9569-1b8f19b304c5", "value": "768:YwrOtpip2gG9VdDL2UYVqAksdVlcVepsgpe3zeXekxe/0/6ZiiDSXiBkEvO0d+6d:YOOtEcg+VdgrW6xxU0yZiijvFda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806892, "uuid": "7540155d-6310-48cf-af7c-1e6b8c64af9e", "value": 75876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806892, "uuid": "6c42a2d5-11f6-4ad9-a096-2b80907fd621", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806892, "uuid": "d7dba58c-74e7-41dd-8f49-eb6dbbaef9bc", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2435bd-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806896, "uuid": "a2fc09fe-ea8e-4832-9b7c-29f15ff33d5a", "comment": "Malware payload (Mirai)", "value": "fcc8f7123b0df1ba9be430491bd13df7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806896, "uuid": "eccb4831-2659-4088-8233-d9b9c84fd3d4", "comment": "Malware payload (Mirai)", "value": "11e2a5842a9ecdea65d03c725c64f83fb42ef6e86c7b4fa8678e9a5133a2ea77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806896, "uuid": "21499834-ed19-4033-9d1f-6693ccce1909", "comment": "Malware payload (Mirai)", "value": "08f273a005e09a5874d600aecb090a8848f7847b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806896, "uuid": "f8e0b8f8-dfcf-476c-b08c-5e71d780dc07", "comment": "Malware payload (Mirai)", "value": "4efcd29dbd518bca11e4cfe2154f3ab1aec15ca09917ccab5d8e5b8c5d415370272bc89ab192707b308bba4744443019", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806896, "uuid": "17f869a7-83c6-478d-8b39-a394f9868989", "value": "T11EA2CFBAD690475EF6E7B8F4E804E3E637440EDF5B5BCE412681AF50162293765023F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806896, "uuid": "4c3a9ab5-b86d-4e89-8c5c-6684959d4119", "value": "384:OoFoPx0D9yyeMMafGafP2bq9F28phS1OkTDwH1aM4uVcqgw05VxJr:OoFWeDUjMMa+an2G9Q8TS13Yf4uVcqgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806896, "uuid": "5b795e52-b229-48c0-ac9d-2bee38939f00", "value": 21848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806896, "uuid": "2bde21b7-426f-4d76-8a5e-cc3fd95a459e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806896, "uuid": "d061106d-668f-4ef7-bef2-6b0b343f684a", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44c6fb6-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744764, "uuid": "8c1c6e67-10a6-4f5e-aee6-d6a6f53c863d", "comment": "Malware payload (Mirai)", "value": "69f51b48a1651622cf28eae0e077b33c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744764, "uuid": "9de937a7-3222-4245-b2b1-2c4a9b09edca", "comment": "Malware payload (Mirai)", "value": "11f735fb94637d2770bb1ea2eaa5e88ef82b46a633a9886183d59fa777e5437d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744764, "uuid": "84f92775-adfe-48ba-a7e6-08e8394ddb2c", "comment": "Malware payload (Mirai)", "value": "5e58d76080324e088d47b6cce23a5668ac4de39e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744764, "uuid": "4aca595d-0c09-4dda-952f-0422257cfcd5", "comment": "Malware payload (Mirai)", "value": "86fb3bbb6f7c868dc0ec052795071df39a7958294fe1925b078f52fb1d82cb7a08741e96bdfef7d42ceeb07420c5c564", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744764, "uuid": "5265b187-2442-468f-903a-4c9d3e7fea54", "value": "T1C782D03051AB79E5DBE14431FAAECEC6971A0BF8C1FC36D317586B78C94110221F82DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744764, "uuid": "b8b69bbc-9a07-4ad5-8a73-839abd6efaec", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaGohymdGUop5h5lI:6GV0P6+kom0tVAoNvm+to1Gos3UoznlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744764, "uuid": "d48cf07c-5422-41c4-8346-813bfad688ce", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744764, "uuid": "c6f8e111-f12d-4286-b4b5-3c2f35b42bac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744764, "uuid": "ffd6e1c6-d8b7-4f59-b4f8-47977c42f702", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dac10a0-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806949, "uuid": "d44054b6-7fc6-418e-9205-857bb575e3c5", "comment": "Malware payload (Mirai)", "value": "fc93f836754d6f396f6036274aab8e0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806949, "uuid": "a05fb315-83e9-4357-afcf-9e6ccea5ef97", "comment": "Malware payload (Mirai)", "value": "12a8a71a84423372c8d1238f8f6ef8057f9ff187493d4e671de046c07190fadc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806949, "uuid": "5bfd63e8-237c-4dff-9c8a-11d03ef3923d", "comment": "Malware payload (Mirai)", "value": "4f7c5eada663a0d58d44be8dde10d737bd152dc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806949, "uuid": "b16a92c1-36cc-4449-8859-5ee5057a8335", "comment": "Malware payload (Mirai)", "value": "f4f853162f7a6e1bfa5722caf40489b289da426e4f2b97e0a435ff71595b649a766d332aa62b4f7ebf47b03583abefa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806949, "uuid": "406e1868-ef9a-4495-9fff-eef5d1c02cd8", "value": "T1F863941A7E229FBDFA9D463587B78E225A4833D627D1C541E16CDA016E7024E340FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806949, "uuid": "526bf277-7a46-4bda-9f84-56be677eb65b", "value": "1536:D7y2MxuLW0DjESdMcUSJhprIzk3zbusqr:EgfCShrIzgP5qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806949, "uuid": "278f036f-3e82-4e19-a290-bcbe294dfb3f", "value": 71780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806949, "uuid": "75265b1a-c317-4d40-908f-da2105f7e9fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806949, "uuid": "d1726b0c-7377-4e04-8cde-d90e14305fab", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c07f4a-3f0b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748797883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797883, "uuid": "43b96965-a037-4c16-90cb-99c53189c9df", "comment": "Malware payload (Prometei)", "value": "a978a892a031a60c0aaba40722c65fd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797883, "uuid": "9c2decc6-2855-44dd-8768-d7ec5a16748e", "comment": "Malware payload (Prometei)", "value": "142febcd588d01a5ef42f3805467b03476e485fa17ebd4dcd90f6deeaa6ccc71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797883, "uuid": "816b1301-8c96-4b92-a956-29c7fba35009", "comment": "Malware payload (Prometei)", "value": "36041fa42199ce85aa3717daf96c7c3d836c4bf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797883, "uuid": "2449953d-9031-4639-8bd1-0e4822467727", "comment": "Malware payload (Prometei)", "value": "c7a3d47cd72412326a7bb1f5b45a11888e99a9439f3bbf5fb9be360f9fbdc7394b9c0655665b55d5ccf8330ebc934a41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797883, "uuid": "c48fb646-af04-44c4-b7e1-bc33f16aefbe", "value": "T1209423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797883, "uuid": "c5f3e249-e268-457b-a87f-b39702c2c77c", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg6:25WOSACZSV6eKRH5EPiamb4DsDwwcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748797883, "uuid": "1bb1bfc1-315c-49ec-ab16-6764224f2128", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748797883, "uuid": "b98d9130-08fd-431d-8d05-93a23965a93c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797883, "uuid": "2c799a8a-24db-4dee-9542-b06724a30670", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905e0d9c-3eb3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760139, "uuid": "935d07ad-638d-40db-a76e-dce83b812333", "comment": "Malware payload (Mirai)", "value": "ca333bca6b7493eee36a5bfa7ea905f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760139, "uuid": "836174a7-40de-40a2-87ce-33d3f664eb45", "comment": "Malware payload (Mirai)", "value": "146a9e8a20a1638b843afb5ba21a0596c471262fde12387dd75edfc738327464", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760139, "uuid": "04634804-4545-416d-a467-ead2d9394295", "comment": "Malware payload (Mirai)", "value": "b854a7f4586a65548d7573f572a1f587f9e48a73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760139, "uuid": "db73cf29-a94d-4e4d-b5e9-27f47eb1c725", "comment": "Malware payload (Mirai)", "value": "7a663795e7de4b15fd342d36012ff17cc707625a4396f262ef3273f094a6ba8bbd7c1610a91e25973c36521fe6866b64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760139, "uuid": "056bd072-d1b5-4942-998a-20d5c28ba22c", "value": "T11CF34B46E6808B13C0D2177ABA9F424633339794E3DB73069928BFB43F8679E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760139, "uuid": "92c7933a-e3b9-4711-bfee-8d07dba72667", "value": "3072:fizEJBM++Rtq85nGbva5w1TbRr0YCbkNV+Bt+86l53KUyM/9ETIG:euBMPR/qva5wVbRr1CbG+/+86l53KvMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760139, "uuid": "43be9f63-9c5d-4b64-907a-0be72acf1d1e", "value": 170740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760139, "uuid": "a6bccdc1-a182-4c6f-ac32-b374412d7e10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760139, "uuid": "6e916b50-5cc9-4f76-83b6-6ea5e679451a", "value": "neon.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5216905d-3eb1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748759175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759175, "uuid": "81b070a8-5d81-4734-a931-d62999744a3d", "comment": "Malware payload", "value": "e2bcdda59f7384aa0addee12376cecb3", "object_relation": "md5", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759175, "uuid": "f1a3d1f3-a681-47f6-ba46-03d19bb599f2", "comment": "Malware payload", "value": "15125ae6eda7f3897085b4bd8b7c17b576c22a823d58d0093757a1aa9acb1c2e", "object_relation": "sha256", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759175, "uuid": "72bd3f7c-ec5c-42d7-9e06-cf5bea54b459", "comment": "Malware payload", "value": "71cfd4f231a099282fab5d79f98b6accaeb11f2d", "object_relation": "sha1", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759175, "uuid": "dae3a2c2-980a-4e91-99bc-9404dfd94c31", "comment": "Malware payload", "value": "f800aed5a6fcb6e878c9869518dfa80bfcdd8848efa31bd364fd9e07ca5421e529730753266e332a95fcee77f210b671", "object_relation": "sha3-384", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759175, "uuid": "3b3a3fcc-d753-4a5b-a109-5ec7b291e21a", "value": "T17C12A6C55622D12F568EC9062E437FDC2868D1AFD5C9A302E0C4B64F64BC26BC5E8BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759175, "uuid": "cd599e2a-dd60-48a1-9320-5c9f1c357388", "value": "192:ibkTbCBPN9Pn0rA45yoyY5LrIRcIiPc6/HeHmjKOtVwX:i6I9P0rryod+uPP/dKO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759175, "uuid": "c307009e-49ac-446a-872d-6d20a2acebb0", "value": 9787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759175, "uuid": "8a06e91f-b1a9-4893-90b5-ec83b0e0dd2d", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759175, "uuid": "0ce44b13-4fce-4daf-b69c-130302e89601", "value": "DragonLady.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b46921f-3f1a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748804180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748804180, "uuid": "e5b3ab77-d6ac-4375-8cc7-e02faf46d8cc", "comment": "Malware payload", "value": "69d08aef019b5aef1586de054eee4644", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748804180, "uuid": "b64d4591-f7e2-4dc1-a4eb-5adb488e10b0", "comment": "Malware payload", "value": "1517cb17de47a556857f9ba78bc4ce843089b83d6d381d137b1c337f55d79b5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748804180, "uuid": "2cc4546b-a084-4f6f-b088-0492c9259d42", "comment": "Malware payload", "value": "377f4cbf15ad5bcd3c8d4c73e3e551a5e6b7a94d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748804180, "uuid": "aaf02f83-eeee-4721-8caa-677a9455fc70", "comment": "Malware payload", "value": "972e3c883c285ca39db1acfd8507bcb7ae85bbb39e6aae9075f8c1e38336496ffedba5e85fad260404e424c7b111bbcf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748804180, "uuid": "9d61304c-afb6-4197-8033-2f75d06f6bbf", "value": "T132A41212E290D8FEC4CAC170469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748804180, "uuid": "0546db8c-cc0f-4c2a-9fa1-c57e7036a761", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748804180, "uuid": "98f121d2-3468-4c2d-aa07-8c3263b1b7f5", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748804180, "uuid": "e5944f47-afc0-4e0a-90ec-fc39b27fb7f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748804180, "uuid": "b019b71e-fa46-4c31-b288-b839e66adca8", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb18c73c-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744775, "uuid": "dcf01cb7-c58e-4c62-9a94-79b924374463", "comment": "Malware payload (Mirai)", "value": "71a472a91b58b91b4df3d27462ad7b05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744775, "uuid": "b83f6de6-cd26-4851-a730-72c69eaa547f", "comment": "Malware payload (Mirai)", "value": "155da158bba71c62ebfad07f2f14bcf27cb35019839c0608f7d1f41b12a582d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744775, "uuid": "9112b875-9dca-4280-80cf-dbff1f345b17", "comment": "Malware payload (Mirai)", "value": "eac7931b1ebbbe2963809b37e57bf80cb1382235", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744775, "uuid": "6fd44253-9964-450c-84a8-6dd02ce96a8c", "comment": "Malware payload (Mirai)", "value": "8ebc2726075e8d1bb8d6ebf152127bbdc42f3c6cd96f63e89f21cec72e81d7222ea45baf2401c27c0e24ef8db07c34b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744775, "uuid": "1cf720aa-2b9f-42a5-8070-0cf435a1d79d", "value": "T125432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744775, "uuid": "aabead32-5346-45eb-9fd7-2da0e3b7d950", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwq:RqtmZPuutfbltZFBSJsBcfDSTFI+BEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744775, "uuid": "72671a2c-2c27-4063-9099-b4092bfd043c", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744775, "uuid": "8f766bfd-3394-451a-85f0-ee9825faa0e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744775, "uuid": "1fc97a9a-bf8e-440b-93b3-e19f52d4964f", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58579566-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748765199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765199, "uuid": "8164c3e2-c59c-480b-9439-6c284754b736", "comment": "Malware payload (Gafgyt)", "value": "67280b31bb920eba600f1f4d53185575", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765199, "uuid": "2c24f434-439b-41ab-ad9a-d96d5a397213", "comment": "Malware payload (Gafgyt)", "value": "15bd2187d7ccd699060affab42bf8d989ab55a3ea4eb4ee24e374b04086f88c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765199, "uuid": "b9e406f7-9d9b-40c7-9988-bf83b45a94f3", "comment": "Malware payload (Gafgyt)", "value": "40aa444ec4547e456237c5c9fde9fd5d7a4a1856", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765199, "uuid": "9a5d7a17-69ce-42fe-8ad9-2f9057eccc4a", "comment": "Malware payload (Gafgyt)", "value": "55d382b90c7f98b52958cf8e939ad2f22a9a6ce0823dd142e2b0364ba59b482b975092eb1ff67838e87518fb89bdb449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765199, "uuid": "20a3ef2d-11ce-4926-b6e1-35b8f9c9760a", "value": "T179833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765199, "uuid": "cfad05b6-084d-43dc-9fe3-5af56764bef6", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LEWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Y42oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765199, "uuid": "12c7fdc5-e5fb-4a2b-84c8-28877d6fc9ff", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765199, "uuid": "28450946-8ac9-453a-a0aa-31ea71f165a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765199, "uuid": "acff9250-fe88-4aac-a259-ab79d7f948be", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d34590d-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806895, "uuid": "3a91a124-4402-44b6-a14b-92fa0c11abdc", "comment": "Malware payload (Mirai)", "value": "8ffdc2f8b821754b7595d4087b361fbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806895, "uuid": "fc3501b0-b3cb-4167-9632-c129e0d1ced6", "comment": "Malware payload (Mirai)", "value": "161b058f860962e0c3a5e86f191905f510f6823d6db0bd469276964b3582761a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806895, "uuid": "8fcf3d34-10c3-4992-8a74-9a2f2dd49d96", "comment": "Malware payload (Mirai)", "value": "a721e1ae32db4953c7523a62cc73b2ad6592220a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806895, "uuid": "246e3f6d-a018-48fb-8e23-7156d62fa127", "comment": "Malware payload (Mirai)", "value": "895ce8ce2d7ca270848bd2cff087b51bb8d99fd2494c5367cd33d16873adf6fee323b468465864374b624cb231706862", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806895, "uuid": "c0a55fc0-d008-4b23-88ff-e2728cbb1838", "value": "T198C2D0A1A172DC39C6B2387664350A8DD59B8F3891BE7019B168549D3DFB84262FC3C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806895, "uuid": "0b331efb-a838-416f-a62c-d694e0e4b0f0", "value": "768:QK/BqYHlekvnKCR5HkE1TDdVq3Jr+3+9q3UELoD:dA0lFvjR5HkE1TD+50Lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806895, "uuid": "883bd8c5-514a-4719-a24f-6316516ade16", "value": 27272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806895, "uuid": "9727f50a-5d54-480b-b3b3-4e8a9a2392ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806895, "uuid": "36d4c36d-8777-474e-88df-f14c2e9d3d11", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b916d1-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744770, "uuid": "b2ac62ea-6b67-48fb-9658-3666c1c8723a", "comment": "Malware payload (Mirai)", "value": "c1128fad77063e3e39a59b77c328d7a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744770, "uuid": "9c3de3a8-c9ce-4ef4-9bb2-11da9dc9a317", "comment": "Malware payload (Mirai)", "value": "17180118ab6e57dcb5df9aed16604e58961198b9c08464556e0e343f649a0573", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744770, "uuid": "54567560-1b70-4698-a6f4-91d2c45ea60c", "comment": "Malware payload (Mirai)", "value": "d90c196f42ad32f1863c23ae172841cbbfd4de0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744770, "uuid": "651c303e-f873-4549-a201-49238e578b9e", "comment": "Malware payload (Mirai)", "value": "4261f58aee960c33dfa68c999c18f41d3e64d8b040fe3d4a991436749b10def6dabc23d004ac32ce96d02a7dfc52534a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744770, "uuid": "6640ba8a-7986-47de-9032-60e82fd8e16b", "value": "T132336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744770, "uuid": "b47b90f3-b456-4481-aefb-aaff038569c5", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744770, "uuid": "c5f36ea9-821c-4dd0-9d6b-a72012fd5c79", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744770, "uuid": "7f20d211-5c59-4688-8429-72a5a337f8ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744770, "uuid": "5607c5db-8417-4758-a4a3-22635a61a203", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1796640a-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748786565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786565, "uuid": "9e2c0a99-b5d4-4be4-9572-032aad5e84cb", "comment": "Malware payload (Gafgyt)", "value": "36fffd03f1d0d9fa339d4154dc201e19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786565, "uuid": "599d6052-6a16-490f-9c49-b49580aa008a", "comment": "Malware payload (Gafgyt)", "value": "175962f87fb3065b11c64733189ad1c00321ab14f45e67596b4ffc08a0c71163", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786565, "uuid": "baa81e41-d1d8-4822-b74c-26357414e274", "comment": "Malware payload (Gafgyt)", "value": "df90ce02fb8fca07cc90b699de39712294a9ea9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786565, "uuid": "f0466c80-86fe-44c7-8d2e-fdcbaf001142", "comment": "Malware payload (Gafgyt)", "value": "ee045338ef8f0f214c125ed6abd251506ca6e26f59cb3b93cb3741c0c7db256a9567d25d14da8efd571411dd16d00720", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786565, "uuid": "5895aa9e-7028-4772-9383-7549e0fef359", "value": "T1C3C33BD7D942C5B3D40209F2226B62494622FF3B485B5AE6FB1D3CB4AF318897225FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786565, "uuid": "bf1fc497-ab83-454e-871b-c73d63ffc744", "value": "3072:lZjZie1sWFYsDpzHvMetJ8add9Qz3s1zvw2Jg4NKcXeGcgqGK:lZNDdHvMetJ8addQKI2Jg4NKcXdcgqGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786565, "uuid": "a2416d4e-042e-47e6-9231-d457341f3050", "value": 125342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786565, "uuid": "fd94f703-7fc7-4768-953d-91537c53b694", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786565, "uuid": "ad6b5edd-98f5-4508-a913-e41c65ffd534", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3252c63e-3f1c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748805078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748805078, "uuid": "7492f047-7be8-4d71-b994-ca1e8c00e669", "comment": "Malware payload (Mirai)", "value": "8acba23f491c780994e80839d898fd75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748805078, "uuid": "671fcb6e-fe18-4e44-ad9b-f57dcf18c128", "comment": "Malware payload (Mirai)", "value": "17789153495d436cf49393b7ef024aa8b501d56d90cc40f4d4516fcddaa817b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748805078, "uuid": "dd3aa436-1502-454e-9281-1067d7af68fa", "comment": "Malware payload (Mirai)", "value": "2fe16d92d87f423346f15b5e999da33112db058a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748805078, "uuid": "5749fc87-0983-49d0-804d-cfcfcc1bfb9d", "comment": "Malware payload (Mirai)", "value": "1ed619ec4b4b41e132b65210d17a7d89c5142b794f2882db10af7b216870bdc5ea778420abdac54f198fa501112ab058", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748805078, "uuid": "e4d34ec8-51bb-4a6f-87ef-696ed25ec3ff", "value": "T120130956BCD29A2AC6E463BBFA6E018D331163E8D1EF3257CC152B047AC951F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748805078, "uuid": "d1f0ac12-8920-409e-8963-62bb9f0490d2", "value": "768:Fu9GLs6QmR6vkrAPWyGFJJaakHrd1DG4AdDoCerCAyAOtB8IvYP5b/hHiN30VO4w:w9lmtkPWypE4Auy58II5b5Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748805078, "uuid": "f3fee439-327d-4037-bffa-a026903d6b90", "value": 43248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748805078, "uuid": "9e5961b6-e41b-4223-b763-1f3f136a0019", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748805078, "uuid": "ff93c02a-5b2d-44eb-a41a-707600aabd4f", "value": "hoho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bcf970-3ead-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748757438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757438, "uuid": "18a18d3a-79cd-4666-b0d7-0a861f6dc160", "comment": "Malware payload (RemcosRAT)", "value": "c864d4bde1e9f67468b6e009f8cadbc7", "object_relation": "md5", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757438, "uuid": "3448daf8-2b45-4cec-bbf8-79b46ce0271f", "comment": "Malware payload (RemcosRAT)", "value": "17ee0458fece2d5c210c057d719a508591958e854c489b3063c01f446a43ed9e", "object_relation": "sha256", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757438, "uuid": "22bdace9-b139-4a93-95f0-bf9e124a1110", "comment": "Malware payload (RemcosRAT)", "value": "02b668431b8c9de4de309402212c416c0d95a54e", "object_relation": "sha1", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757438, "uuid": "04edde1c-4e91-41a6-8fba-dc643a182d02", "comment": "Malware payload (RemcosRAT)", "value": "11e2dd57a09c01bef8e847ee49116fb79360bfd6a6720b8e865233a65408706bceb85667138e9525837e210097a28e92", "object_relation": "sha3-384", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757438, "uuid": "480ed724-3606-49a8-9f0c-b28b7ebebf46", "value": "T1E8835A52ABEA2108B1F6BB88593A05344F277CC96C7DC55E05CC6A4D1BF3EC4D860BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757438, "uuid": "b40c4eb7-83d3-4624-a945-344ee24202e2", "value": "1536:/tDa3LRV0ubIGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDpOAWGPrbrbTDDpj:lDwVJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748757438, "uuid": "effda49e-e6da-4d92-9551-12e65016ffeb", "value": 81692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748757438, "uuid": "7dfd4cc6-0c8c-4d6a-af3e-f4a48ae388d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757438, "uuid": "4e4aadd6-9c3f-4fb4-a90c-4b3f0ee12859", "value": "Eugenia -Curriculum Vitae - Copy (5).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6e81d5-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748800105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800105, "uuid": "dcc8a749-2771-412f-9a1e-4a05b27a8a1e", "comment": "Malware payload", "value": "8e0226ac631c481ce6d812bd0394edf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800105, "uuid": "ce04fb80-9c99-4af7-a329-e67dfeaab4b2", "comment": "Malware payload", "value": "181bf56529da01de5f87d8154f086963053f4de81d45827cc08c77e325f79b5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800105, "uuid": "b3662d2a-77d0-45f2-aeeb-b9783b58b2a6", "comment": "Malware payload", "value": "fc6fe08a60927761788cd7a44eac6f899dcdc6b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800105, "uuid": "4793876d-b7fc-4425-935d-1de03d4b3798", "comment": "Malware payload", "value": "9f719f1bc30fb5dc48333654f9d1579501b1b1fb2fda5ef589e37dec8d414703368204ffa9dc9b6e0bbf158f23fcc039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800105, "uuid": "159dab63-2222-4250-84ef-f1ee20fe6fe4", "value": "T1BA26332BA83374CBCA0505FC88C39E07DBD5CB4A1CE54D9B266C05243BCB6B697A1776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800105, "uuid": "19277f26-d6fb-441f-afb2-0929e8fa4de6", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800105, "uuid": "9e46ca22-7466-48b2-994b-97e6b734c646", "value": "98304:rZstDSYR+MktRVG8Jjdq9MU4ltNtH9SvHbtMugFw5vEfJLwFRQL:N+2YR+3k8/q+UItr9SDtM5Fw5vEfFwF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800105, "uuid": "62180e29-4ac0-489a-98c3-e4abe4ca7c31", "value": 4775936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800105, "uuid": "ab32df48-b1ba-40d5-8fa9-b7d6a589bd9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800105, "uuid": "1ccdc4b1-3141-4474-9ae2-ef751a0174f8", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939c4ed1-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806959, "uuid": "7c4623f9-591e-4612-88bf-298fb0a188f5", "comment": "Malware payload (Mirai)", "value": "46e3ddf3f7f86aa2322db8f49ddc60be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806959, "uuid": "b1e87831-f559-432a-97d1-9f5bf0dccf99", "comment": "Malware payload (Mirai)", "value": "192396bc7e657fef6b0ce636c0892581387cd6952502d6d6f550e7e11567cd65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806959, "uuid": "e000d47c-1a24-437b-addf-30ad0efa9f03", "comment": "Malware payload (Mirai)", "value": "3441d19497fc44723dd3b6c54f2fbdc381d0a44a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806959, "uuid": "70c70766-d4ad-4016-a7d0-b0f6c7678b21", "comment": "Malware payload (Mirai)", "value": "092a58cc21e8f5f8e6b63a0d1d8ab1c6332196242c0a5940e6b3cd0ca0fe95c04107884a13335e33cb736530c1d763f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806959, "uuid": "76c42d18-61da-4100-afa2-30d9a81c41ce", "value": "T119C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806959, "uuid": "eac28d19-6702-40f7-b1f4-237c8b3ccd72", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoyrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIyrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806959, "uuid": "dc42ad97-e1a3-4414-be9a-08b3df3a306f", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806959, "uuid": "31f0c105-3321-4233-afe5-ef208d605ec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806959, "uuid": "8699b89a-27df-4650-b316-4b28179068ef", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c462fb-3ecb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Akira)", "timestamp": 1748770593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770593, "uuid": "ee93e38e-2a88-41ad-bc8b-a8819270b4cb", "comment": "Malware payload (Akira)", "value": "503f112e243519a1b9e0344499561908", "object_relation": "md5", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770593, "uuid": "41206eee-bf86-4511-956d-6bdfbec2a1fe", "comment": "Malware payload (Akira)", "value": "1b6af2fbbc636180dd7bae825486ccc45e42aefbb304d5f83fafca4d637c13cc", "object_relation": "sha256", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770593, "uuid": "cf545194-f500-4d05-a864-7667f27504b8", "comment": "Malware payload (Akira)", "value": "8d635ca131d8aa20971744dcb30a9e2e1f8cd1be", "object_relation": "sha1", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770593, "uuid": "0cd43cf8-0242-4b36-af12-2301640381e1", "comment": "Malware payload (Akira)", "value": "e72e2120c8efdf13d889afee8abdbee6616796a7df47bf7002cab09128b57d417ba5975b4312d560b179db2cd96fc631", "object_relation": "sha3-384", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770593, "uuid": "a5afc131-0b07-4b81-8290-be3c7fa3a04a", "value": "T1C8C46C19B6AC47F4D0A7C238C9228506EAB7784A13718BEF039446772F176E15F3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770593, "uuid": "715822db-559f-44da-b26b-fc5027b91684", "value": "f2621faa63cc44d421c7ae38a2c37765", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770593, "uuid": "98c22186-5280-4daf-9111-cfba3bf03b8b", "value": "12288:BV0qnXKTH2P6rxTcQpXDHgswvodgnAdA:BV0EMm6rxTcQjos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748770593, "uuid": "c0de95f2-1e40-46c5-9c87-d0920ace268a", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748770593, "uuid": "3961a2e7-a8c5-40f3-82f0-b4aa8335d6fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770593, "uuid": "bf7a039a-c5b7-467a-adf4-dc74929e51cb", "value": "1b6af2fbbc636180dd7bae825486ccc45e42aefbb304d5f83fafca4d637c13cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ff0aaf-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748759479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759479, "uuid": "3148fa50-f076-4341-835b-93a7a64e66d3", "comment": "Malware payload", "value": "277f0bea0a66c5a2fd36242b17efc6bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759479, "uuid": "71ad2b1a-b269-4c2c-9538-bfc7688f049f", "comment": "Malware payload", "value": "1bc75b8586b3302e983b5f2cffe20b1ffbfdc1b553ad1e5a62e34b1029cf82b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759479, "uuid": "a41821c5-52cc-4882-8772-9fc488e5621c", "comment": "Malware payload", "value": "7c6b59ed25ecbcee31dbd02101c0e05ca877e333", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759479, "uuid": "759c6943-8dff-4c74-bf2b-7bda8f067de0", "comment": "Malware payload", "value": "fd273e1babf947e83ed09aabf4bd084d5c44d5bc811544038c21974dd3c4dfdbbcf81b449453a0fba1dc961689accb45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759479, "uuid": "5c8614b2-3519-46c6-915b-e6103bd0074d", "value": "T1BBA41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759479, "uuid": "c80ca5f4-349d-4f2e-bb67-271569b01f67", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759479, "uuid": "e12282ca-9a0b-4dca-9914-0843c92222be", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759479, "uuid": "a3bc1ce2-6797-4092-8d7a-dabb1331918e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759479, "uuid": "0428799f-4f1c-46a1-9966-b3822cffecb8", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63efeafb-3eb5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748760923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760923, "uuid": "064edd2c-82c2-4ec3-af17-6b1f077f4111", "comment": "Malware payload", "value": "16aca196843a2cdd4f6949e648d6a260", "object_relation": "md5", "Tag": [ { "name": "195.82.147.113", "colour": "#1ECA18", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760923, "uuid": "86ac2db5-72a7-49a6-a9a7-8684ac5193bc", "comment": "Malware payload", "value": "1cb440bc30647a0971e87524e50cb6289a6118ca1513a96bb5797ed907a4992d", "object_relation": "sha256", "Tag": [ { "name": "195.82.147.113", "colour": "#1ECA18", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760923, "uuid": "3aa5e255-3182-4ac7-9da2-ee729c924688", "comment": "Malware payload", "value": "c3fb94eb59d6bd47f9592f56317a7f433ff76b5a", "object_relation": "sha1", "Tag": [ { "name": "195.82.147.113", "colour": "#1ECA18", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760923, "uuid": "6a87bbe6-b6e4-4359-b09c-0ee5d1ad0d99", "comment": "Malware payload", "value": "1cc710ad1eb67537b311112c3429a063e6d9da9b3464ad355a910ca9d5fb15bd58eae27cf9fca0364c215ddbd5e4e21c", "object_relation": "sha3-384", "Tag": [ { "name": "195.82.147.113", "colour": "#1ECA18", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760923, "uuid": "6f84101b-213b-46ea-9559-69249676034f", "value": "T17AE53346A2A46ED061964FBAE9C10412359D47B121C6F42318EFE29E7EE6CFDD8353C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760923, "uuid": "826ab87b-5753-42b2-96b6-1f30f367d236", "value": "49152:gZpjrufx9CY7HkoQZKQh0npCRIkPHdKtyjp7ig2ZDxSfhUJw8R5aKRU5S/:QmxD7EoFQqpQIa4tyjpOgoDA52mS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760923, "uuid": "d8d08bed-0021-4a36-813a-4f1b25437c83", "value": 3174574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760923, "uuid": "f14f7ebc-9b3e-4506-988b-48152ad799b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760923, "uuid": "2b15922b-e6b1-44a8-9484-c2ad4c11de1e", "value": "server.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf64d8a6-3f09-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748797154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797154, "uuid": "3ed35b49-b7a8-4070-98ba-81ba0c1377af", "comment": "Malware payload", "value": "3b9a79ed0ab4b6bb8973e625ea42cabb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797154, "uuid": "467a7428-5997-4af3-afef-e2feedaf9565", "comment": "Malware payload", "value": "1cfc3b32aeb66367c054ac339add02b24805f90a3d0b53bd61b4670d0edf8a55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797154, "uuid": "2fb33afb-6db2-4b0b-8d80-1aaa7409ebec", "comment": "Malware payload", "value": "b08440965f9d05ea9b85a7749dc293d6c090a084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797154, "uuid": "02bc7af2-a320-4dbf-8723-147e23e230b9", "comment": "Malware payload", "value": "e3f3e5593931ed86f7535e590a23e071f95f5268d7776bb5e59ad1a35839b55306a3516c3b018fa1e052790c99de7f21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797154, "uuid": "0986f58f-91f6-43df-86b6-6ebf50a948e4", "value": "T19FC6E113F28E742ED06B3E392A7793A1983B7A5039124C57A7EC394C8F3D5845E2A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797154, "uuid": "316cca2a-d615-494f-b824-19605a68d476", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797154, "uuid": "52f522cb-2e7c-4441-bc25-5c07045efc40", "value": "196608:OsWQVJCX+SZhA7O40StbBmafQzBuXlIjwvT8Q3bHAcTo00jDt:OVOwX+SZhmD0SBcaWBMIjwo+bgKGDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748797154, "uuid": "4cdd0122-1fe9-4000-ab05-64d1e3d42b45", "value": 11720441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748797154, "uuid": "5dda65c9-a3ca-49d8-9cf7-d086d7b9eaf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797154, "uuid": "361d53ba-7236-4a85-9320-74efb571790d", "value": "3b9a79ed0ab4b6bb8973e625ea42cabb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728bd38f-3ee6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1748781993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781993, "uuid": "e9ed6dfa-40c1-41d8-8e5a-d48e0fc7a944", "comment": "Malware payload (Rhadamanthys)", "value": "99890a05de002ac63cde60449da48a0e", "object_relation": "md5", "Tag": [ { "name": "65-109-160-160", "colour": "#72BB3D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781993, "uuid": "6ec3302b-3dd3-45a1-900b-39f3ea3bd1e1", "comment": "Malware payload (Rhadamanthys)", "value": "1d101119ce0a0ab5d67d9c1c87744caa660897fb9562a7482d5bac5bcc14cc17", "object_relation": "sha256", "Tag": [ { "name": "65-109-160-160", "colour": "#72BB3D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781993, "uuid": "093eab3b-00d3-49e7-8b7e-ddae033e7b45", "comment": "Malware payload (Rhadamanthys)", "value": "97a112f6b1ad778ff8cb277b6d0c5f4188ca7dc4", "object_relation": "sha1", "Tag": [ { "name": "65-109-160-160", "colour": "#72BB3D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781993, "uuid": "7832971c-7a28-4999-9d50-fb72c8f4e3a0", "comment": "Malware payload (Rhadamanthys)", "value": "b3010cde0bc01d5eb6ab7822e77cde59dd803a9279c2a7e6fab376145c9366ce45d84750b22e66502e35c682369301e4", "object_relation": "sha3-384", "Tag": [ { "name": "65-109-160-160", "colour": "#72BB3D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781993, "uuid": "92c2d15f-affc-44ca-bddc-efe47b7739ca", "value": "T166067D17F389723ED46B1A354A378690983BB6216912CDA797FC384C8F3D4942E3E746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781993, "uuid": "8f4d109f-0751-4b28-8415-118864af0c79", "value": "8507116e3d0e7e02e36e7dc5b8aa1af8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781993, "uuid": "40ec2d20-d42f-415c-a48b-dbe146fdf1c0", "value": "98304:LHzYsqiPRhINnq95FoHVBU333l45ywjnt2:Js9q95YVBoZwjt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781993, "uuid": "ddc35e7b-5109-4a08-bb31-dcb76b25577c", "value": 3803784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781993, "uuid": "b602ef44-99c9-41ee-a782-59292c277b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781993, "uuid": "0966951b-0e5d-488e-be1f-65c24980f02a", "value": "\ud835\udc7a\ud835\udc86\ud835\udc95\ud835\udc96\ud835\udc91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3d2c70-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806891, "uuid": "2d16960c-d872-487b-9e4e-750cea2b1c33", "comment": "Malware payload (Mirai)", "value": "1f4602e79357a9ae2b616f023e1a997a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806891, "uuid": "def33067-b476-4a54-b445-d817aa2f6501", "comment": "Malware payload (Mirai)", "value": "1d2f0886cb31c46d4183bfbb9b91c3891a2444e29afe0683fd10f917d46df2da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806891, "uuid": "b74c3942-20d4-470b-b7fb-e46ae434bab6", "comment": "Malware payload (Mirai)", "value": "019517cbbea06f3cc03df837e7dadd69affc7e2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806891, "uuid": "d8347716-379a-4d33-ad6f-1ba032f186db", "comment": "Malware payload (Mirai)", "value": "2e8ea0d5b6f053b9570e83287033d264e338ab5f620f9e1cf12806a963868fa3e7169f11362562c862ae15692859c5df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806891, "uuid": "79810bc2-78d1-4784-86e7-15ab31a8e483", "value": "T123A2D022F30AAD71C070243A4F7888C2710606BC61BF6766AD9545A4FEDAD1B7CAE5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806891, "uuid": "55adceba-9ce6-4d8c-9cba-5cf0f9c2ea1f", "value": "384:PKTe1A2d67kX9C8El3e8chusJQx7SMb1saXyT+aJqD3IyhymdGUop5h2:CTx2QItC8EodYo4uuXyoVs3UozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806891, "uuid": "089f26d5-88ca-4fb2-b55b-82ae137951b0", "value": 22128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806891, "uuid": "9d762fea-ffc2-457e-b9a3-4f18dd00a4cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806891, "uuid": "7158f7a5-d4fa-4f1e-9971-4361167fbe34", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8ac4a7-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748798656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798656, "uuid": "32105c2b-74bf-4f3a-af40-805acf5850b8", "comment": "Malware payload", "value": "3ce7ec99549fc9a46dccd739dcd68399", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798656, "uuid": "f25ad4b5-ffe0-42ed-bc68-b07ba0eec2f9", "comment": "Malware payload", "value": "1d338748d0464fab67d2d1cc9eca819e499b6f808afa1bb9665ee58b66df5510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798656, "uuid": "416136b9-5aa8-4f68-81cc-24d3f802844a", "comment": "Malware payload", "value": "64d683ed8dc4fcbbc68792e7ff7cdbe2af61ba7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798656, "uuid": "57adc005-594f-4247-9efc-babcb1e04388", "comment": "Malware payload", "value": "1ba4ef3da68aa3bc86115614e0a0c7c34ad4f43788d7f532af1a54959ff8c4653474192b355e24bab2ccf83cab7dab22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798656, "uuid": "ec4f6a5a-e0d6-4153-8fd9-9305248ab589", "value": "T1F9E533533FD981B8F1C215B16A92AB2339F4EA725B2197DBCBC4050BDCB05D1A6341EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798656, "uuid": "ce74cd88-9132-4077-aecb-4959bb8eff14", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798656, "uuid": "e808810f-4d95-495c-ab4b-64ce19d22e9e", "value": "49152:pc5WUq54rTisTxB5LWLqq+srI2PgErtcMFUrAHXlj98mCsKDbrZiHNf:pc5C54/f/ssEy5rA3l6mYQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798656, "uuid": "32ffb8e7-b602-4c40-8493-14b05af01742", "value": 3099496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798656, "uuid": "a721392f-6791-4118-b48c-f1d399b4336e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798656, "uuid": "a027500b-f3d6-4d5a-b9ff-9d02d2343775", "value": "3ce7ec99549fc9a46dccd739dcd68399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f766d251-3f05-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748795530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748795530, "uuid": "a88fc34b-2342-493c-8f28-ff40588995b3", "comment": "Malware payload", "value": "3c8392a8b2e2a42be1966927e1c1f5dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748795530, "uuid": "7ff6eabc-7d57-41cc-80db-d510616e4a48", "comment": "Malware payload", "value": "1d978f2d67e2dc707a554b3ba37655438c50c318f2087f4aabd4e80c4c28a49d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748795530, "uuid": "9288b384-842e-4aa0-a8b3-940b6e4c5a34", "comment": "Malware payload", "value": "816fc5d10f19ff675498ca45b39fab7f8cea7f79", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748795530, "uuid": "d1b1ead2-9160-4e8f-9dc5-c93a876ae750", "comment": "Malware payload", "value": "220d61e260bb48945bbaa812724ecabee4174c1d099abf02148fde501b865d2da94722ab0a885239fc8b4101cfa24d6e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748795530, "uuid": "10e80275-b968-48bd-bbac-f3d7399c3283", "value": "T12D63E55427FC4A2BF6AF17FE9C71145107B2B5A33A32D38E5D85B0CE0A627819A017B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748795530, "uuid": "5fbd8cd1-8482-48ed-9d60-7e13e52fbbd5", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748795530, "uuid": "044c15e3-2519-4539-bff0-94539c3cb47c", "value": "1536:ss7ZORUVhhFrwCcXb0UbI8i2EDlhG9U/fgGpcw6hZE25PEyrwiwHiCkuYhloV:ss78RwzCXbRcDlhGXNrAHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748795530, "uuid": "b2157cb7-3bce-438e-a84b-21d3d8179148", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748795530, "uuid": "2c9b7954-d3bc-4144-9ffd-b9021db646c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748795530, "uuid": "4aa1652c-0b8b-4f77-a913-488d6f7edab6", "value": "NiggaClient^2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d443dc08-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748800196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800196, "uuid": "ae61b96e-197b-42e8-8228-ef0c265f9c59", "comment": "Malware payload (LummaStealer)", "value": "f28af8f9e42e18ce72382c9bbe1ff92d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800196, "uuid": "46ae3003-8c1d-43eb-9063-2eb00dca18c1", "comment": "Malware payload (LummaStealer)", "value": "1dbdb93bce3323ca282b1359ff13737ea1251afeb7c5f813ffe1a1daf2338ef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800196, "uuid": "72f5d59c-e3f0-428b-bb68-6b2ac4bfea48", "comment": "Malware payload (LummaStealer)", "value": "3d20207d5c5b0c316a834cf903aabd52a3509da8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800196, "uuid": "75ceeaf1-ec85-4516-b504-a650c383c026", "comment": "Malware payload (LummaStealer)", "value": "6694b19e708ef6538bacca683670b046ed41c9adbd888244b57f399bb6c09a55417e10bb361fb2383e243da7bd62f4c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800196, "uuid": "bc5b0aab-ab53-467a-9653-3427ba53e84b", "value": "T1E6953398A6B7A2BDD9D579312E93AB03DCB0096702CF0D3353FBE557816BB022B0B551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800196, "uuid": "071be861-adbd-40d3-8c5b-81890f822111", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800196, "uuid": "7eefc4ed-94fb-49db-abaf-59a6437dffed", "value": "49152:4HFK1L7XqX049Fyl2MT/qcbL+Gg6dht3pp0BDRwaFlL+VesQQ:3XqXP9FyccO36dht5akUllsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800196, "uuid": "fc0f2057-b075-4a7c-bef8-1f564364f9a1", "value": 1906176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800196, "uuid": "3cbda344-c1da-480d-9c9b-ae966e178d19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800196, "uuid": "c3ebbb68-864d-462a-9654-1ca4fe69f802", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d77b5d-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748786567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786567, "uuid": "34115043-6ce5-427b-8812-7ea205f72616", "comment": "Malware payload (Gafgyt)", "value": "3a31008879c695c01ddd98b33460f862", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786567, "uuid": "52c681ba-5cac-43f1-9355-f4e502c339bb", "comment": "Malware payload (Gafgyt)", "value": "1dd04fa7a2852e5fd553175b268b141bdf009df6dfd4358564547df0efa5dab3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786567, "uuid": "36228bf3-c2e1-4ec7-a5f6-a67e0b49b1c3", "comment": "Malware payload (Gafgyt)", "value": "0ea0534493b73b511c6121bb921285a1dd11fa51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786567, "uuid": "b099fa79-8e5c-4fea-9941-9fcfb67826fd", "comment": "Malware payload (Gafgyt)", "value": "0ea93077a8ecbbe23aee40d75981280c5db9b2ccdfef8aaeab90b3eb023606fa665faa0299b45b208560286bffa56caf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786567, "uuid": "2b6acfc6-179a-4ed1-bdb2-774cd1cb9ac8", "value": "T1A8C32AC79640C5B3D00209F222AB67454622FF3F599BA9E6FB193CB09F305866236FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786567, "uuid": "1c48c0a6-c36a-4669-95e9-ae25cb1fa87f", "value": "3072:9W197+dIYsPvOFug6fetJ8add9Qz3sDzHHt4NKcXeGcgqGK:9nI9ir6fetJ8addQInt4NKcXdcgqGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786567, "uuid": "af06c481-862b-4f73-9e19-494ce8d8af23", "value": 125342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786567, "uuid": "5e667388-71db-4a30-ba09-b764dbd7646b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786567, "uuid": "e3ab1f96-f816-46f3-b850-83501bf7be07", "value": "ftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523151a7-3eb1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759175, "uuid": "a81ff7e8-1c37-4d22-ae3c-4131288507c3", "comment": "Malware payload (Mirai)", "value": "ecccf3b010f53847c6772a84e59d75da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759175, "uuid": "8e117c2d-7010-4445-a5a6-aee96499fe30", "comment": "Malware payload (Mirai)", "value": "1e8d7ac4e2769e5efc1d0c785f5640c1e62fd457a806f677b9651e3009b6b206", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759175, "uuid": "91bb7cf4-c93c-43e8-a1e6-9915cadc3d2b", "comment": "Malware payload (Mirai)", "value": "73edc91c8f0e891bc76a1a9cef1ad4cafc9b8916", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759175, "uuid": "5ab49183-40f6-49b3-a7f1-128a32c42c71", "comment": "Malware payload (Mirai)", "value": "5449c96680a42f55c1df5e97464d7042437298e0e4b79966841239a544281ca5284c503d8369af4f39f3c08de0fd6d4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759175, "uuid": "7269db63-b38d-41d2-b68f-74707fa790d7", "value": "T1FE138D62D43A5DB8F2480578B6748B389723E806D4976FBB16698B769007BDCF90D3F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759175, "uuid": "1b006390-a3af-465d-ad49-f6f619c174fd", "value": "768:/tfYTA3G1s6zKzZlA7I58uxXaHoCYo6vICkw:/pT34z8E7IubHoYMICk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759175, "uuid": "d59e5e2a-93e3-41c6-bbf7-69695016a923", "value": 41852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759175, "uuid": "888a59ce-a357-48de-ad18-2cad8310607c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759175, "uuid": "6ef2a191-aa85-4ad9-8104-3145c21e9259", "value": "owari.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697fda08-3eba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748763080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763080, "uuid": "a2271201-fd81-4a2e-8cfa-e93190b48712", "comment": "Malware payload (Prometei)", "value": "c58744a2605962791fa72bf0e31d17ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763080, "uuid": "a0d89b5e-cf65-43e2-8994-3896b74ba5a7", "comment": "Malware payload (Prometei)", "value": "1f3dbc83b717a7f34b4ec9c19537bb5d7d056a46f0946ef29269b9eb321eb2a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763080, "uuid": "cf223710-3c51-4113-afab-7edf7e7193b9", "comment": "Malware payload (Prometei)", "value": "9352a2d0e762423cff03a2ff386fc572e5b5fef5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763080, "uuid": "3ae52cc8-b976-4dae-906a-bc269f3b248f", "comment": "Malware payload (Prometei)", "value": "e2b5e1ec199a9ed0954814207ade7feb180baa14c06fbf456cca607aa5d1b554b22f02adf4b2ee70e47d89f8063d5484", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763080, "uuid": "77846638-eabe-4d79-a61c-03b4471eb2e8", "value": "T11F9423F8C83D2E3098169B3CBB1A826CF0A15772D9562F7AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763080, "uuid": "17f3f725-7afc-409d-9517-0ea58baa36c5", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgQ:25WOSACZSV6eKRH5EPiamb4DsDwwcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748763080, "uuid": "eedfeb3f-ebb9-4c51-8c88-bdacaf6a5288", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748763080, "uuid": "5ed0dccf-f32c-4051-b4ed-a2f6f3ab4b81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763080, "uuid": "0d1fdf07-ff61-435f-92ce-52f59c6b2fa8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ebcfed-3ead-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Koadic)", "timestamp": 1748757712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757712, "uuid": "00c51251-f4aa-4d2d-82f0-2ebe20ef8b1e", "comment": "Malware payload (Koadic)", "value": "280c660df049b710d9ee59d353dc6dd9", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "Evader", "colour": "#9B34AC", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757712, "uuid": "f661510e-ec5e-4942-9e7f-219ad891c13a", "comment": "Malware payload (Koadic)", "value": "1fc3ec1ee63d1d49e1d008603fbd81254ae16a1fb96e90e84b3f723e50774b6a", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "Evader", "colour": "#9B34AC", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757712, "uuid": "dfff8152-b09e-46b1-8dd8-ebe1921f21e0", "comment": "Malware payload (Koadic)", "value": "c4e14c46c0b6d355e354aff5f531fbe747f90897", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "Evader", "colour": "#9B34AC", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757712, "uuid": "95c6e8f4-1ae1-4a3a-84f5-f4d00fea116f", "comment": "Malware payload (Koadic)", "value": "9eed2e2ccdc6b6ce4b4162469d883a61aa0f90e806c6735c03dafe3bbce9302eb61bffadcaa03b25b261c00e8c23e2f2", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "Evader", "colour": "#9B34AC", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757712, "uuid": "9eb7502a-560a-4f94-8559-8b1a2c11df02", "value": "T1F0F4FD9F0E81F75EB10491CAA28790FE52CAA4FCB1E9D99FD849F65A1CF1D16E103C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757712, "uuid": "26829aa2-adb0-4c02-b888-4d1db7d51b6c", "value": "768:W2wAWxQ0wekXxBXa0klgejcv8BW7mOnnEGWsWAgwKUDXdhjlay+pjo30OgmQHzlP:96SA46cC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748757712, "uuid": "8d493d29-15c5-499a-a0c7-93fc4d87f56f", "value": 751514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748757712, "uuid": "9e6647d7-5b43-4697-b13d-4292aa88427e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757712, "uuid": "d75df27e-f30e-439d-8015-36135c8a98af", "value": "ToDesktop.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062671fd-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786535, "uuid": "876a6f8b-8458-4bee-83cb-19d1f07e4292", "comment": "Malware payload (Mirai)", "value": "6a7018ce526492f1bf2fb9025efc9206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786535, "uuid": "95763c8e-a228-4788-a90b-1ea8f8e57bf6", "comment": "Malware payload (Mirai)", "value": "1fee3cedf2d0e69938016218f2388369a88a78f7f409ce3c5d5bbb09308fd4a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786535, "uuid": "fb6a1287-9273-438d-9356-9af9ff640394", "comment": "Malware payload (Mirai)", "value": "f3b8af388f4d36f1e19710fe1714e63630c3e522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786535, "uuid": "84d95515-ac31-4f4c-b7aa-1f21a643a26d", "comment": "Malware payload (Mirai)", "value": "837af3ff8e86282de0d2a16904cefc0c0a5d2a0a4c955f3882c2d99c6e2d0b43a640585288e0134868ea2724a859cf35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786535, "uuid": "58c5bf46-1cc9-4da9-9730-0df8f94c606f", "value": "T1F603E16DD012BCC1EE99ACF4598E27748D53B2E4B38ECF9567108CE4B518106B8DC5F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786535, "uuid": "7b0af9a7-f2f5-498e-8a43-7b56128f55e0", "value": "768:RTLFubRd+txWGoawaMyrfRjcQrMliGC6avTunMBqwvWZ:RTLUbRdGobRyrZPrQU6aLaM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786535, "uuid": "923e0686-51d0-4df1-b29b-61af67d2770f", "value": 39376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786535, "uuid": "adc118e9-6ed0-4193-a57a-0d499c0e9f7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786535, "uuid": "477ec471-9ff6-425a-bd27-7e0645e34fdd", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7359f35-3ec2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748766673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766673, "uuid": "db899c2f-944a-4e05-bc5a-db9b12f4ce5c", "comment": "Malware payload (AsyncRAT)", "value": "57a25260bdafb8cea3e5c23440fa4356", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766673, "uuid": "02f1035b-9db4-4c2a-8ef5-616fb81699fd", "comment": "Malware payload (AsyncRAT)", "value": "218aeea1a78d22fe8f16cf3b3f8cb549fbf2e63410892c7223b0689ec46c6690", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766673, "uuid": "e9227ff0-d166-4c9c-b4a5-2ee916728c4f", "comment": "Malware payload (AsyncRAT)", "value": "02e63cb6b6bad23d8088804bdf40dbda7b930bfb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766673, "uuid": "109e9919-94ef-4503-88d9-42513bb6c88b", "comment": "Malware payload (AsyncRAT)", "value": "1003b032a879466f6d8b4bdf5439a61e6e12e4519871f09a9fd05bb83552a1f620aaca944a19a98905e0eedb27cf5ef8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766673, "uuid": "3d783049-f006-44e6-bc4b-8f274bae6bf7", "value": "T18B548EAC2A42C337E77188BA89D6FB771665A9716D02EBC6B3E8D1193C13F045F08607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766673, "uuid": "0d661d3d-7a6e-4736-8482-987c9a232bf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766673, "uuid": "0c1466db-18c8-456b-8473-2c55c25c8096", "value": "6144:7YJ/lVINq35pmCgsRjWlOT0V8oELKvqWDvnp6QXD4+:7YJ/lOcgxyejp78Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748766673, "uuid": "1128edbd-5119-4a54-83bb-0caded431422", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748766673, "uuid": "fb48487c-0e49-4b1f-ad80-0eb65796309c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766673, "uuid": "170160d1-5766-421b-9444-ebb6cade2555", "value": "SecuriteInfo.com.Trojan.InjectNET.17.3115.14957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6e806a-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786516, "uuid": "2f9724e2-be9d-42ac-b887-055f3ffb7511", "comment": "Malware payload (Mirai)", "value": "71c3937aeb240251acf917e5e2960244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786516, "uuid": "67aeeae9-9e32-4a83-82d2-5e0ba46e184d", "comment": "Malware payload (Mirai)", "value": "21b45d67ec9b46f8f3245204df19d2c393089fc604923f7d1d04b1c38c52e472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786516, "uuid": "ed9f51ae-4eaf-46cd-959a-054a9349af3f", "comment": "Malware payload (Mirai)", "value": "826c932a264008cdab202584dfa03709a8e87320", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786516, "uuid": "06b098f2-459a-48b1-aed5-1b3d82d47d16", "comment": "Malware payload (Mirai)", "value": "3017ca4a8af62197a41a137e2fbad3caf2f2decd36512dc285371ec4ef2cc548bd289550309b99cfdc46c2975285f129", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786516, "uuid": "67329a5f-ac5b-41a9-9bb5-2f38220eb40c", "value": "T1D9B2C0CC61543084CA8D7C7C178D4A664F68A1D0BAED9B26E350CD98B3BEA8B745D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786516, "uuid": "e94cb412-fa40-409a-b749-221c066c9b04", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpmZqEWvA:/QlS07FUXqIYSXQKquqqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786516, "uuid": "76365c75-67e9-4b0f-90a0-e41a6fa82122", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786516, "uuid": "6df6092e-0d94-4482-9852-bc1167165100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786516, "uuid": "b2e5a683-1979-4f99-9e07-063cbf7f8951", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48eef7c-3e81-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748738778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738778, "uuid": "796b856d-9207-4a6e-afbe-281af791040d", "comment": "Malware payload", "value": "d24302599b92513ffe10390ede8032fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738778, "uuid": "58ff73b8-3822-4217-a36c-364e0acea312", "comment": "Malware payload", "value": "22743721f063c3ff326bb2bb810de33332e21885da3a35b572be1103ecd143dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738778, "uuid": "4b7d3ff4-7e49-4f82-897f-51a49ba288d0", "comment": "Malware payload", "value": "13f3b55ab0eb25d4ac7e533158e22c9d9ae41e49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738778, "uuid": "010d4e1c-3ff9-4fbe-971f-d075f46a37fc", "comment": "Malware payload", "value": "f0f10cbed74b3acb2c34355cd1b7ffad116c61b2e8a654e3f68bd66d5577b505de02dd0dd43fca75251b90aa4fd197b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738778, "uuid": "e5e15aed-c458-4948-8922-56ccccea0567", "value": "T137A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738778, "uuid": "dedc6a50-d11c-442f-a04b-4f3cbeea5ba0", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748738778, "uuid": "8a4a8d0b-84da-4e38-b32c-414d1bd842cc", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748738778, "uuid": "4c0c3cbf-bf36-4efd-bdcf-c7e388dcf7f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738778, "uuid": "da8820f3-53ca-405b-99c9-352e0ced4d10", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5d74d4-3eaa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748756402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756402, "uuid": "a39c8349-0926-497a-9d8f-94e5c7ccaa91", "comment": "Malware payload", "value": "5289c94f1ae20f78d23b2c6c7cfd0276", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756402, "uuid": "49265558-df07-4fd7-b33a-87b79644cef9", "comment": "Malware payload", "value": "22de5ffc9bffe49c4713113ac171b95e016ed0f09065bfee1394a579174e8dd6", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756402, "uuid": "d26b27a8-03f2-456a-872f-f25945456c60", "comment": "Malware payload", "value": "965d653fee4acd9c3fa7258096782d9ee3246916", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756402, "uuid": "d535515c-74c4-461a-8349-108d11c62c70", "comment": "Malware payload", "value": "ab94b6cff0ce992a815ef41e43eee4da50265df750066ce35789016081fb23de41b13aa9988bb95437bd854b06a65610", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756402, "uuid": "d065433f-14ef-443b-b108-48bd2f01e1ab", "value": "T109073312E93D284AC16237B68A33F94B9DDA1A45524DD0CEAED25C3BFC473C16FAD148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756402, "uuid": "bbe31577-8aef-4bea-ac06-37b7d0d5fbe8", "value": "393216:idF9eCjdEgurEUx3Q8SDEoCjNitZUQif3yyWt:id/TJKxKMNfQif3yyWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748756402, "uuid": "547b374e-c25d-4785-8ab9-614c205fe0f8", "value": 17721008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748756402, "uuid": "1bd615a5-e07f-4390-9799-e36cc5aa8be3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756402, "uuid": "5068611a-4719-4fa1-acc3-16283c3efe7b", "value": "bab.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a18ff5-3ecb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Akira)", "timestamp": 1748770613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770613, "uuid": "b0dd1537-e091-4e4d-8b56-ab727f60bc97", "comment": "Malware payload (Akira)", "value": "1c34c1860041aa479c14a9c5b332712c", "object_relation": "md5", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770613, "uuid": "c194e711-b28b-4461-b35a-c10e9b8581da", "comment": "Malware payload (Akira)", "value": "232ad46f353db7bca9d03e88e0c25981447839b221bea99c35f66819f1e17e77", "object_relation": "sha256", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770613, "uuid": "f8738df3-ba67-4906-a9c4-f991374ded04", "comment": "Malware payload (Akira)", "value": "164866ede63d28354981a2fd2dac8c1d137ce4bd", "object_relation": "sha1", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770613, "uuid": "fc3bf220-7968-4409-bea0-c0ecfc85ba10", "comment": "Malware payload (Akira)", "value": "6bd35d88c20dee924f1f13a850cc85f8fd6e3a79345d3a138f46a1234baa508f9959dd9bfcb4145c54849d65cc6f10cd", "object_relation": "sha3-384", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770613, "uuid": "6c293297-8441-4d0c-8b00-816574569ea6", "value": "T18824130EEA28F4ACE03A543B8392D3DD69B53D510210167E1BC5BA8DC73A7606FD5362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770613, "uuid": "a76ae6dc-fec7-4885-988c-da8b91e0ddeb", "value": "67c9d6c07216ca5fe310108a7aa79f16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770613, "uuid": "3e85b1fa-8c30-41c5-82f9-acdb1b09a26d", "value": "6144:4VTORriIAgIJ5r9H3hy1VEjmG4EMfTyr0esrcZ:QCRYgIJJ9Xhy84EIUsre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748770613, "uuid": "d18d1c7e-0749-48dc-b534-115ba8b6f7d2", "value": 227330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748770613, "uuid": "32e9e809-c968-450b-98b2-fbb1a304a943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770613, "uuid": "c339807a-fb77-4880-9b76-6fdef2a2a4d3", "value": "232ad46f353db7bca9d03e88e0c25981447839b221bea99c35f66819f1e17e77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111a53a9-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748786554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786554, "uuid": "96389be3-3611-43e2-b46b-1c3ce40aab99", "comment": "Malware payload (Gafgyt)", "value": "701ad17cfc2743dbb3b36e2c832204f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786554, "uuid": "cf681bae-8871-462d-9062-55f38ee69d8b", "comment": "Malware payload (Gafgyt)", "value": "232ae4137fb3320990dc92c8dcb7b1ef0a1b70c28f34ef7c2f7455d8edba2b46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786554, "uuid": "bf227549-3bf0-4692-84bd-53a5ac377e9f", "comment": "Malware payload (Gafgyt)", "value": "4bba969a282a14395a3d72f041974fd2c379def0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786554, "uuid": "ce8df10d-11bd-44ac-b2be-08f3e42a85d3", "comment": "Malware payload (Gafgyt)", "value": "e85aff27cbf339899243a8cc21a81a640fbf896585e5033982c632cde82a00eb046e9b8e4f1b6966e857199f39cc51c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786554, "uuid": "583b420b-81b1-4533-92e0-df524f7ade70", "value": "T149E33B3767230E63C084487212E32331AAB6DF6A38F913D7E9907DA86F35A443566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786554, "uuid": "672605a8-7229-46ba-a858-e8d0d591d192", "value": "3072:mBwXvBAqGoPkVC9OutJ8adPF4KQTxsscJW107bySQ0VGngf1k:mcvB04WutJ8adPF4f9507bySQ0gngf1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786554, "uuid": "21e905f3-1e02-4b78-a530-3bb3cde420e7", "value": 152319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786554, "uuid": "f0110f9e-ce9e-4d05-99b2-7354482a8c92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786554, "uuid": "3a75a4e2-0094-4ba8-bcbc-801ec2cf8eaf", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecf32b2-3eb4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760673, "uuid": "7ed83bcb-ce53-4ff1-9a57-b5d6d6c16a5d", "comment": "Malware payload (Mirai)", "value": "4789e4589b49ac74ae50a31c9dc2dbe8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760673, "uuid": "8eaeac1b-933e-4cf9-a681-57862f0fba52", "comment": "Malware payload (Mirai)", "value": "2498c1dfe0cc8732afddbec689e88ab6e39808be3c5434379a13c6ed5ec9e590", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760673, "uuid": "8c76897c-b8aa-4ff9-8232-b45bbc6804c1", "comment": "Malware payload (Mirai)", "value": "5a0ef14d41ebc8f263c55c2c4576d1558b22de85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760673, "uuid": "1105715e-a255-4250-9538-3364bd06b005", "comment": "Malware payload (Mirai)", "value": "8e3f6fbf4faf3d08e81aa9d2b2d0b98aea34f70c1f9c1f92e44e880465e719ec2f9b35410e89d56b31329866701438c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760673, "uuid": "2e1e5b9b-bb61-41dd-ba04-a9653ed5772a", "value": "T181D37B73D825AF68C625D170B0308F792BA3A99451875FBE2A67C3758043DCDF909BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760673, "uuid": "c12e01a3-7c47-4d87-a617-27bfc709810a", "value": "1536:VfaJ8oKU+KC5VCp7hatQfQzCuKQ2567azQWlWIwmdaWW6umWYE6k9rbAo:1JJ58platQfmEQ53WlWZOaWzumjMbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760673, "uuid": "860965f2-4a82-42aa-b8dd-0d9ff27db441", "value": 137348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760673, "uuid": "9da7e4fa-afc2-40c7-a5bf-0067f59d4189", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760673, "uuid": "e15f1327-7d30-4e78-8cfa-2257e59bcd49", "value": "neon.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8439abf8-3eb5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760977, "uuid": "e59d79c6-4620-4330-9007-d24c02f5df99", "comment": "Malware payload (Mirai)", "value": "5423be80bb929b29edd6fd43450c1275", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760977, "uuid": "7d409b44-e6ac-434f-9e6b-fad70cbe5bed", "comment": "Malware payload (Mirai)", "value": "2637242b5412daaaaf2b9b77833f57e77ad3b1c4df31b74223a0deb8bee75865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760977, "uuid": "55811700-622d-499c-ba5b-fd8975953be2", "comment": "Malware payload (Mirai)", "value": "c1004609e6826974800ec924af88c887793320f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760977, "uuid": "58bfafa6-1a93-4254-b58a-3145de94a6ca", "comment": "Malware payload (Mirai)", "value": "974d40e1eb2b2da5ef7a66e969eb2e603de54a549513bc85b3085179a548793a78a7fdd87e2955a537cac3ca8897e92c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760977, "uuid": "647e6611-800f-4957-b694-bbc55889d796", "value": "T12013280173180947E4A66EF1383F07D1D7BFFA9221F4F089694F9A4A8135E33468AE9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760977, "uuid": "29928eaa-fdc8-4c7c-9491-a8f29a5e9c90", "value": "384:Wf7L/qax5Vi/c8LcZpxSRNkxfc2E7sr2BLRochYoMBOiUDAJ34LZ3fmvt6d4g5ac:WfTx5Y/cMcZYK1c2hnOvu16DChXt65xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760977, "uuid": "ea4ce5fe-e605-4787-bb59-308fb5dec818", "value": 44724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760977, "uuid": "868f75c3-c6f3-4b2b-a97d-978398e25482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760977, "uuid": "a7c78327-762b-4129-ac2d-4eff9fa39d13", "value": "owari.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42320750-3f16-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748802528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802528, "uuid": "96db5c3e-87da-4b29-a8a7-a39ef7178f0c", "comment": "Malware payload", "value": "6a039698823113ab9387703ee577cccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802528, "uuid": "685bd39b-5fb3-4734-ab24-5492a3dbada4", "comment": "Malware payload", "value": "264a047f7113d8108d90836f2f55379223e23e911696d7492a3583da9adf4d16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802528, "uuid": "eafd7462-cfa7-45ad-a8ba-d93e734d0653", "comment": "Malware payload", "value": "443eadaf8e06ebc9d8462a6f55d1c126748d00ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802528, "uuid": "9f61d330-0be9-4f03-bdfb-1b2831731be7", "comment": "Malware payload", "value": "d73817589c198890a5bd9e5e33ca6bc57d47c80173f2b1776e489f940d1f4f3e3a74a93c38d3b0d40aad1fe3143b7bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802528, "uuid": "a699fcc7-4004-4f22-b2a4-ca6e21c5698a", "value": "T1E926337B6832BD5BC54842B954C2CB53DE47D10F88CB1DD9B35E02A932C312A4BB6E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802528, "uuid": "30ccbf9e-a1fe-40df-bfcf-f42171fcaa07", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802528, "uuid": "43c445ca-fadd-4a76-93eb-680d2813e86b", "value": "98304:bkTOpbe5fRVG8Jjdq9MU4aAG7Uay9JhSBJ1i6h:3b/8/q+UFlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748802528, "uuid": "b4d21195-ec28-4d40-876e-db01640c746a", "value": 4775424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748802528, "uuid": "3d99807b-a86e-4590-9be1-0bbc90295fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802528, "uuid": "5ac58ba6-08c2-47ec-88e1-3606b7bbd759", "value": "SecuriteInfo.com.Win64.MalwareX-gen.3638.1443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931446ad-3f11-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1748800516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800516, "uuid": "bef0084a-50ed-4ff6-8ad8-db3d1d34ab30", "comment": "Malware payload (DCRat)", "value": "b98c2272871480bcfb5041dde13fccac", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800516, "uuid": "c0215a14-73bd-4953-a615-d5acec879c6b", "comment": "Malware payload (DCRat)", "value": "2673a4d00586ce15a056e3dd30f50ce7681c44bb541e3ce6740ec87b6671b5ba", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800516, "uuid": "7db84561-d5cc-42de-8a17-a5ff886a3fb3", "comment": "Malware payload (DCRat)", "value": "99f0aad956b883ed147d94acf898f1bfd06bc35f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800516, "uuid": "37238973-39ff-478a-b6a7-b8965bb0896e", "comment": "Malware payload (DCRat)", "value": "77f5323e05fbb2084d57570365fabe6449ba225943bad5e7038dbd6c4822cbe636b498b39c971cf2703233802bf3b847", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800516, "uuid": "46c4f4c8-6e21-415a-b4f7-2c960992cd4d", "value": "T126B5AF0675928E33C2B017314AA7153D62B5EB223A12FF5B371F5593A9077F1CB722A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800516, "uuid": "375c3579-62d6-4da7-aeea-aedf242a2a71", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800516, "uuid": "9c8189b4-4a9c-4a84-bf25-41d3aa031d8b", "value": "49152:IBJ87tZQKWnNyOMABQ4WjL5yKMeEuLEPnDSoKvA:y67tZQ/kOMh4M5ylrSoKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800516, "uuid": "1f8ff8cf-7a5b-44f1-8ab0-01bf40456b9a", "value": 2282711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800516, "uuid": "831cfd24-1dfb-4e09-8943-1b4549cb9c07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800516, "uuid": "1b48627a-e39d-4a95-99cf-5b2a2f1794b9", "value": "b98c2272871480bcfb5041dde13fccac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5305c35-3eee-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748785567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748785567, "uuid": "289c1f8e-2a7c-4339-b75b-302290166f5e", "comment": "Malware payload", "value": "4069f254c4cd7130eb15193e12e2f12c", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748785567, "uuid": "06a9107e-4510-4a39-b54d-27f5ab18175b", "comment": "Malware payload", "value": "27fdd841e80c9ab1370662dbda0c3a9ddaae5dc04d9174c609d30c3fecf707a6", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748785567, "uuid": "ad90a8a0-8978-41d8-a1c4-008c35e7ebba", "comment": "Malware payload", "value": "eb00f7a7e13ddd3d90cd7ddce19249f8246c682e", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748785567, "uuid": "332d8223-cc23-48d0-9dc7-25ec0be96b92", "comment": "Malware payload", "value": "b4f67c36dcfad496ab8e7128a6030f573b4e581a9ce729ccf9a26ec0b08edef94cb4bed127f311f4efd4d7e093c40cc7", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748785567, "uuid": "0409f47f-9376-4655-8ce9-880aa42704cc", "value": "T1FA97F183E764CD36DDBF827A58AA536277351E846783A7933109B2B87CB36D01B40BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748785567, "uuid": "a5651c87-2821-4eaa-9ba5-b92f7cdf51ea", "value": "786432:ZdQ1EiQB6Q2y+DJDNWcpqYbq1E0oEtWIprWsHXKLH:ZdQCb2vPpqV9LdrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748785567, "uuid": "e86574e6-7df9-4583-a43f-5aca55e96d71", "value": 41540860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748785567, "uuid": "7a2a2ea2-8c52-4654-b929-56bda32843f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748785567, "uuid": "8b934681-91d1-4397-83f8-5b03fd796ce2", "value": "Swift Chat Messages_3.2.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738ce751-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806905, "uuid": "ff128ce6-db30-42be-ad11-5696114c4d5c", "comment": "Malware payload (Mirai)", "value": "00c01cc1b4fb8cc29daae2242e63568d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806905, "uuid": "289c59dc-aa93-43d0-a4d3-43aa53e60006", "comment": "Malware payload (Mirai)", "value": "28eb5b3cb81d434985ff370a187f8eb637e9c8ec77ba92dcd5d43597e9bbdad8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806905, "uuid": "377ac2c1-8008-4796-9555-88f44bf1af98", "comment": "Malware payload (Mirai)", "value": "2f610faae0f9be439bcbc8811684fb5bb367e1bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806905, "uuid": "28e77b0c-a36c-4540-bb38-dee793ab74d2", "comment": "Malware payload (Mirai)", "value": "cdb4940e2e56c8802b9a67b316190b8645f05002922f6f2a67dc11a41be882973616a975f3b54482c3be2fd2939f5310", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806905, "uuid": "c066fae7-b841-40ea-a8f6-e4146e76e5ee", "value": "T1DDA2E019BF1C868BC8323A7555D9EAD21293FC61F29CDC092A40D16BF0A33A91834F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806905, "uuid": "9c159141-e47a-4ff6-830f-867d143e4685", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTL:O98o08kxofBE+ZkXaITbp2F2TWul0c5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806905, "uuid": "87c951bb-e037-4eb5-a19a-11ea78e0bf08", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806905, "uuid": "db47f461-bde1-4195-b931-576d195fdfc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806905, "uuid": "c6dd1780-3c5b-4e7d-ba7b-cbf54cff73c4", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59964a4d-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748765201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765201, "uuid": "181acc60-4033-4dac-a10d-b5a875b067f4", "comment": "Malware payload (Gafgyt)", "value": "d08f85a9159cc63ae3347e846415c6e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765201, "uuid": "323aff3b-ee93-434a-ba38-1f7b231f4b29", "comment": "Malware payload (Gafgyt)", "value": "2aa784d3366ba4524697e4a7e269b96ba661a0c5b670bb57b717335d641f6d74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765201, "uuid": "de924e40-49b4-42a6-bcb3-09bc6c2724a8", "comment": "Malware payload (Gafgyt)", "value": "bff8ddcdbc2361b07a9a029ff677759656f34d8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765201, "uuid": "4d5e8226-cbee-4ef8-89ec-7912f5f51940", "comment": "Malware payload (Gafgyt)", "value": "3c62242f88acba75b4b60813577b2e82213dad28f31710d75bd2639c5b0433cf01b3f9e0487a727c028a1fade8576b7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765201, "uuid": "5c342329-5dfb-4a29-9bbb-71399f6bca93", "value": "T154C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765201, "uuid": "12e00bcf-4ed6-4644-bc20-00bdccf81c69", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeiEdWfRZrmW+IFj:Ted0W0MZQHUd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765201, "uuid": "4bcfc8eb-137e-43a2-8866-0a5b76fafab3", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765201, "uuid": "fce7226f-9008-454f-ae22-0ab155cbe1f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765201, "uuid": "5b59fee8-180f-4006-ae67-b87fe00f93bd", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530fca2c-3e89-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1748741997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748741997, "uuid": "ed5bcea0-cb9d-41fa-95be-c0d1e4e1a034", "comment": "Malware payload (QuasarRAT)", "value": "7c1fd7240072a6a6f53d93f191d769f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Waynesson", "colour": "#601303", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748741997, "uuid": "4aec8fb5-d357-47eb-9c61-ed516f65d230", "comment": "Malware payload (QuasarRAT)", "value": "2b556da7af4e05fdc5c0a47bbdcc999bc9f3f708f7aa88f07ed3083f88d45432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Waynesson", "colour": "#601303", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748741997, "uuid": "9e98cc00-3cb7-4ee0-8000-c7b7a632ea25", "comment": "Malware payload (QuasarRAT)", "value": "c0f3004513ea69aca854da4a740b176d04be8a35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Waynesson", "colour": "#601303", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748741997, "uuid": "5d90fb7f-3e47-4fbe-a809-9c8915e5447d", "comment": "Malware payload (QuasarRAT)", "value": "d02c9ca578f30ea2a8fdfc9a75a649318ed247c8ce501acce27b8fda5c629446c280b11b86e7e22d9a414aae61850e25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Waynesson", "colour": "#601303", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748741997, "uuid": "b6b2c04b-618e-455f-bd4d-03b0a6837b01", "value": "T131E54A1437F85E23E1BBE273D5B0041267F1EC2AB3A3FB4B6191677A1C53B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748741997, "uuid": "2b76d203-2afd-477e-a6af-e9b7cfe4ec2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748741997, "uuid": "9d328b39-c31c-4aa4-ad14-b4e1e99e68d9", "value": "49152:/v4uf2NUaNmwzPWlvdaKM7ZxTwkCC1JdLoGdeTHHB72eh2NT:/v3f2NUaNmwzPWlvdaB7ZxTwkCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748741997, "uuid": "6efb6d3c-7e0b-4f58-a270-89ea286d09b8", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748741997, "uuid": "7745533c-7f7e-4383-9564-e52f3fe473fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748741997, "uuid": "1d95d598-1317-444f-9b18-2963f894cb9f", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393df66c-3eb6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748761281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761281, "uuid": "7d1ddc97-5bf2-455c-9ef0-9e33e1243d71", "comment": "Malware payload (Mirai)", "value": "6a9139e31ebca87c5c66174b580cab2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761281, "uuid": "e30638b1-916c-4c52-8a47-51b52460f32c", "comment": "Malware payload (Mirai)", "value": "2c2fc8d2f592f8e78de8e7b40bf85167703d042b103365cc4b24ad81aa34f33e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761281, "uuid": "107358cf-ccf0-4dd0-aa3a-902f3e7c8ec5", "comment": "Malware payload (Mirai)", "value": "99c451ef75e478bc9b8badf534f877d47a38b67a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761281, "uuid": "ca2cf7db-f498-40dd-8857-5b77fe08a634", "comment": "Malware payload (Mirai)", "value": "8d93edd308206f544cbdf114027810c1a375bb5fcddb0bcca1d0c4899022be84283cc815c802a8acc450f193cb34065f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761281, "uuid": "049d956d-2ba4-4830-9ebc-a9893082f751", "value": "T1D913F1184B5101E4C63EA9B25DBF3A090586F391E82CC09F92C43A3B5495B5CFA5BB6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761281, "uuid": "dab6bac4-86c2-46ae-9ecc-9a64dab90b13", "value": "768:bR6DhK8bduGsRc1qo5hjcQ63zrup3SyoAurfBmi/No46EDXA2efWW+/w3liTgnbr:s1FwHEzj96jruNSjrfc46Z2hI3lwgno6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748761281, "uuid": "e9e87e0a-5091-4845-9b6a-c0cd58cb7d31", "value": 45260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748761281, "uuid": "1a0fdb24-64b8-41d6-9f42-ca29a27eac82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761281, "uuid": "692f2dc8-bef5-4861-9254-adca4bff9ebb", "value": "neon.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dacf6218-3f35-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748816098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748816098, "uuid": "d804c102-7153-4e60-b6ae-ab825879d115", "comment": "Malware payload (RustyStealer)", "value": "5cd5968f201e8f910c05696047e45e58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748816098, "uuid": "d2214041-ee07-44e4-9990-f7c62fb08972", "comment": "Malware payload (RustyStealer)", "value": "2ce224a0090d40a155f1e35b7ab2ce95ce9500859916ec1b780aafbde9c8b50f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748816098, "uuid": "9c24195c-971a-4012-af2e-b043043ba7fc", "comment": "Malware payload (RustyStealer)", "value": "03b0ef34085e7c8a29f14997cb0279e45f1b85c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748816098, "uuid": "f7184776-4c11-418d-b0af-2f8e940531d6", "comment": "Malware payload (RustyStealer)", "value": "91f951f00251775f7efa055f4369112e70e4bde880bf16cea585d2a635809c0fc0b465af8851f23fbc21c90acb1f45f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748816098, "uuid": "9bd125f8-7efa-42d9-accc-2fa91f68a895", "value": "T1BE642925BA9695ACC54AC078834A8673667174CB0B32B9FF41C442383FBEDF65E3C658", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748816098, "uuid": "aa71e9eb-8615-49a6-85b1-a02d291380cc", "value": "5dc4246cf659a2f8704ffb9fcc80da38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748816098, "uuid": "b2fd7b36-d195-4e90-8d56-2fd834932eb5", "value": "6144:8fjy38AJHOoxGgYL7H0HQ6J3Z0oLnXutlXd2nyq0JO9qM:omUL7Hy3FZ29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748816098, "uuid": "1145d729-9159-431c-962e-9e64626ee49a", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748816098, "uuid": "419b9869-708f-423a-a910-d815d573302c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748816098, "uuid": "7f26cc5c-60ef-425e-9008-2fdcbe1aac9f", "value": "bigvirus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eabf495-3ee7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748782282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782282, "uuid": "7a7d5ea8-8441-4df9-adc2-6ee1ab5b3539", "comment": "Malware payload (Mirai)", "value": "d8724a87afd8f9eeab1b2aede3ec3818", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782282, "uuid": "904eca50-9172-40d4-b088-5e8ddd0c1d22", "comment": "Malware payload (Mirai)", "value": "2d39cfdcc84c1a186d2f92eee9161bc67ebed639cf1f099734a0b964445039e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782282, "uuid": "88a1a98f-d1c3-4c3f-82a3-1da790b96b0b", "comment": "Malware payload (Mirai)", "value": "140530dc37aa5d40ca9e3efc388bc576e595a079", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782282, "uuid": "e999d775-298e-4a06-9c6a-13886968f785", "comment": "Malware payload (Mirai)", "value": "a5b1fed93f68e6b820412acff1802ccda130eb0ef14b1df845ef988e39e9a8f10247e7c3c1c4992f59df6fee43ad74ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782282, "uuid": "ac05e74e-46b9-46cb-a45c-df3004de6e49", "value": "T1C6F33AC7F801DDBDF80AF33B4853081AB130B7E250925B3762977967ED3A1991963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782282, "uuid": "2118e47a-3bd4-49d5-bd99-ca77b249be3a", "value": "3072:klnDkEpsDP9WCFpd62EWpTBjVvjbitLQKigGynpSiZ9:k+VWCFpc27TBMLQMGynIiZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748782282, "uuid": "7f1c1eba-fc00-4860-befe-865208f563f3", "value": 165792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748782282, "uuid": "6aa8ab04-318c-4033-9668-269417fb00a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782282, "uuid": "9dc925f4-690b-4d8d-8718-c3d78c1beb36", "value": "navo.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482f6178-3eb1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759158, "uuid": "6b6c9873-4c20-4bca-ba22-6221b9b83aa2", "comment": "Malware payload (Mirai)", "value": "82946586037327564cbc4fbfe1425cde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759158, "uuid": "567e7076-0ca8-4183-b1be-b07c6b2c0501", "comment": "Malware payload (Mirai)", "value": "2de55dfac7011176186e4fdbd674ed2b4f1f7e4eb8dd22b2ed951c0fafc84707", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759158, "uuid": "42b77816-8943-4762-bbaa-d61aa9c06389", "comment": "Malware payload (Mirai)", "value": "732f99fa6da19d672e220f50aa394b07b9aee088", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759158, "uuid": "fea40239-876d-4c22-8c7b-047bc2462236", "comment": "Malware payload (Mirai)", "value": "3493f5ce375cec342bbfcf7db8015a8eed026f1f0a8972c9738e1df2b69465027ac08455a5e131b910ae3103071a8773", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759158, "uuid": "03757db8-09f2-4682-b637-adb8051d43f4", "value": "T107E2E1B4D5D8AF95C6F89C7CAA20AEC53F61CF4D3FA8DE5241C5AE206C71D06A7008C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759158, "uuid": "7dbb7777-4440-4b34-b4a8-8a4be170a4be", "value": "768:vDOGcFUihN9p1sFUVigTr12R+6Rbbzonl3sgb0wO+Y/17tpY4uVcqgw09p:bO+4sFMP12R+6b4nPIwb+1hO4u+qgw0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759158, "uuid": "4ffa7fbc-4d8c-453b-9b00-0ab92ea71a1e", "value": 33208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759158, "uuid": "22ae4145-524b-4b66-81d3-dcb8a5bfbfcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759158, "uuid": "ee094647-d929-498c-9cc9-7ae4d4ee1e60", "value": "neon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c14376-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748759468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759468, "uuid": "9004a04a-fa7c-41e0-af33-dd5c7b16f887", "comment": "Malware payload", "value": "9cb948fc7c8f64d5f2629d1613f7ca65", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759468, "uuid": "7b900baf-903b-410b-8091-b7c4c181f8b8", "comment": "Malware payload", "value": "2df3b9c7a1ef50f1e6ccdc8a3aecf5ff4674024069286398a5340037d0237345", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759468, "uuid": "12857ccb-991e-4e88-8e4e-2d458ae34f6b", "comment": "Malware payload", "value": "c729f0093eb6cdc60ba3f5a54a763fe1b80d110f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759468, "uuid": "8a079d75-c898-45c5-8f4f-4a5028a207cc", "comment": "Malware payload", "value": "d84fc86a51dbd30ff6336b7ddbfa402f767faad9c0514dbaee666d4f6bd42e81c0e514d90ece10298158b2142dfbb2e7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759468, "uuid": "2ede8e13-c343-4218-a731-44f376e900db", "value": "T1F91186F903B1D32594574F9AB0B18B05B44AB7A536B70F28E4C424F25A4CD64B885E37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759468, "uuid": "8c727b3e-c91e-47ea-bbf9-a45b6872f684", "value": "12:QvJXOpue8f+AiJKggrWKIw+gBA8U8W648v8o/uwvwQewKwUcolK4w30w3lK5q1:QvZi4w3RaBA8U8WB8v8o/uIGTW4dcK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759468, "uuid": "86dc4261-b8ce-4bfc-ba67-f18f2b715f70", "value": 939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759468, "uuid": "27343b1a-21ed-40b6-8b83-2041a6e18e2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759468, "uuid": "35450c99-3492-46cb-9d4d-594e4febe5ac", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0f8f47-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786544, "uuid": "422c0643-a697-41b1-8dd0-75ce9f1a090f", "comment": "Malware payload (Mirai)", "value": "ee8cf03eb9b06c3762f77027d1861643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786544, "uuid": "aa40ac7b-6a8f-430d-a598-34d5baf455f9", "comment": "Malware payload (Mirai)", "value": "2eb14a96e35aab69c9dcd594a5e85c2dbeb63956c18e527f58130832e1e85488", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786544, "uuid": "48507b3a-6d24-4094-9901-d50defa9b4a2", "comment": "Malware payload (Mirai)", "value": "f436761c0ac2794e257508bd03115078c3f58889", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786544, "uuid": "dabc6dd6-ed8b-4724-ae07-492371421660", "comment": "Malware payload (Mirai)", "value": "7b2e9c0bdca4be36ea3f622d7ca241b3b1a39b94174e0cfc7f62650ef4aa794768a659aed23c493fd891bc04839af897", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786544, "uuid": "e3449292-2cd2-4b66-95ba-bb4444c5b9ac", "value": "T1E3832A97F800DD7DF80ED7BB4453090AB671E3A116831F36675BBA97BD321A54822EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786544, "uuid": "3522ab4f-04d7-455e-b866-0e880f39766e", "value": "1536:n/vD8wpvE1O+ZFyXChE8ByyMF7FsojayY1zc6NWnIwAi4pees14ku:n/vDnpZ+byXChjyyMFm7yIzcKU4peN1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786544, "uuid": "0f7488e8-1a0c-4138-aacc-c76626688779", "value": 84784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786544, "uuid": "48d442a9-87a6-4bb8-b2fa-f7f225daadbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786544, "uuid": "c01fb7fa-d4f5-4e67-ae42-9c3fd6bd0b39", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee56ef2-3eeb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ArcaneStealer)", "timestamp": 1748784188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748784188, "uuid": "b06bd92b-a58e-428f-ae41-97d6894a5c7a", "comment": "Malware payload (ArcaneStealer)", "value": "310e4b0bc728f38f0d177c811fc57527", "object_relation": "md5", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748784188, "uuid": "aff4d212-7d18-4425-8b4a-950e57b816c7", "comment": "Malware payload (ArcaneStealer)", "value": "2f795839b213c43389e207cd24a9999f75080e237f018a6578bf0906ef837a2f", "object_relation": "sha256", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748784188, "uuid": "2d539a0f-0e71-43e1-ace5-0ce4fefe4148", "comment": "Malware payload (ArcaneStealer)", "value": "d6df751205f8efc41fe5d609725ace491a2f381d", "object_relation": "sha1", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748784188, "uuid": "0e11bf2d-1db6-43bd-bd6b-690eba013e2d", "comment": "Malware payload (ArcaneStealer)", "value": "4cd3fbafe136d1368e3d6902aa253c2bf9c0a00a753bf0fd8ec0f5f819ef01ac9008a8fe9a36dd239e62c43c31ab5201", "object_relation": "sha3-384", "Tag": [ { "name": "ArcaneStealer", "colour": "#884033", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748784188, "uuid": "45f5839f-e216-4729-8c63-20ea6b676a9e", "value": "T193F35C453B79CC0CC8A055F9AA737F900FF9997C5B0A9B2387D6BE21D119AD11E1F206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748784188, "uuid": "45692e4a-d7e1-431e-83b2-4e14e609c6f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748784188, "uuid": "09867280-6bfb-46aa-9fd9-d5ce9cd7aa45", "value": "3072:kLumj9z0NWsLA9Utolso80ghVtJj7yx1wAV/bcrMDeIO+26IyF08pPwSz3VR:0b4M016I0Jw43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748784188, "uuid": "46d00ebc-45b9-4145-a98e-951c2b72a2bb", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748784188, "uuid": "f878898d-955b-413f-ab04-82c2ca9907ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748784188, "uuid": "445f3ec3-07e9-435e-8753-51e08479bee0", "value": "SecuriteInfo.com.PossibleThreat.31868.23078", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b7dd33-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748800124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800124, "uuid": "9d0d2eef-c87e-4242-875b-5cea89ebb58c", "comment": "Malware payload (LummaStealer)", "value": "7c3b1245d2d9e08b0ba41404ad0f2ce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800124, "uuid": "1b7cc43a-3947-494a-a734-eabc43926413", "comment": "Malware payload (LummaStealer)", "value": "2f7f81432177a7781400778bb51f3c69f28eba0ebe7320989a55f71ab529f7c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800124, "uuid": "744d6177-2ebc-4a3b-b1a0-29fdd4ff76df", "comment": "Malware payload (LummaStealer)", "value": "6a355692eb76d17c10d92e55f1e1a44ff9dc1bc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800124, "uuid": "31d423d4-484a-4d52-9a24-6988c5361c13", "comment": "Malware payload (LummaStealer)", "value": "2a27ad4c39688ab6143653ab2ba3899ff4e7bdf3d8d8cd32f26127149cf127576ae310520f8efef1edd772019ca02904", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800124, "uuid": "b272c2c0-31de-45bd-816e-c0c343afb34c", "value": "T1C495333724FBF199C40DA3F856316A442F8D46A3B3CA36F0DF5C7E6509E4A205392E59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800124, "uuid": "5307f70e-a777-4eec-b3d7-54ecabb42ad1", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800124, "uuid": "398d632b-925e-45d5-ac56-aaed577fb6ea", "value": "49152:X/MNu6JoegTzq7x6c2+nYNBwGi/1G89oXH5KE/yE6sHOYj:v8Jo1y92+Qv+1G89IDyiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800124, "uuid": "9ded09b9-5321-4b51-b099-42f74ed2c666", "value": 1894912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800124, "uuid": "83592f31-cf0b-428a-9910-180dd67f3a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800124, "uuid": "3f84dbf6-a7b3-4021-849e-85464c01dacf", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6c5bcd-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748799753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799753, "uuid": "3f7ec091-9d2b-4d13-a3d0-e2eec9a3ebd0", "comment": "Malware payload", "value": "d125ddd0da43cd36136c2f5880fa800a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799753, "uuid": "321d4787-7aa8-4526-857d-4df480a7520d", "comment": "Malware payload", "value": "2fef3ace88004e5b95f60b72459ae6ea97c7c236e06ad782c669bcd5241c8f29", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799753, "uuid": "45a0915c-1e9b-4ffe-bfe2-1f5868e74b01", "comment": "Malware payload", "value": "a166e623615a5176e9bc28dd7135a3732da6edb3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799753, "uuid": "d844062e-8950-4df5-bb70-0bce9fda8763", "comment": "Malware payload", "value": "34d89314b7a7cb953ce0200ee9e662bb9945432be6f3ec706b771f7f6c11e96a51d4df3e68d5b7f0b66399b81166c7f1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799753, "uuid": "23836734-75c4-4aa0-a9ab-88051271b1e2", "value": "T1F931CE380DE102EEF633C3B9ABF8B3B34421FBD2DD7586BD118062455712100B8A7A3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799753, "uuid": "69c64d85-e23e-4c0c-ad48-e35d2e6d37b7", "value": "48:8+5aeZXk7Cgbk7KvjpLaMbLYmvq4abBk:8+5Xa7c74YWL7i42k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799753, "uuid": "fec2dbf0-650c-4f88-8d93-fe991a5dbfdd", "value": 1726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799753, "uuid": "338200dd-b8e9-4e88-8925-daa972d6cd84", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799753, "uuid": "40ee15d6-c960-4246-96b6-6e6b827358f2", "value": "UltraViewer_setup_6.6.114.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bcb770-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786637, "uuid": "cc09471a-c25e-4d3c-be39-51f19f2fef34", "comment": "Malware payload (Mirai)", "value": "6835862a9e4c123d282245bfd714b55c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786637, "uuid": "db30778f-e318-4012-98ca-7cfe2b0e4a61", "comment": "Malware payload (Mirai)", "value": "307a166b73d58fc4c22c032cb8bb080d153b357d9f48f51c61dab3fef32e6127", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786637, "uuid": "f61b3253-c8a7-4ec0-b29b-4359561a68f6", "comment": "Malware payload (Mirai)", "value": "3fd35b06dc103a71f5336a0db8c181db5e55598c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786637, "uuid": "7266a3f4-15d5-43c4-a696-cc60d906d96b", "comment": "Malware payload (Mirai)", "value": "606903051602d25bc5a228b9d4a3c42a76a4604e4658ca36914713ae1801fb7f5b3b2fc6557943f51dba073679b4d6ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786637, "uuid": "f904ba2d-833a-4650-8c1a-0a7df8dd3300", "value": "T12E831A96B8814B22C5D512BEFA2E118E3313177CE3DE73129D106F24778796B0E77A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786637, "uuid": "661a4946-bbb9-4d38-839c-decdab29d896", "value": "1536:4enTB4FRuYdywsgi5PgRRbaKzotPQFMyiSdCs9TrNW07wB5kYJGd:zsRvURJgRRbaKAs9TrNW0sBWMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786637, "uuid": "cad966d1-9b5f-4d52-9228-57ded00f380a", "value": 84212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786637, "uuid": "e9c63f2d-2aaa-45a9-b9a3-d4b9c1a276c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786637, "uuid": "553e6797-b8bf-4c1e-9c5f-81f0878216ca", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd707be-3ee7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748782579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782579, "uuid": "528e5e70-6a33-4048-9f55-201ebb9de9d5", "comment": "Malware payload", "value": "f4026ffa4d11ee8931699bc10f2b3a10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782579, "uuid": "4372c8e1-2ed8-40b3-8c0c-906083fcce91", "comment": "Malware payload", "value": "30cc157bd428533d13afe121b30fdcd1507f755f16cec95e2274c15627ef7ea5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782579, "uuid": "98009fb3-28f3-415f-a709-6456202f25be", "comment": "Malware payload", "value": "64cc30a82cc42883f8af61c055c7152bbe11c95f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782579, "uuid": "a56aac06-21cc-4e41-8d3e-6b162757fd2d", "comment": "Malware payload", "value": "e861375e10a4b5b4a82d06a8bd49f31203d2a3601fe8dcab94ffe1fae3aef01e53cf9b17627860fc1cba2685cfcc7074", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782579, "uuid": "edb2c060-e71c-412e-bd36-5cc839984890", "value": "T180A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782579, "uuid": "484961aa-f1b0-4649-a6a7-56cfb858ac55", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748782579, "uuid": "ea25c156-a76a-43b7-8671-f0bf2eb3c473", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748782579, "uuid": "d484da8c-d948-459c-8e1b-15f4d0c47be2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782579, "uuid": "8044ac5a-fcfc-4a5e-a68f-b82ea70aa8e9", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04d0b28-3eaf-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748758447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748758447, "uuid": "591382b7-d4a8-425e-88f7-bda19571089c", "comment": "Malware payload", "value": "b00ebbc0386a39d43d2ff315272b244d", "object_relation": "md5", "Tag": [ { "name": "dfsdferxc-com", "colour": "#951638", "exportable": true, "hide_tag": false }, { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748758447, "uuid": "c33cb98c-8e2b-46f8-8a6f-cc5f6b0d4254", "comment": "Malware payload", "value": "30cef0f5e7b98ab1f564b0ccf6d524133ccab32bf945a9eb87917df3b6bcdefe", "object_relation": "sha256", "Tag": [ { "name": "dfsdferxc-com", "colour": "#951638", "exportable": true, "hide_tag": false }, { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748758447, "uuid": "b153b853-b56f-49a5-aca0-4065087282df", "comment": "Malware payload", "value": "8f7f9eba05c35017eba4833511f26f36f1b683c5", "object_relation": "sha1", "Tag": [ { "name": "dfsdferxc-com", "colour": "#951638", "exportable": true, "hide_tag": false }, { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748758447, "uuid": "b214f966-707c-47b9-b7db-6a97fdfb5e28", "comment": "Malware payload", "value": "190d0e1de30311aaaa3a2871237d87e8feaa926cd59945e6e615ba66f062b3ba306a9d6dde35958115e8b964bddbedc9", "object_relation": "sha3-384", "Tag": [ { "name": "dfsdferxc-com", "colour": "#951638", "exportable": true, "hide_tag": false }, { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748758447, "uuid": "741ffcd4-29b7-4cb6-9c1c-e896b772d9e4", "value": "T1705182961B11C53D4770AB3A7F0511CCBA00C0E0DD96A371007EDAD22C296E99BF2FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748758447, "uuid": "ac4f4807-7117-4af1-93ed-ee5ea8c6a421", "value": "48:eCwvnFruVfssXTRXyFmNjd4kEz13SrN0X/ERypn5WKXQbffLD820b0IQRwVKxupU:S129fNjd4kEpCZ0X/ERypn1XCX820bT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748758447, "uuid": "f4d453ed-f1d4-453c-81ce-062e162e683f", "value": 2684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748758447, "uuid": "e3126d9c-ae23-4f8a-9a4e-01aa99b2da41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748758447, "uuid": "9a8ca701-a3c6-4976-9343-43c99edc4743", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6b83c8-3f1c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748805098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748805098, "uuid": "4771d1f8-937b-4774-9022-9f4d4e5499e2", "comment": "Malware payload (CoinMiner)", "value": "13cf01c7a994601abcebca04e49695fd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748805098, "uuid": "38466438-f0be-4880-b428-01a2129a948c", "comment": "Malware payload (CoinMiner)", "value": "323d104d40becaddc05d2c48a53b685ead32c3cfb88aa11f0307d0a0e5e250d2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748805098, "uuid": "362eef43-995f-4555-a462-98465722559b", "comment": "Malware payload (CoinMiner)", "value": "e15e2211d20309f38a1fe1b472a7c2c1a618f61f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748805098, "uuid": "a94cb202-5447-4f03-b3e8-a92138ce103d", "comment": "Malware payload (CoinMiner)", "value": "17cc3c20b039f12971b6e4c63cddd3e4a57e08f1d820f6b9ad2af78db2a7b43371e47ce56bcd6fa2a281108008988c2a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748805098, "uuid": "c529c2f7-857f-47bb-91a8-71ab1e1d85b3", "value": "T18676126E445C10F8FE2AE8F59E6B3713CD1BF89307719343112B43958D8AA529BA327D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748805098, "uuid": "6101a244-5ec2-4f5f-af71-80b47972744f", "value": "bedd6d848bac4316f8d2ce8b5991d853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748805098, "uuid": "99463d79-d05c-4251-854a-e50b13820191", "value": "196608:BxXN+u9WztUF64ucyKEJw0JhvYcZpFVl6Cd:Xd5cztU/y9Jw8BTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748805098, "uuid": "d02f0d9a-df6d-47ad-830a-d91e66b6ed5d", "value": 7781888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748805098, "uuid": "a4140c4e-a174-421a-b11c-7868bfe3e4d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748805098, "uuid": "4bf11418-a0ef-4c54-8c0c-ad5bba412e23", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb2b66c-3ef9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748790202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790202, "uuid": "27e8280e-e31c-42fa-b3d8-1724f0f9de78", "comment": "Malware payload", "value": "997b02d6a1588743d2e830350343c4e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790202, "uuid": "0a4a0e69-8046-4eee-acbf-243b9781ea1d", "comment": "Malware payload", "value": "33e1a0a62a6667c86cae7fadd76e4571b54decae4bc8073a897cd0905b376309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790202, "uuid": "7c223111-2600-431a-be02-9dea057e9ea0", "comment": "Malware payload", "value": "7096844c14b5dcfaaa92a5d708d85c256ff91d28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790202, "uuid": "5e671002-1c63-4966-9f2e-e177a8bd4a02", "comment": "Malware payload", "value": "90956f585fef0086fe6868041c82fe89b5698f844cff68aa9a301688005a50764de59c34bb520feb599502f579b4210c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790202, "uuid": "28ac23df-9cfa-4486-8262-fc5fd1603054", "value": "T13C28335172F844E9D0BAC135C9958A4FE7F278400B3AC7CF00911AAE1F7B6E54D2EA76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790202, "uuid": "8a337765-d15e-4039-a735-d71b6cf4b678", "value": "838dd9fbdbb409224ad0e13122a109ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790202, "uuid": "ea46be93-44de-45f7-a330-54b0cf1d62af", "value": "1572864:t0A5XBbWLBbWLBbWLBbWLBbWLBbWTBls8ZpWpftmIqRI0xiTlUB7JtKqNzu8y5T2:t0A5X5q5q5q5q5q5UHszpRQfMBUNJsXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748790202, "uuid": "644ad6fb-5745-4789-a7f9-c59d010b0c55", "value": 94833124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748790202, "uuid": "1f6424d9-2683-4e73-8b1a-4edd76862b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790202, "uuid": "ea0a0260-694e-492c-85ec-72ea3d1d4026", "value": "gogvchV86_21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3426025a-3efe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748792196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792196, "uuid": "9c432b76-5195-4450-a922-4556fb10ceee", "comment": "Malware payload (Mirai)", "value": "994a1a3c7d1093e9c289e94e8e470dec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792196, "uuid": "03bbfa4b-a016-4e9e-bd4f-b63b3ffb7634", "comment": "Malware payload (Mirai)", "value": "35b4ed0eb8675a7b780bb25332c46accd2bc863f02b0dc701faaa50384f37e14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792196, "uuid": "abdf8542-bde4-494a-aa17-1f9f98823e45", "comment": "Malware payload (Mirai)", "value": "40d20e479da90f60afac7e7c78a9378f21688a6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792196, "uuid": "ea35d48e-ef01-4a6a-b262-412148f54d59", "comment": "Malware payload (Mirai)", "value": "38e315d0c453029e31ec986a7c5895ae257b9fd0330d7039ac8cf6a3e833c0b452c5a2064a4fa002d3001edbd3750200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792196, "uuid": "c3c8ecba-0cc0-4ac7-af54-1b229b18218a", "value": "T1EB430842B8818A15C5D412BAFE2E11CD33136768E3DFB2139D106F257BCA92F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792196, "uuid": "5281a567-9b88-48ea-887b-8f908d867f72", "value": "1536:whnvPzVJS6Ct2+ikW/udbuTKIQ3EktLGIPi1TasKWf:oTSx4+6Wd6hQETasKWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748792196, "uuid": "9c63f6c5-d7bb-46f3-a4a1-011d63ec5e08", "value": 60048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748792196, "uuid": "d1d5ef26-2fa8-4cd5-9846-aed11a2c6dac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792196, "uuid": "bfcafa87-d2b6-4436-b738-dddd8fcb89e3", "value": "hoho.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d29334c-3eb4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760375, "uuid": "e6741aec-7d46-4f2b-910f-1d6d767de2d4", "comment": "Malware payload (Mirai)", "value": "53a163e49ed0a8bfcc7eddb1f8a87fd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760375, "uuid": "cd9a442b-0ba7-4286-8275-903801c154af", "comment": "Malware payload (Mirai)", "value": "35d77afd0ad7a138fd2fa0b9a8500db5fc4d5c7d43854d30810cf6d903e8be21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760375, "uuid": "819be4dd-b8bb-43a9-8a88-b910950d37fc", "comment": "Malware payload (Mirai)", "value": "9e76ed419defdadd4a1fd386e7741f7797bbf763", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760375, "uuid": "03dbf756-15d3-4b33-ba89-1b4ca7abe2b2", "comment": "Malware payload (Mirai)", "value": "639db662b9a3cf5ea7501bd4266562a684918052869657a22d4c953f5071b4a69d1b524fde1c22f146a1a2ff6f16be71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760375, "uuid": "852d5d97-8277-4879-8cb5-23abad16a6fc", "value": "T11743750E6E219FBCFF6D823987B79E209644379626E1C148D26CED015EB030D745F7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760375, "uuid": "ca2f7773-13c7-4005-91ee-a3a6387fd7ab", "value": "1536:P1Pn5HYJShkBgg04fer9EXRNU+dpc5TFIYc1R:NndQShW2BERY5TFIYiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760375, "uuid": "049b8a2b-6a98-493b-b0de-8b67a76aeb51", "value": 59776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760375, "uuid": "a2b5ff98-e39a-4611-9168-c28eb3b7db3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760375, "uuid": "b54f7da2-e66c-4ab4-a5f4-5ae7052be996", "value": "owari.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f6137f-3ec2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DonutLoader)", "timestamp": 1748766671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766671, "uuid": "273a2022-9646-4639-8f5a-829a7e967bb9", "comment": "Malware payload (DonutLoader)", "value": "c0bd2b4b7777e7bb4e8fd46715a841fc", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766671, "uuid": "3059a80f-48a0-4a7c-801c-109f29834d52", "comment": "Malware payload (DonutLoader)", "value": "37ac7d014887892014e460561ea56ef2ae50961d0cf35cacacdca6f29097d704", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766671, "uuid": "4d3bc3f2-f9ef-45bb-9bfb-8c7ddb350813", "comment": "Malware payload (DonutLoader)", "value": "7293ad20be990e8da64ee1e3286ab78c15438a85", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766671, "uuid": "76a1a0ee-9660-4de9-9a2c-fd4a38c8c84a", "comment": "Malware payload (DonutLoader)", "value": "b5d665db73795d9b68a7dc783f5e30bcb93a053a128b7f740c6c9b94e26bbc699ce8da0f329d5f60126fd1d211afcbae", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766671, "uuid": "d2ba3231-b31a-447a-9f2e-906aad992844", "value": "T1BEC55A2B56A9619AE3E7C07CF51A5792FC3072480E35A77714B683923730A2C9B6D373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766671, "uuid": "cb674307-d967-40ea-9617-851dea6d438b", "value": "8af7b468c96a77b7e5c969ce4c6dc1a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766671, "uuid": "250c2983-f9fa-4539-990f-cbc81a51d1bb", "value": "49152:RNsU5CnqGpMAyjyP2M7FI3RApzh+knI0TW6oOoKPL2HTDvp/jbVxpnbB:TEIA2J0TWF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748766671, "uuid": "4205dd6e-1dd4-4e85-9277-1e099ea49ba5", "value": 2552832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748766671, "uuid": "7f1c0360-f35d-408b-9800-3aa439120272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766671, "uuid": "0593c862-c211-4e08-9d92-877c64b70da6", "value": "SecuriteInfo.com.Win64.MalwareX-gen.12020.5129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c892ac4-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759542, "uuid": "7b6b1d13-f858-47da-a317-3f8a00d98df8", "comment": "Malware payload (Mirai)", "value": "c44d4ae4dceb14fcc2809366e373ef59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759542, "uuid": "7977cf38-7b29-4898-97c7-ac037a65020e", "comment": "Malware payload (Mirai)", "value": "3884c694dffd7967192deed7d6c088d0d6eae965f46c1f1ec720f08e046a0b51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759542, "uuid": "08fa74c0-29a4-46d7-a441-15e0720d0362", "comment": "Malware payload (Mirai)", "value": "a21b2de4ef3795955f490b77740641d33493a1d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759542, "uuid": "d79c8559-7bd8-43a9-98ca-e15e8f64149d", "comment": "Malware payload (Mirai)", "value": "1c52e65367be64544b96594efe01eeff62e20584d0bcd3d4f7a610a7b1e27bafe16f1b39cdf92121d2b5539529b8930c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759542, "uuid": "1d2ca010-e401-48d3-9464-8fb5bfa667c7", "value": "T10B14A71E6E328F7DF6AC873447B78E25976923D627E1D685D1ECC2101E2024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759542, "uuid": "d8bb37ab-1acd-496a-81c7-e4c0596c8a75", "value": "3072:4qBM+MZH57jSxNp4b+gJshsWfE7EdsNQvDvntS/x3VN8FAVvz3YWHk:RM31jwN2b+gJshzMDW7vk3V4AVb3JE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759542, "uuid": "eb76ee9e-8bfc-40b0-8e27-e1200f83029e", "value": 202280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759542, "uuid": "c0d2c4cb-fd87-4440-8b09-2c86bb257d34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759542, "uuid": "d135d8c4-5d6e-4b0b-b404-80b35920e198", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccd9908-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748807189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807189, "uuid": "e358e8bc-1da7-4e7b-b0d5-313653103e51", "comment": "Malware payload (Mirai)", "value": "7b85d0e083d12f32f0950ed4f078dc2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807189, "uuid": "ff67c9e3-0973-48de-8e13-bf0918195b96", "comment": "Malware payload (Mirai)", "value": "38a4fd7b3f92799b8e1abefe2e89053569b61c2b2014c3e9209442483d1989e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807189, "uuid": "b6d1783e-8e73-4db6-b437-b911b4dc27b8", "comment": "Malware payload (Mirai)", "value": "bb54c28cbe2fb77cbed78291adb5b86332e566d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807189, "uuid": "f424fb1a-057b-4e85-a2cf-4d4b47743939", "comment": "Malware payload (Mirai)", "value": "95ce7e477ba8905c0ab23f3324bb2af1fe234b1c91fe7cd66c2a8b577d3deead7b500196f890cbb84205480d8ce21a9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807189, "uuid": "aaa9acd2-4142-48dd-927c-5b84c4460877", "value": "T1A6A2D029E349AEF4DFEF5D9492C1C3C277E543C66786C8E240FEAF012506046BB89D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807189, "uuid": "779ec057-6934-49d2-b53c-5318c6d3233c", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5vvM4uVcqgw05VxJZ:9RxsSVsMD6xiJJE5zRWN1E4uVcqgw09L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807189, "uuid": "61bcb3e3-fbde-49b4-a7cb-b3dd5d7cd3c8", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807189, "uuid": "2fde6ac5-27da-49ef-b04f-89c574308867", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807189, "uuid": "89b7d394-c690-471c-a236-2bd6a653fb3a", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c365f747-3efa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1748790718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790718, "uuid": "5b948f77-d771-46a5-b9b1-150b4c31d3ea", "comment": "Malware payload (ValleyRAT)", "value": "042feb84e90cbbb36af7b378f19a2cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790718, "uuid": "4287dcf6-c037-4ee8-be73-0ab0c677e517", "comment": "Malware payload (ValleyRAT)", "value": "38de66d6ba8e065a4d9f2ae37fb5bad2e494218e9b3c26f0f0743571b9716fd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790718, "uuid": "40de81c2-b6c0-4d02-9c1b-6219a7faf1f9", "comment": "Malware payload (ValleyRAT)", "value": "bbf994017a03cb161c41722f75506e89e0e85025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790718, "uuid": "b910f8ef-117d-4f6f-a0ae-8c90aff1d5ab", "comment": "Malware payload (ValleyRAT)", "value": "18e2c370023064f0382abf8e4c167550cf7a122680ba3571f5101a4ff3d414eae2f497bae4da311f977f71b772fb23d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790718, "uuid": "02718588-cabd-4446-bd7a-d0ad7a3ee91f", "value": "T127E7335B738BA7BBD0395B369569D38889FB3D205811BC13E6E07EA8DE7D0500D2DA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790718, "uuid": "356195f4-8e93-4230-bccc-041b217435a9", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790718, "uuid": "bc49596c-d0e0-41fd-a629-c9541247ee6a", "value": "786432:9Gyz+mUQlk9McTmIBqK3H7hxpOyo2oiebeLHt/zi2/s9jIfBQcRcbrvSevxwpqVm:cC5UL3EqH7hxRsbMt/z6cRYOEwENGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748790718, "uuid": "204db014-a74c-41b1-be5c-2ad7630a9433", "value": 65338814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748790718, "uuid": "4764b4c8-61d9-4f6b-8ebf-387528db9c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790718, "uuid": "bb10222a-0c8c-4ac4-a2dd-becbdbaaeab0", "value": "Aex_win10-11_SatrFery_8273.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b36c89c-3ed3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748773740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748773740, "uuid": "43fddf6d-2657-49f9-9aee-8ff2664aeff3", "comment": "Malware payload", "value": "0d50383145ea53f8391b83f8eed7f1a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748773740, "uuid": "f1c98396-34bb-4f5d-8b10-916cafdce573", "comment": "Malware payload", "value": "38efd3526423ebee2bd5aead2642d8a18927516b0bac7ec79743ec80d6a95d1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748773740, "uuid": "f1b6b936-4c00-45df-bc2c-6ffb04696b82", "comment": "Malware payload", "value": "098f0784b872ec0083ea0ad6b55bcb2d0d91fd61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748773740, "uuid": "8c070766-1798-40e4-90fc-7dc77fe45048", "comment": "Malware payload", "value": "947ce3db90f2e9cb71a15cc60442c6af84a99c7734091d79f0c4f63e24309e5ddebe86d5231b089d4caf05c8b22ef098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748773740, "uuid": "4f227bcd-2add-4e37-92e6-202d9c47dda4", "value": "T144C612A05299C45BF9564270FC6FF4F257207E70EAD0988F325DBD0B3739A509928B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748773740, "uuid": "8014d3ba-f006-4d6f-8caa-92aed23b7566", "value": "7c9b6373ece611a7ce9c9d709b32a31c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748773740, "uuid": "17be0580-7451-454a-9e35-22904062ffe9", "value": "196608:xHlk6FY0NuFehMgTctuuYPHOs79Jbp0xtJ62LtAAnAcErVs5uopx+mO0:xH26FBNUycM7REJ62JnarV0lx+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748773740, "uuid": "82adbce1-d2a4-481c-9bfe-b2ebcdea0209", "value": 11917312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748773740, "uuid": "eeb5bdea-5532-43b2-92fd-6736421d7fce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748773740, "uuid": "c1c32134-f9fe-4651-96c1-4c7111cf8c63", "value": "8099_4350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bd98da-3ed6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1748775021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748775021, "uuid": "b1a1afee-fbe6-4a5c-ba7f-f489240bb9b6", "comment": "Malware payload (DCRat)", "value": "a44e8f285106d2733cca1679c105c8b0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748775021, "uuid": "6a7ac98e-ec45-4633-8ca9-cbf3ccd9209a", "comment": "Malware payload (DCRat)", "value": "39c734ab91b8067c2458a620ce002b8bbe6f0e18176a7d98d022883ec73e67ec", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748775021, "uuid": "01774b38-4a77-48a5-9b19-c5c3915125e5", "comment": "Malware payload (DCRat)", "value": "0009eda663291d4c7f219e8e3cc1ec36ea31b5fc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748775021, "uuid": "002b6961-df47-46ba-95a9-a964011ffc3c", "comment": "Malware payload (DCRat)", "value": "722eb946715a8c50377ef5b9e766e6f5ee6d8896fa26c5c1e6d4ccd8cce06a059952cf2517f1406d6db2161057099674", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748775021, "uuid": "b066e90b-c76c-4dac-9a60-09afe9fbfa56", "value": "T177F5E0017E44CE11F0195233C2EF495887B499426AA6E71FBDBB77AE65123A33C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748775021, "uuid": "05f8e300-b32b-4eb7-89dc-4eb2be5b0edb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748775021, "uuid": "182cd0ec-f2cc-4b30-81e0-eb2133d4e12b", "value": "49152:CV1NMwRNQj6w2FR9M3rH+0NpfocBgo0vdZ1WIIs/7iu5Cb2y2vwH/WQm:CLNMw33e5AoiZtIu0HOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748775021, "uuid": "691db648-6f0e-4fce-9443-e9451d595cfe", "value": 3483648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748775021, "uuid": "86cf733b-00c1-4792-b031-d30c7a3d618d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748775021, "uuid": "b10b7921-3aca-45e1-8ff5-85f47ae5a9d5", "value": "a44e8f285106d2733cca1679c105c8b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99167965-3ee5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748781628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781628, "uuid": "6e5118da-5df8-49ba-b5e7-e8f2781cb74a", "comment": "Malware payload", "value": "14c5b5a306dc94c2095ae073728d7b87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781628, "uuid": "8e3b92f1-4d54-464c-8515-1a93525b2c54", "comment": "Malware payload", "value": "3a668ad5af37e434f9e942ab93e9adb6e23aa28d50b49a323eee2753fe49ef44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781628, "uuid": "93c99caf-446a-46fd-9dd6-1e722db9fe8d", "comment": "Malware payload", "value": "234cca9b49f4fec205796db2b75fc5c8719631e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781628, "uuid": "ee373d9d-1288-4aae-9640-f02755f917fe", "comment": "Malware payload", "value": "877372608bf579d0aa8504e5418de4f5d0062ffb9a30c877a15cf4d722eb4f2775e1a38e52d40b9db56c5563f4400751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781628, "uuid": "2962a972-5368-4460-9835-162e6643629d", "value": "T1B895CF23F2CBE03EE05E0B3705B2A15494FBAA256523AD5786ECB49CCF751601E3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781628, "uuid": "7d96f624-cf50-4399-88e4-544e7439a0d4", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781628, "uuid": "0ab2385d-cb27-48ec-8611-e333be2eef28", "value": "24576:waE+hTNrCHtLfTfuM7Djr5QpYrao2rupZdH1NNf+jwH5JaFMWHIta3+8Fk86Y1oQ:0+MRvH5yk4Ju+ekQoEcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781628, "uuid": "71b6ffd8-4c75-4bfd-a43e-050515a7f83d", "value": 1914623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781628, "uuid": "8597c328-aa38-4f5e-8846-2711f1ec1063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781628, "uuid": "498420d6-fa7a-4d8d-8728-ecc1f749d8a0", "value": "IDM Crack 642 Build 3 With Serial Key Free Download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5d1430-3eb7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748761882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761882, "uuid": "6e2c4f81-cb4b-4663-910f-17b9228bdb4d", "comment": "Malware payload (Prometei)", "value": "c51a8cd7b5fd6719e5e53669a8fe379d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761882, "uuid": "ee5fbbcb-4e4b-4737-83f7-c5025932757e", "comment": "Malware payload (Prometei)", "value": "3bcb4b0cdbf23d5f5be5b0f6211e9e6030aa7a4ebd4d6c634857f3f7b87567c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761882, "uuid": "a4fde527-6272-4e30-8068-09be9a1fceb3", "comment": "Malware payload (Prometei)", "value": "fa799a7a93f53a3d8560eff25b2630f6c6e27a96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761882, "uuid": "bd3dcd98-84f3-4be7-a33a-d6e3e6de8c0d", "comment": "Malware payload (Prometei)", "value": "83e444f636f9344feca6dabe4d065b70cc6bf6e37d657b5cba17f4338b27b5916667261e7e97378c1e7ca3e27231e259", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761882, "uuid": "d905f700-f459-4cfe-a4e3-f050712924d6", "value": "T12C9423F8C87D2E30D8169F3CBB1A8268F0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761882, "uuid": "3bb593f2-73f5-42e8-8ea1-12a4eb0db3b6", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgb:25WOSACZSV6eKRH5EPiamb4DsDwwcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748761882, "uuid": "66a6aeeb-b4ca-4d85-b896-2d71c3272616", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748761882, "uuid": "77e8120f-c107-4e78-8f51-43e3efbd1b88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761882, "uuid": "2b6d894b-50b1-403a-8fa0-a02062bd1276", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba043aa-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786518, "uuid": "3d79531a-6354-47c5-9c6f-1537cd84a1a4", "comment": "Malware payload (Mirai)", "value": "3bd426e7cbe3eb5b231dad101a9db62e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786518, "uuid": "406de236-a978-4b5d-86bc-7b559d20880b", "comment": "Malware payload (Mirai)", "value": "3bd62947040e7f0ffd9d360630c08204f0d8db7b816f35f4858521e7edf5eb30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786518, "uuid": "b4092c0f-7ef5-4ac5-bab4-d122e7569781", "comment": "Malware payload (Mirai)", "value": "665fc7d47e195203bd79028e94924d9ed46c9ae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786518, "uuid": "9a8400af-8663-4c08-a084-f919e9c4a08a", "comment": "Malware payload (Mirai)", "value": "c419dbacc3a35743c5f005d8324b1d0909123bc182352f11cfc640299f3c55ac4789b312d5aaeb65105e551e384a9eda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786518, "uuid": "a7d223cc-bc65-41fb-b00d-ede70ed1564a", "value": "T165F2F274896148D1DF99DBB00CA3CEECC7C326E2BA79EB55614462E73B0147365A9FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786518, "uuid": "0dfa4621-a275-423d-9dd7-88857458d7b1", "value": "768:Y35LXQin3B853kz5/L9ir6AMvkO/QmyUONaxm4uVcqgw09v:Ypgin3O530/bAIV/QmyUOYU4u+qgw09v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786518, "uuid": "540d3909-3e73-4f89-bb2c-67d11c9f6858", "value": 35284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786518, "uuid": "aa738cda-0ed4-4859-adf6-39576197a146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786518, "uuid": "4d07687a-b25f-40d9-bef3-17a421b50f8a", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5d0db8-3e8b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1748743137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748743137, "uuid": "32040081-2121-4f48-9bc5-38bf115192bc", "comment": "Malware payload (XWorm)", "value": "b777cfa3f6c7d8ad118caf620908a60d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748743137, "uuid": "e048c912-c194-4d9f-bbb4-ce4882e6db08", "comment": "Malware payload (XWorm)", "value": "3c8ec4a8a8c3b1fbabc577576da5b70f5ddf3460b68775f3fbfa4fc07b6a7fa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748743137, "uuid": "08538420-b3d1-4dd6-8d8c-e1cfbc929526", "comment": "Malware payload (XWorm)", "value": "46a0af09d1901ceaca3ccde27499ee1b91cdf0e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748743137, "uuid": "dae0cd63-37cc-441c-916b-48e18fb2e606", "comment": "Malware payload (XWorm)", "value": "476f8745a43c051dc2720cdbf665efccea1767b4baadbe98298fc85c5fe7f91d0b6499b844d031231a0f625fd0772637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748743137, "uuid": "905d460e-bfae-4728-9aaa-f068f5d7f5c8", "value": "T18CC6225663A042A7E4254B3844CB4332F731EA28BE07E3CB4750AB655CFBB867F256C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748743137, "uuid": "98635074-990e-47a5-9445-d9fc71a15dcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748743137, "uuid": "21b1666f-f893-4a27-b263-15f773063a16", "value": "196608:54F1KIlUrJyTOZzEwLVa1XwETq4FHsm1hmKXdFL5d3IH:yF4LyTOZ3LVgXwCDFHsm1hm8dJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748743137, "uuid": "d578a7ce-93a2-458e-babf-e695443bdc9a", "value": 12387840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748743137, "uuid": "c62c00fb-c230-46b2-a1e7-a3809b84f011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748743137, "uuid": "0a44c07e-46ac-4e79-9775-15ea89041a15", "value": "3c8ec4a8a8c3b1fbabc577576da5b70f5ddf3460b68775f3fbfa4fc07b6a7fa4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb9cc96-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748799700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799700, "uuid": "db79ea92-84a1-47ae-bfcf-63f7c5a1d899", "comment": "Malware payload", "value": "bc0d4b2844de0e9327bab2891ff32cf6", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799700, "uuid": "1916435d-ab67-4603-83ce-654f91643175", "comment": "Malware payload", "value": "3d3a6d7905ca1387f3ec7a637cb672d6b6efa0f8efdbf819f756a8e5f92bc960", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799700, "uuid": "b4dedeec-e9a0-42a6-929b-40f71ffb24c1", "comment": "Malware payload", "value": "a375e27ec85dd7b04ce44d4c02a0e5e162e484f0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799700, "uuid": "25a312f5-db59-4352-a6ae-ec22f62ac636", "comment": "Malware payload", "value": "01664f72e0ca7366ac7dfeda6ce089b1a0ca8bb2f6fec0965e6b49c956221a1db2733727742ac80591bde6b796ad494a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799700, "uuid": "da96ef5f-252f-4d57-b946-3bb79bab9b52", "value": "T10631E1117BF95B34F3F68E3518B6B7368A7BF846E5A28E2D4054474C0861E01DD25F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799700, "uuid": "0de5fd7a-ae78-4b28-bcbf-b301191e53a0", "value": "24:8gJVmInC5axH3E8QUA0vm2P+/cdv7cZyoarP0Ip/YqVKukZMwuTcmf:8AmICaxXXKk1dQsnrMG/BcQcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799700, "uuid": "1f7b4f2a-ff43-4eba-b16a-5b57a455822a", "value": 1561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799700, "uuid": "68a011c3-a44c-4d77-8af2-b5438012a4da", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799700, "uuid": "31560a39-17f6-410d-b256-643df2bde4fd", "value": "RE_05JKS25A.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0049cbf2-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786526, "uuid": "7310e95a-df88-4c0b-ac05-c6ffe82bf9dc", "comment": "Malware payload (Mirai)", "value": "dbbea5181ace39d5582bd13395cd6f06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786526, "uuid": "90dcac99-eabc-4474-a4d6-f287cab76a45", "comment": "Malware payload (Mirai)", "value": "3d7e909852928effa769bb808c9a7549f313c30e575f7359153507a999e32df6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786526, "uuid": "f23b8671-07a2-4529-8630-672d89c731d3", "comment": "Malware payload (Mirai)", "value": "0ee462d80c10c5b3f977e591b066c52272278f23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786526, "uuid": "300705eb-7984-478f-ba6a-4dcba84a7f77", "comment": "Malware payload (Mirai)", "value": "7e2cca0c54b44d421de0f663864190c146933aaf11fde4eb72e63140a7a24f07f866d9486df9f65313015644db147ecd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786526, "uuid": "45bf2558-8a73-4c20-873f-9c73390cdd5e", "value": "T117E2F166F38F509BC218813F9363C647F6928E183BA9C581761648E17C8F2F45C66EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786526, "uuid": "4ff7a7ed-c2e4-44d4-a7d1-f03cb5229750", "value": "384:MAly45MXECa5ZlQb6LbQXuR4NhZj0af/5RbySXCPROK7cr4+KGgZW6qjD/Z7WWNd:L75ZlQe4CyhPvbyICP/7cJBgZWLjLtt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786526, "uuid": "004ed8c6-a8e7-49a6-9a8a-df34f03f8b9a", "value": 34212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786526, "uuid": "666a4227-5166-4ea4-9938-ddf4ac74808e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786526, "uuid": "3ce3f4b4-58d0-455f-8a45-563ac6e264eb", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2235f8-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806898, "uuid": "eff0e1c1-f092-4b04-b16e-2dbeab5fd980", "comment": "Malware payload (Mirai)", "value": "d4a237f2901ebf8b6c4d97f54b85cdf1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806898, "uuid": "af7bc346-f9fe-48df-87a7-cf6aac4c7786", "comment": "Malware payload (Mirai)", "value": "3ddfdde13f4abf94fa26bac5976d1e5e41d94bbd22165d18686a8394dd135166", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806898, "uuid": "a0228301-6612-4c02-8c8b-6bf41e4ab545", "comment": "Malware payload (Mirai)", "value": "aae6c232a6be7599cd084b42148c02ea6db383b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806898, "uuid": "1af40f3a-833f-4fe6-a1ec-8783b1c138b5", "comment": "Malware payload (Mirai)", "value": "fadc19bd76d35d092b03d2cd031691c238013e482f480f8621b35f705aa31b3327afc4456c753176c6b9765610c7af40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806898, "uuid": "07b38e2e-51db-47d1-a0e3-77b7a539f913", "value": "T112230781BC819A2BC2D01379F5BE998E336173E8D2CB7227CD614B107AC552F1C6AF95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806898, "uuid": "30f211d7-fc69-4c10-ab3f-f2788c922559", "value": "768:2tQfAY5Jmi+siyDVmwyIzyc42G5UZQq8pJWgYf/3+bYVMSTKNS06gDAvUGFG7aJK:2Kmie/Iza2G5gUJWgYvRUcW9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806898, "uuid": "0b4902cc-6f37-489b-a6b1-43e3b2fa873e", "value": 46920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806898, "uuid": "8177fc4b-3d52-4603-b2fa-177d43e4e17d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806898, "uuid": "b429082d-0b8e-4064-95ce-47ba572aed52", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15186e71-3f0e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748799016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799016, "uuid": "e8d84640-3782-4da1-a819-6e90970f2633", "comment": "Malware payload (LummaStealer)", "value": "4fc3b1a507ee569e3cadba081cf7bd20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799016, "uuid": "c4010a7d-09e2-4be8-a823-8e6ffc61be8f", "comment": "Malware payload (LummaStealer)", "value": "3e98da9b60931c00f9ca7892d6ce0e187448a86e4fe1266f156a5a9bf5d258cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799016, "uuid": "6fecf003-321f-43c2-bcdb-f12ebc4407ca", "comment": "Malware payload (LummaStealer)", "value": "573f58b9f245001796596128df69b13de3cb25c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799016, "uuid": "f78d10a6-9e59-4519-9a26-9f553a450b30", "comment": "Malware payload (LummaStealer)", "value": "5d5068088cf3e78ae23e77697d232c4d8583ab0c673dd829a2b9a7ef3c88b3615ac79ea38928885e542ed5760b15f507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799016, "uuid": "b0383165-8aa8-4b0f-b8b2-118c62905da9", "value": "T1518533AD8C10FCC5EA5A8B39E6F1142C81F5548E825E6821F7727B7814C94F2EBB7613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799016, "uuid": "bfb42d58-0cca-494f-88c3-2940302f1a77", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799016, "uuid": "ccccdbaf-70d9-4066-9e3d-416717d9bbe0", "value": "49152:n/6uecMCM95KeFo3PIO5W9bkOdd3yvGpkVlcngr/Mk:/bVMmeFPoyd3Nkfc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799016, "uuid": "7b418cb5-aa63-4c68-8b07-8d88da9cf494", "value": 1864192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799016, "uuid": "e1ef2f35-ca39-480d-9d18-7e8373217547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799016, "uuid": "32bd221a-0dd6-4191-ae25-01b77d7a6d1e", "value": "4fc3b1a507ee569e3cadba081cf7bd20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad39eaf-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748765203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765203, "uuid": "f972c71f-6043-4024-9c92-96733e9e7da8", "comment": "Malware payload (Gafgyt)", "value": "42362d3fad448128c3a1288c7174d2b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765203, "uuid": "083fbd27-6ad9-4024-b4d8-51ca24d8c4ff", "comment": "Malware payload (Gafgyt)", "value": "3eb12e7ac74e2da94465b2c2da36c67cc7c7c98fd3921cef71411136ad07e973", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765203, "uuid": "2b51011e-c056-473d-9102-91ac84164549", "comment": "Malware payload (Gafgyt)", "value": "de867fecc97dd3be10ab05abe771573099dfc15b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765203, "uuid": "c0829d2d-e38a-4f84-b3f6-f373489432c6", "comment": "Malware payload (Gafgyt)", "value": "40c79f16a4b36287742a2977c7c890255150221d68d6d0a67205060ff51a127f56b334a8b2190cfd660c342af6dc40c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765203, "uuid": "0b567c98-625f-4aab-bc47-71702a794588", "value": "T10AA30896F800DFB7F40AA67604D34B20B670BBE54F532622731739A6AE762D52823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765203, "uuid": "0c7ac565-3d8e-492b-9ae0-8c4d1f8b6745", "value": "3072:/Ir2vIBAxMyAOLRcftQ2OemuxVqDr78fz1e:/Ir2vIRyAYcC2OemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765203, "uuid": "577c422f-32c9-4dbb-9f3a-59ce596d22b0", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765203, "uuid": "9ff75fdc-a48c-4a8b-ac11-3d99dde13ea0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765203, "uuid": "bf2ca8ef-d075-45de-ac42-4b13064662c1", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c45692f-3eea-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748783781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748783781, "uuid": "2cd33f16-8eb5-4a02-aca9-1682559e96c8", "comment": "Malware payload (Mirai)", "value": "8016489c89fe6797e92d94fcfe88a330", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748783781, "uuid": "37cbb6ad-b5ad-44f1-b58b-c7fb97c8da5f", "comment": "Malware payload (Mirai)", "value": "3edc2b21ce949e5bf8596481d8ed88c401345af88804e1a4a826ae86bde4c141", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748783781, "uuid": "a826417a-5d47-4936-bf51-8e8edb771451", "comment": "Malware payload (Mirai)", "value": "ce5d9954b1de70f5a43e9d94c61ee49d02aefb0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748783781, "uuid": "a98a9722-9598-4e84-8220-184c3a033279", "comment": "Malware payload (Mirai)", "value": "fee22bebe20722b6166a7c88f0df591237f362a93a459d89040b9f1b5b5f88a244aac8c678f2a689163292a921e2b4fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748783781, "uuid": "9ca1106d-7b7f-4238-b0ec-b636a0b6c025", "value": "T1D9F30A56F8814F16C5D512BAFE1D028E37231BB8E3DE72129D246F20778A96F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748783781, "uuid": "39dd255c-ed71-43f3-9fa2-abf022fdba78", "value": "3072:o4yDrIp2otUqrUyjXJS560VTjahc3HIExzucVdnL2L:FyDr5otB1jXQw0V/aUoFcVdnL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748783781, "uuid": "d85de0f2-d8ac-4393-8137-32a1d5700b79", "value": 160124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748783781, "uuid": "9ed57945-5943-4522-a37a-48a7a1fbb110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748783781, "uuid": "05e41a75-b036-4ac9-97cd-a84a2b881bf6", "value": "navo.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09768088-3f0e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748798996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798996, "uuid": "542080c9-cff7-43be-a32b-d886c1c314b9", "comment": "Malware payload", "value": "186facaf4b30ffda142b56625fd8d887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798996, "uuid": "38008d3c-ac77-4d50-835e-c2c8c8161543", "comment": "Malware payload", "value": "3f28194ce38cddb4324cb92cb90524cb2042afb58233bbb2d6540aa8c1746fcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798996, "uuid": "89c3ea64-d2cd-42c4-95df-a657b3199cec", "comment": "Malware payload", "value": "42879a83b70af34c21e4596175c5718a11bed2ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798996, "uuid": "9e122e9b-5ee3-43ce-9671-1658f6984a58", "comment": "Malware payload", "value": "4ba18bb7d59a9c8a5f0deefc896560bb6103fce0015b771502f9533edb974a8006f72f9d5bc1b954f80450d701c6ccb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798996, "uuid": "899b6eb9-2b1d-4bfb-a8f6-77a0c6a5bffb", "value": "T1EA26333FDF221A23DE5486F9A4824613C681870D68ECDCE7AE2C07757DC257B81A27E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798996, "uuid": "06546dc6-c4be-43cb-90d1-bbd8eb2f5286", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798996, "uuid": "90bf6360-a27e-4973-bed9-cdd58d5ffce7", "value": "98304:ajTX9kzWKXQR435UVqJElTV6ceAYMuMZ9uGuqzZSpX:sXaXX0oiTcc0MnZ9u9eOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798996, "uuid": "4d0bbe63-4031-4bf1-9711-313e67356b53", "value": 4817408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798996, "uuid": "e3516c39-7771-4df7-91a0-c8f3146fb755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798996, "uuid": "54db5ec2-47b9-4e2b-9645-5fa3e07655a8", "value": "186facaf4b30ffda142b56625fd8d887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e2713d-3ebb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748763575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763575, "uuid": "90052b50-3ed3-41ca-a2c0-efba2dba5608", "comment": "Malware payload (LummaStealer)", "value": "502cb01007ae9c562bb5768a0d8a580d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763575, "uuid": "7c05745e-764f-4f37-811b-302221262893", "comment": "Malware payload (LummaStealer)", "value": "3f3a8337aa451a4a2c57b9c68ded1345dfa21566dfb2007f8f01f48b00538877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763575, "uuid": "fe82069d-5314-424b-b9a8-33e21cfe253d", "comment": "Malware payload (LummaStealer)", "value": "eb838b94971d50bdea44d70f2b1c916c66c85297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763575, "uuid": "d4edb9cc-9aa6-4c57-a086-0378704f8bed", "comment": "Malware payload (LummaStealer)", "value": "1c1161af298c1e6a0bcc7f718a4af3788dfcf138cecfb6107a41cee290a9996f677df4f28b80002edc75f507d16f40f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763575, "uuid": "a1345bf3-bbb3-4da7-84f9-36fd24c377e5", "value": "T16D281255E7A5443EC325B11B319A72EBC7365DE332661BA945BABC03380F00F4B666B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763575, "uuid": "45cb2511-5d41-4e0f-8b77-45cea802df49", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763575, "uuid": "41cc5d02-e0ba-40ca-b4ed-8968575645b6", "value": "24576:E0aeThJGomZYNaDi0PIzOGOJkkjFN6auItywihPHq4d0qKnoH:EHz+aDVOOJOkhcaXYRQto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748763575, "uuid": "2158cbd3-5e8c-490f-a9e9-e11a8cb8127a", "value": 94382203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748763575, "uuid": "c286a7d2-55a4-48a8-a1f0-65d7c011c73d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763575, "uuid": "4754dab1-b5f3-4101-8e0b-cc7fbbb46c08", "value": "mal3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca8711e-3eb3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760079, "uuid": "dbb64f65-fa8e-4a97-924e-3668795c0872", "comment": "Malware payload (Mirai)", "value": "e3885926b2cc9ca743df92cbcd8f30bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760079, "uuid": "6a23cf83-170e-4e42-9d03-190d87dd9f4b", "comment": "Malware payload (Mirai)", "value": "401bbdd86ee0fe6a3300d9f6aea3b5a5ea992978591731f4b4ecc8204751030e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760079, "uuid": "0910b010-8f16-49db-845e-caf5c21ce144", "comment": "Malware payload (Mirai)", "value": "ce661cf3408abfafefa4df99edcf0ce40b546d80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760079, "uuid": "7bb1cd76-35d8-4b57-b418-0337964e5fbf", "comment": "Malware payload (Mirai)", "value": "08b2f7d0bb4d14de3af2e70e941b612952c0f8bbcfa5cbc6b783b8a8478f03f5a39d30538893cf9b8be4d51553fda956", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760079, "uuid": "f71cf5f8-9d33-4dd9-a0c5-423d1d0a9d11", "value": "T14CF2F1EBEAF25381E9CE807D787E778D60819E498064D170F9D89A775A17B72033A1C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760079, "uuid": "b83cd7a0-0b2a-4bf4-bde7-7d5d5fe9c371", "value": "768:DvPLCcnx2wPO3HeMa0anVPEuIz5AvsDVIyenbcuyD7UHQRj6hh:DzCbEOXeMa0aJEu+AvEaBnouy8HyAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760079, "uuid": "2474e89c-7528-423a-8ff2-15b36782f436", "value": 34712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760079, "uuid": "a166f414-cf80-425c-9853-97225c507324", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760079, "uuid": "074f7070-d419-48b0-8841-58a8477cc945", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d633853f-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Phorpiex)", "timestamp": 1748798910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798910, "uuid": "282f8eb8-782c-4154-a823-35b0a6b3171c", "comment": "Malware payload (Phorpiex)", "value": "68106404805d643aeae3b8fc173b83d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798910, "uuid": "6ab42cc9-e920-4402-a4d1-5e6b96fbd91e", "comment": "Malware payload (Phorpiex)", "value": "4048fbaea0275f72ded36b88d7dd15e1dc173089d3d0c12e5b1f5a0b8e9a5de4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798910, "uuid": "5caae689-2bdc-4eb0-b650-e66cb2dcface", "comment": "Malware payload (Phorpiex)", "value": "51f359e51cffadeba7e2669c35f817c52fce6777", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798910, "uuid": "e17c4afa-ab59-417d-86ad-b78431595741", "comment": "Malware payload (Phorpiex)", "value": "d67113161cad58eb5a696848024bec6cbecad1c948aeaeff21d86496ec65cd46dfa482dd011967caecebd1272ed8a455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798910, "uuid": "ac030ad4-8f5b-4e4d-a417-5f380abb83b5", "value": "T1F0733910F6D08136F0F740FBD2FB566A682CAFB4230654E763D469AFAB209C5B931467", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798910, "uuid": "48b852a0-4e3c-45d2-a075-ddd8350c74e1", "value": "20ff7a11513e88d0f5188b2ee188ef8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798910, "uuid": "7e5ed3ee-4622-4ff3-a877-278d303317cc", "value": "1536:MJDGp6NFmav82ld1VEZh4GNI4HXc5oLMRlmY49:8o7O9d1VpGNI+GoLC8Y49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798910, "uuid": "8e4fda3b-997d-453b-845e-1377c359c719", "value": 76289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798910, "uuid": "f2e9c290-055d-41d9-9952-db1054c54ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798910, "uuid": "08e1c1da-f6a7-4981-87a4-cddd580a2ffe", "value": "68106404805d643aeae3b8fc173b83d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82556a5-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786512, "uuid": "09819ee2-1ff2-415a-a5c8-e4f56ff77d4d", "comment": "Malware payload (Mirai)", "value": "f396caeb910813349da4480f53c200d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786512, "uuid": "08870610-c68b-4383-833d-12163630b5e1", "comment": "Malware payload (Mirai)", "value": "413aeb285c54a4c63056390f99d8b97400b4a5e8902eea2d87d18b3bb326a16d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786512, "uuid": "27a71e0c-f879-4aca-800c-e03bc20b32f6", "comment": "Malware payload (Mirai)", "value": "5b6d10dbd6280e0c4923fb7718c72d705b43779f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786512, "uuid": "7a3a0b8f-d4fd-425b-a9b9-336d70807558", "comment": "Malware payload (Mirai)", "value": "691af74aa806d995c665975340cbd2f4a2616e568e5db0ba27de115dc076d4f8955e7c61ce87ccea7dc93fbe412f5cd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786512, "uuid": "e7d290cc-84ea-4edc-b7f2-6c09cd792a89", "value": "T148835B22BA750D2BC4D0A87A21F70725F2F6478A25ACCA1B7DB10D8EBF6164036477F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786512, "uuid": "322877a0-a96c-4573-a214-6c1b4e66048d", "value": "1536:SAYESwhOQTJuX4YjajNBxaWiPWesQPteaMNM55Cp0FwUyItbQWJ:/YsPA+aNPrEvN85CpMxTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786512, "uuid": "397c9b65-eb75-45ec-8d05-9cafecc3cbc0", "value": 81056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786512, "uuid": "a2721f55-3597-47b2-a050-87bc009ad157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786512, "uuid": "e0c83654-63c5-4306-a91f-91e0872a1d19", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546c14aa-3ee4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748781083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781083, "uuid": "f14580f0-6261-4cc5-bd5a-c1a67e1dfa9b", "comment": "Malware payload", "value": "4a8c31487b3b3de6fd074d5980b601c6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781083, "uuid": "2e0dc220-a9c4-4137-88ae-1ce0fe55331d", "comment": "Malware payload", "value": "41e18e164eaef3fb9f22770bbaad0779bb98e9c6a524a9c5e67cb794e1829671", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781083, "uuid": "f1d0f268-2010-4350-93cb-e10a8e39bd0e", "comment": "Malware payload", "value": "50cea57623f6b00bd986100663c191868ee1fa5e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781083, "uuid": "5f9b29dd-3f14-4a50-932f-2ccfbd68cb40", "comment": "Malware payload", "value": "af9fd6344f2a40f4fbc9662d466023af6bfc94bab1d9bb0e1809490adf67807cdd92afe360eb8996d04025982bf64c1a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781083, "uuid": "1c1d46c4-e198-4254-850b-a9651d54c8e6", "value": "T17DE08CEA30219907406C4C29A3D3C1009111D1B96CC6AF69FE89623CAE487C07031A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781083, "uuid": "185bbf87-b0e2-4e3f-80dd-97f654e93869", "value": "6:hoewj5SexAjWVTbK9AeKXz1SWVTZ/F8h9AehCYSKjWVTzWa+AeLKG:m5bxAjSTbK9AVXhSSTz8h9AACY/jSTz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781083, "uuid": "e53cb3e2-1c92-4898-b073-9ab8db9788c5", "value": 343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781083, "uuid": "b98d04a2-1de2-4c67-a870-0f9ca5e81556", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781083, "uuid": "77af7e97-b4a2-48db-a5dd-d098220e5e6f", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d3a860-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748799745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799745, "uuid": "b27f7a12-cf90-46fc-8346-930367fc98b5", "comment": "Malware payload", "value": "a1b148ff1ac67d8a32c6ace17bdd9d3c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799745, "uuid": "7c319b08-b820-4c1a-8919-b3ed57044219", "comment": "Malware payload", "value": "439c8f7b8b02728d1031dd9d0bc8d6c60409de2650371d42e4e0d22553a7f1d4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799745, "uuid": "634489fe-63b8-4992-9d85-0642d2d313e0", "comment": "Malware payload", "value": "70988ef424441f1fd805352018c1d59bccfed0a0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799745, "uuid": "0e09bc2e-d896-40be-9647-3933bee764a2", "comment": "Malware payload", "value": "c13503a0f494eebd09e1516d366c80b3d556d837cc0bc52ce9bad964723d87694dbaeb934e9ed7ea84c9005c12d953a1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799745, "uuid": "2806607d-7f50-4c49-89a9-2e89fa5dc3b0", "value": "T1DA5178201EF202A9F27387B557F973B38876FA92DD2986BC114153444621210E4A7F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799745, "uuid": "af1e8823-e287-47dc-8f54-3993feb98ca5", "value": "48:8y5amTNXk79of3L2Lb8hpLaMbLYmvfdJ9AabBk:8y5fTm7qOWL7jq2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799745, "uuid": "5e5056e5-46a7-4474-9db5-405bb0ad03db", "value": 2468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799745, "uuid": "c8515d6a-eb7b-406a-af87-44c8a34caa54", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799745, "uuid": "68eeead1-3d41-4fb9-a3f3-17b72d5c2f13", "value": "UItraViewer.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d0838f-3ef9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748790105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790105, "uuid": "9c9ee056-0ed1-4ef1-a69a-99a8114589e4", "comment": "Malware payload (LummaStealer)", "value": "fb968dac5d14257ed11be4903fa8c484", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790105, "uuid": "520d4004-de6b-46f3-9c9c-f0a10f8b83c1", "comment": "Malware payload (LummaStealer)", "value": "43c962dde0e3943280cca5e1d9c2b838e4aa59564a95d47b72d9c5b4da6e0015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790105, "uuid": "c0eb03e0-69b7-4486-bdda-3b644cc3b191", "comment": "Malware payload (LummaStealer)", "value": "e4a7b6268879b2b0357d7aab34a3f03bbc751d28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790105, "uuid": "9a0fe438-14b2-4d08-8270-25678508b0ae", "comment": "Malware payload (LummaStealer)", "value": "00d81c624b73424d9366feea1a3cba0d13d957279ea486c8e13f50982a415ea970cafe89b44ee6627e026803bb077307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790105, "uuid": "c23fabeb-19f9-433a-a564-67395465a3eb", "value": "T187670101FE8B94F5EA031930016BB2AF67365D098F34CBD7FB547A6AE8776911C36206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790105, "uuid": "6a575085-de9e-4b9d-a801-0528bc1b02eb", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790105, "uuid": "3f46f606-936e-43da-ae83-45c5fd9f32be", "value": "393216:jz+QWdllTXntg/12wcvfRC9Ed6DEQ2CcwGZ0hNA+LbGSW2XK7u10jXYcfaVafV86:jGdlEQwcvphrCUibLbGfdKELaVa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748790105, "uuid": "5abf0a2c-e948-4eb3-8ee2-7e8302eadd69", "value": 30771200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748790105, "uuid": "d15283e3-c6d0-425d-a5df-8131103e2542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790105, "uuid": "0af57fc9-32f9-47d1-a5f3-cadd4e923278", "value": "24087zx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045b21ab-3ee5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748781378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781378, "uuid": "e1a28662-1708-493d-918b-2a2e4a9bd813", "comment": "Malware payload (Mirai)", "value": "071f735cb961e7a61864580a0d9eb3fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781378, "uuid": "2311ca95-881f-4638-87a4-1924f6d37525", "comment": "Malware payload (Mirai)", "value": "4448d21d1e90ae69990783a43102e3163baf7cb56b92ce31512fc11525b2bf8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781378, "uuid": "df787652-d458-48d0-985b-518566822d7e", "comment": "Malware payload (Mirai)", "value": "fe35540c3ac45e17dd158096c448becc1aad7f65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781378, "uuid": "e04d99e8-69fb-40e9-b953-4fe667554a00", "comment": "Malware payload (Mirai)", "value": "8921960a8bc02d68eacab0bd0e16ff1c1907041ec95f43525bdb14d3179ad1b9da8dd100fe3f9f28d0a5385fb7e2957e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781378, "uuid": "3630b5c3-f346-4657-92ce-c4766ab778cb", "value": "T186D36A32D82AAF58C555D0B4F0219F792B93A59282831FBF1AA7C2754087DDDF904BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781378, "uuid": "f5fc0c14-87f6-4674-b6b0-07898553f7f1", "value": "1536:R1c/f2l4ZPZU0GiYY/uCMKSK4XUEhLlVCBGDWav392RRLbd:Re32lyfGbOutKV4NlVhDWe39GLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781378, "uuid": "5da04745-fb7a-4108-aeba-9771ee17bb34", "value": 134016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781378, "uuid": "4ff6356c-c742-4d69-bd37-e2a28e378eb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781378, "uuid": "534ca2cc-5129-4ca4-8420-e722f366d124", "value": "navo.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b741cabe-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759774, "uuid": "35dfa025-11fa-400d-9a56-bb767c5b7777", "comment": "Malware payload (Mirai)", "value": "da2b9be47990f71eefa36759a2abfe02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759774, "uuid": "38466c80-620d-4d16-83c2-57394f90545f", "comment": "Malware payload (Mirai)", "value": "44e55d9d4237041511e0c7efd30deff2f4033cc26d6fd4c9a571ff765a7ebcb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759774, "uuid": "44df814c-9877-4701-a83f-684c2e6f43b4", "comment": "Malware payload (Mirai)", "value": "9f536ea0b7e037d6ce38bc56253f78d7ce58b76a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759774, "uuid": "00f5dee4-b1da-4408-a56f-ee1cb759c063", "comment": "Malware payload (Mirai)", "value": "5b7d5755792103718412842d14b6d09fc7e697fb8f90962d2a9c04a62e6bf43f5c5d09f7c3cc6d8d2ad9729f80db31eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759774, "uuid": "b56fa435-0777-4131-ad5b-d294349f59ed", "value": "T1D182C051835B0976F5F1483DEDA5868737AF0AB8E1FC763110318529FD8268A1AF82F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759774, "uuid": "bf9e4d90-524c-497c-835e-a3344a240a50", "value": "384:cjvj14mXXhqpAaYNHe8x4Xut4HCBF6G+hymdGUop5h4UV:cjfopAaYN+WeiBF6G+s3Uozx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759774, "uuid": "d0d3cc3d-682f-4e8e-80c7-71ac65577949", "value": 18008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759774, "uuid": "48ad881d-dc37-4587-ba47-65293704868f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759774, "uuid": "5e82b9b3-c29b-4a31-ad7a-2249d7ec39d2", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c93ed5-3eb5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760971, "uuid": "dc048784-289a-419e-b04d-56ab51d00da6", "comment": "Malware payload (Mirai)", "value": "6b58b5f9e8d4c3bb0ecfab13b9e8ad31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760971, "uuid": "e9fa933c-3794-4df8-aba5-d32ada0b00b3", "comment": "Malware payload (Mirai)", "value": "44f58e26fc4dc54a58d352aa6b0fa7ae1611d9818796fdd33e54bdc1aa464931", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760971, "uuid": "6f3c8cd6-f028-44d2-9922-7a4b23b5765f", "comment": "Malware payload (Mirai)", "value": "96c06843a746847e40e93530c13591893ae62983", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760971, "uuid": "6664fe34-cd98-46c3-9fde-8a0434535570", "comment": "Malware payload (Mirai)", "value": "b2f7c7292f065d3e78de1aca581053e1b0b4fe403229cfc80b5943f055e97898a35eb151c1c2a45527e98939e0d674d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760971, "uuid": "b06524e7-8633-48ed-b10b-377caed50221", "value": "T17F1349C6E943D9F5DE2101F03477AB76DA76F0BA5079F993C36CE632E902601910B28D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760971, "uuid": "262637e3-9d31-443a-b999-fd4dc502cc52", "value": "768:Z4EoWXZeCLFFgqpQIhwVJVDxR4Nx2YvJoNTqFL38NfM6LhqcB:Z4EoWXZeCLFZpZSHDaxPphWftlqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760971, "uuid": "bc215b9b-f64c-41fb-93e3-d9a571a5bb39", "value": 41916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760971, "uuid": "a73c9361-39f8-4ba3-80ec-c069aab0c09d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760971, "uuid": "54c12487-d8c0-4623-9125-efdee8dd0021", "value": "owari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527723e6-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748765189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765189, "uuid": "0066b688-a69e-444a-afd6-0dc12002ca95", "comment": "Malware payload (Gafgyt)", "value": "86b46a623cf84e2a47ac552aa918bd6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765189, "uuid": "dd1ffc8a-6eaa-42ab-9b7f-18632fa0dc05", "comment": "Malware payload (Gafgyt)", "value": "451e6d74dcce8cb4f01f7db0d084dfba4fcb8bebfcb09b31e4164fc1a947ce2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765189, "uuid": "e74a8a99-15f5-430e-aa1f-79bd1f5fa4d5", "comment": "Malware payload (Gafgyt)", "value": "e734815813aa10d85e7ba17db312cf46315bf7f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765189, "uuid": "5b1c1c47-b947-4a66-ad0d-d0999efe35d1", "comment": "Malware payload (Gafgyt)", "value": "8ee7fec3acac0768317c667fffdaf56902e0f5ecfd064b0b3c7d0c802e8bebf0956a0f3e3e5488c5d347e6cee7383f16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765189, "uuid": "3111cd02-61b2-4e38-9780-02a3ef597716", "value": "T1ACF34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765189, "uuid": "e189fba2-653a-4590-a588-d57785345e1d", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBFYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/rYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765189, "uuid": "9d4b06d2-776f-40d4-ba6c-f475a4f17b18", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765189, "uuid": "af7c894c-d0ab-4133-bef9-029d26755c4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765189, "uuid": "60e1a768-9ee9-41ca-893e-0b284e1b583e", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d06f82a-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1748798734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798734, "uuid": "3afa2563-35fe-4930-a5fb-edb5fe124829", "comment": "Malware payload (Vidar)", "value": "e597e1b43b378b5f6428cfa731f60cd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798734, "uuid": "8c93e2f9-1ef2-409b-89b9-913ff3c5a88d", "comment": "Malware payload (Vidar)", "value": "467632a1d19d43ebde318007433f48a4efa028db5e0f73745a4cf8292179a403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798734, "uuid": "3e2f92c2-4c8a-4b5d-8e5a-c66b070195a7", "comment": "Malware payload (Vidar)", "value": "a02d362c63f26f6036ca4772421998b742f6bbd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798734, "uuid": "b5d34a43-7bd5-4b1d-a10b-5fc480df9443", "comment": "Malware payload (Vidar)", "value": "37c82e94fe8b834f4b4e1a3df26e1f8776b29d0acf9301c394857d663bf530707a8c0b615a46e25601b659ce3ca1a821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798734, "uuid": "2270b2fa-4c9d-4fcd-9fde-403df56e2399", "value": "T12F06E007FA975AA1E3526776EDEB0C508779FC83761BD71E398A2B29080373B4C81617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798734, "uuid": "ed0e315a-434e-4ee0-a4da-753607e6592d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798734, "uuid": "c8c294ec-c6d4-483f-b19b-f742cd4dd181", "value": "49152:h0dp91aG5ko0fQ2VYMc3TW86zTvYOoQBhg9fNm0NGFwIC6fxle+:88G5kowQ2HL86zTvRhg9fNDywIC6fxlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798734, "uuid": "d8a94777-6a98-4576-955d-4c7b8df427b5", "value": 3728216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798734, "uuid": "e8271594-7bce-4516-bf8f-ebe0d1e26765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798734, "uuid": "abdc4b96-7d74-4708-b86f-1d22139dfb31", "value": "SecuriteInfo.com.Win32.MalwareX-gen.8753.25227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e6f081-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Sliver)", "timestamp": 1748807049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807049, "uuid": "4914d281-a13d-4219-9aab-1728df0ee156", "comment": "Malware payload (Sliver)", "value": "5615d287207d970765bf9bdef701eb92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807049, "uuid": "c79e56f4-fc3f-4647-992f-03f42e5e8141", "comment": "Malware payload (Sliver)", "value": "4742371ba458a52733a2b8991ab9a24615108215ff623730403f21e7dd228a7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807049, "uuid": "10f6715f-e8ef-485b-9742-a5a593d6081b", "comment": "Malware payload (Sliver)", "value": "a261d552ea77c96db5202b7a5f3d2fcfb3ce348b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807049, "uuid": "7670abb8-aae8-4afd-9368-3516c25e1ca5", "comment": "Malware payload (Sliver)", "value": "afbf8487962a2eda009eaa6660955f75f687dbc0a010a894776fec69272cfc68a1da4abdb0cb7e539acefc82341339c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807049, "uuid": "0e6c45ce-ada9-4901-baf9-eebdd090acf1", "value": "T17B0702E0F939FD87F766D438A419F658CAE42091E745D03AB02AFA7456B33902129F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807049, "uuid": "d91d3e9b-0e31-4332-91eb-c0d3fa3f2c43", "value": "c4e4f1c1451f2706373d99b9edca83bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807049, "uuid": "d93230de-d1d8-4999-9d5b-0cccab946824", "value": "393216:J/sxqC0Sgmq1+5bMywZOuVxw15qUgauwZmHhUMQT0qK+OdCQMNbcNX7S5:J0xqe54fku7w1TMFQ4p+OdCrNEX70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807049, "uuid": "24e92c6f-0b38-4a8a-85f6-5a3a8b9038d3", "value": 18224809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807049, "uuid": "caf2e6ef-06fc-472f-b6ef-5122132c1b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807049, "uuid": "a9ef7f38-9a46-48a1-a015-74fb69703cd8", "value": "README(1).txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df87f76d-3ee4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748781317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781317, "uuid": "6acfa690-5478-4fff-b533-8c8dd753c385", "comment": "Malware payload", "value": "25ec907c3016bb7ccd6a80f47df08474", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781317, "uuid": "0323a500-7fab-4862-8150-c51c32a75abd", "comment": "Malware payload", "value": "488510297a3e95900448582940d442a164f58a32d333bc03e5bea350476a67b5", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781317, "uuid": "9f0e900b-4688-4034-b602-32c4aa957645", "comment": "Malware payload", "value": "acffe1c7a458703f983fc4f1eb31324fccfe53b6", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781317, "uuid": "62db07f0-6c31-4b8f-9e6e-08db01beb1d0", "comment": "Malware payload", "value": "9cb4df69fe9ebbe3345ab7c105b9f538a8fac0ffbb7ff89f689642013b667b07e002929e3a83c5c20f2bbd86a34182c0", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781317, "uuid": "fa605312-4b2d-4c89-b7fd-53bbd1b122c8", "value": "T1B2A56B1136405C7BF16AC2705649BB68F3ADF5B03FF6C1C7E290D6292B314874A256AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781317, "uuid": "02c18a55-1a7b-405e-8bfb-7f5ab220bb3c", "value": "a9eb0b46bec6fa6915e1b0ef1b9b0371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781317, "uuid": "bfe45a70-0f86-4ab3-8513-77af5ec7557b", "value": "49152:gHGxqvhi4QQt4SnBcEYBeXHxLkBEqCDia9ugCq:QhLQQtFnCEYBqHxLkBEqCDia9TF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781317, "uuid": "916600b6-8ce5-49b4-a60f-ea6fe2c45816", "value": 2137072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781317, "uuid": "789b69aa-7a1a-49f1-aa79-bbe389998a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781317, "uuid": "93befc39-9382-491f-be03-4c6298cbc880", "value": "DiskInfo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5454f87-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786507, "uuid": "51e8553d-9a44-44e5-9279-994b55b5a4d3", "comment": "Malware payload (Mirai)", "value": "83337387d02e1897e766c29e34605574", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786507, "uuid": "65c952aa-71f1-485e-90d5-61733cd491a7", "comment": "Malware payload (Mirai)", "value": "4887810e7b6b6e6f43ff7c3d3c27f358040c412683e94a741e610585c88687a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786507, "uuid": "bca33dad-3e54-4a3b-b187-9f0365137e14", "comment": "Malware payload (Mirai)", "value": "2223ac26ec9fbd63f5da59122b08a79e47b35309", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786507, "uuid": "b967653e-fd19-4099-ac86-18db7e38d36a", "comment": "Malware payload (Mirai)", "value": "8c6f21f5c9f507cd330147134df0d7fbc75542b953136cddad14f85c2b83a533db344c85df5c5e335137149e3b87e40b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786507, "uuid": "584ecf78-0fdf-4fdc-af4c-5897277ffb71", "value": "T1BDA2D061E2D59FB0F6FD6D349DD1E280BBF20FD479D5CAA200441F66832A8536788ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786507, "uuid": "dd82870e-16fa-47a7-8c91-1b352fa9f15d", "value": "384:7/gNyF/M84Tp2YshxqlDZv4nO23Y1n3nkxRvnKx3/MM4uVcqgw05VxJh:7oNytlSVsMDZgF3Q3kGJ74uVcqgw09L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786507, "uuid": "07200b1a-4637-4601-bf5a-56900d5d6b41", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786507, "uuid": "9df5ef81-f69a-4976-8caa-01bbdc0cb20f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786507, "uuid": "dc6c6b45-9638-48f4-96fb-82d7267d8e6f", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8588427f-3f16-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748802641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802641, "uuid": "2d4e39cc-5959-4ce0-ba49-3d227b58abdd", "comment": "Malware payload", "value": "d74f805d0a7ace6479bc70a1249a742a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802641, "uuid": "9489a442-b3f7-443b-8cb9-7d70fe098b73", "comment": "Malware payload", "value": "4ac7751af246df33e8d417b1eb4c499da9dc667b49188aa5b7716f6f95ff867d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802641, "uuid": "c406a1d9-6886-41cc-9d28-249a280a73e5", "comment": "Malware payload", "value": "ae50ed9473db0810d521ca75b2d5358abbe9ed76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802641, "uuid": "a657a5c6-f317-40ff-b0e1-0f43e8142488", "comment": "Malware payload", "value": "a037416d391ff219673450b3310a9376d4d1accff668f79efca7537aa8269d95ecd232cd24907787a235ffa19a908207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802641, "uuid": "fbc2cab4-612b-49b8-bf27-2125a7a16f6d", "value": "T11EC36B10B9C280B1E1F21E3059B1CAA14A7FFD7449315EAF63980ABA5FB50C15A39F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802641, "uuid": "a40202c4-c801-4a34-a35b-402ae1a4216b", "value": "8d4c7dcb7e5d3788b5d2e2bf14363085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802641, "uuid": "bdf2a7c5-7cab-4c0e-a0a9-a46416631e6e", "value": "3072:XHy1ln+kt3SaBJlWKWpBq/5X/KgdyfuCx2lF:QnQKWpM/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748802641, "uuid": "7baa46a9-35a2-44de-b7d1-a3ccf01656e0", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748802641, "uuid": "53381919-9033-481d-8b20-a9ea0ad8e66a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802641, "uuid": "f0d25d19-6800-41e3-90d4-ad142ec53ad7", "value": "mimilove.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d037260-3f2f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1748813417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748813417, "uuid": "7ea5f478-9940-4cd4-a0b4-afca1e99e4b3", "comment": "Malware payload (RedLineStealer)", "value": "c526fca4d6fab3bab99e20219d60118c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748813417, "uuid": "4f5d5c04-dbcb-438a-8a30-1bce0949c30a", "comment": "Malware payload (RedLineStealer)", "value": "4b79c2fd75e2418fae364e07ceb081553cddd145b3c728c3384d1e63496fd75e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748813417, "uuid": "84418555-6b33-4698-9bc6-d45db3cfde02", "comment": "Malware payload (RedLineStealer)", "value": "c9760cefdd3731b087b6ca52a63be1e3447c5393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748813417, "uuid": "e73cc4d2-2060-498a-8e2c-7858d59a4521", "comment": "Malware payload (RedLineStealer)", "value": "7dac0c5b902be1eb8af7c13fb27000c3bfb4d32c57deed5efed0186c04186baa23738dfe708b0c483bfaaabefd3356fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748813417, "uuid": "3b9be90d-925e-4597-8bda-b1a0feb906e4", "value": "T1C5B4016E1752D653C8A90BB80222E2F837B5AEDEE832C3169FCC5DEB7147B116604357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748813417, "uuid": "75d959e7-2939-4a5c-829b-05e3acfb975f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748813417, "uuid": "8e05e6c7-d52a-4a45-aa35-83ce723222e8", "value": "12288:pOgDB6y3aFqgDBSAweIJ/PWdjIjrBYnz6sqPN:pOW3asgove63mOgz6sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748813417, "uuid": "2f8fe76b-5356-4fd2-ad0c-134335b0f2e4", "value": 519680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748813417, "uuid": "c3dd6f6c-481f-4705-8450-41e08dd470a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748813417, "uuid": "3119d25c-3f5d-475f-8a22-1256ec6f5ad4", "value": "c526fca4d6fab3bab99e20219d60118c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b5d48e-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744758, "uuid": "477883d2-64cc-496a-8efe-2da7b4d0c2f0", "comment": "Malware payload (Mirai)", "value": "14f778de37f0fd2707842a986ee9c53b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744758, "uuid": "f643434e-1c81-42fd-a0d4-0db20b5bbe71", "comment": "Malware payload (Mirai)", "value": "4c91492acb9a46e42de3b7963233aaf5dedb88fe573fc5457e4718487e91f7c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744758, "uuid": "81a0302e-14e4-4168-85ea-f9c5870f003e", "comment": "Malware payload (Mirai)", "value": "f854c1048c8385f610fad8de94193f6778f92c12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744758, "uuid": "da8a958b-fbc9-4ba6-bdce-cb744d69023d", "comment": "Malware payload (Mirai)", "value": "c3ca13d80f9992b25be14f4efa9b6c1edff7f7076776f81e0224baf99b8737b976772b3ef98162c1f212b0725071c007", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744758, "uuid": "30d29940-4e1e-4f91-8fb2-ee30fc9df724", "value": "T19DB2DF3C1B151BA8DE1EC1BD83990B603CB81F2591829D4B6207ADD7AF9A8747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744758, "uuid": "e25cf9e0-8447-4abe-8949-a73ba8dfa6c2", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtui8mdzJgGlzDpH7uNj1JA4M:neD8ZSWvZHZbs1row697qohQvg98izJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744758, "uuid": "81783740-8f1b-465a-b5ac-50a3460958a0", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744758, "uuid": "da0bb461-a48f-49d2-8d05-92c1c8943180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744758, "uuid": "1a10246f-f279-42ea-a7af-280bc19cd1b8", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0182f00c-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786528, "uuid": "2db7fdd0-cc1d-43eb-a98c-f282e5d60e78", "comment": "Malware payload (Mirai)", "value": "d307c955f3f072b1a55dc9fc13edaa48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786528, "uuid": "109e87e1-3e2e-4329-aa22-ff500cae7d91", "comment": "Malware payload (Mirai)", "value": "4d03894d0c5ed995f52d69215d6c05e09fc4d18d89c819b382bd5117b46a71db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786528, "uuid": "b3e36fe6-ed89-4376-971b-749a064e19a9", "comment": "Malware payload (Mirai)", "value": "c1fe260398260be78b48f31db7501b445c896280", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786528, "uuid": "90d79d4e-f1f2-4ce7-b1c1-3d4ba769f72f", "comment": "Malware payload (Mirai)", "value": "410ba4d00bb9aa41c3c3730d708a097b050a542a5cb9a301531d3c05c787c28d0bf6ad4175b8b551328e45d747f135b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786528, "uuid": "baf1042f-8a19-41a4-b947-afeb375f0abd", "value": "T1C9432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786528, "uuid": "942a1a17-8b38-4a39-a9b4-7648c938b214", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw4:RqtmZPuutfbltZFBSJsBcfDSTFI+BE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786528, "uuid": "73189038-dc6f-4880-bc1b-9cea1c68a46e", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786528, "uuid": "0e8948fb-f734-4aba-b55f-405e11192b9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786528, "uuid": "a2864a52-d28c-4a94-b576-ca2fdbfe31df", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b401af-3eb1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748759161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759161, "uuid": "88159702-8b37-4b58-8641-79f001d30826", "comment": "Malware payload", "value": "9f882e9ac0a001dbc5830bcd0d51a4a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759161, "uuid": "3ee0ecd3-3c1d-4bf6-9fc8-42b3b47d60b3", "comment": "Malware payload", "value": "4d4f6a9f67fc7f51426c125b478468ec009e2fa86abb3a5df9c08f9b05f45cc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759161, "uuid": "a65a908b-20a9-4eb3-9f6a-3dc93c26a90b", "comment": "Malware payload", "value": "4ce5ea87ed91fb9442bf50bf6dc46df2714ce1f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759161, "uuid": "c2b2f191-d9fa-4ca3-9a2c-28fcea3a8658", "comment": "Malware payload", "value": "f43a52d43dcff32b57450e0041ff691f313e7a9197dfd7c689bc694f2e881ec8dbf1ef25f3d172d5299fcca08e54d280", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759161, "uuid": "64c4c241-0656-49ff-a9df-3a0a14db5bd5", "value": "T194A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759161, "uuid": "4b95de47-6a79-4abb-b238-fdfddd5c81ee", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759161, "uuid": "5539d82f-b5fe-4a20-b67c-912371b2a71c", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759161, "uuid": "78b93640-a369-4cd6-b785-9e24dfa19bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759161, "uuid": "a22ee905-8c61-4601-aadb-58734c0c737b", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6a74ba-3eb1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759167, "uuid": "84353f3d-dbaa-4d09-abaf-d168a53b0af1", "comment": "Malware payload (Mirai)", "value": "9df3099efd7462b6a9f6cc7c74651c32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759167, "uuid": "b5803015-67fc-461f-b78f-44aaa80eeaf6", "comment": "Malware payload (Mirai)", "value": "4d758323b770c97a73ac34940079b2a1b865282d16be63701259b8d0b0f4aa32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759167, "uuid": "cd0fb055-3ce0-4beb-bffd-d109f32aaae7", "comment": "Malware payload (Mirai)", "value": "f45e3f72c65fb266f1d5a7e94aa6db81aaef58c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759167, "uuid": "735cd6a6-3ffe-4a2d-9c4e-91167fbc4e76", "comment": "Malware payload (Mirai)", "value": "54e28ab367f6fd763b63bbdbf71115ac909843ce4e21e670ef62b02480beb2b2d93c200be0b6b1a536c59f2a1b6b89d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759167, "uuid": "1f9c978a-15b2-4637-8539-881073f01754", "value": "T11EF2E0ECF7A258C7CD9E1C78248E1336BB50A0EB53F70B54BB56AE489558543F24C04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759167, "uuid": "1eead9a6-4eff-42c7-acaf-88963346c041", "value": "768:g925AkRfpL7wmmoIUkJGJ7NDJxnGjRCmFKgtqtWU2n:M2J7L7zeUkJ27NDJ5meB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759167, "uuid": "8289fe88-14f3-4118-8706-fa75f43db7af", "value": 36916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759167, "uuid": "1ac801a5-7e92-471c-8855-a6debbe30d66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759167, "uuid": "72545ab7-105b-4427-a55d-8f784feb7f5a", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4295c7ac-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748798663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798663, "uuid": "82d5b103-d82f-4c31-b4d8-3b9b6c7c3599", "comment": "Malware payload", "value": "839bcd58ef0bbdccbc0e0a96eed6234e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798663, "uuid": "a7864b98-9f5b-467c-b5ab-1219c50185ef", "comment": "Malware payload", "value": "4ffb180a561363cbac4b2e512039b58e3dcee36d7a22409cbfa315c343ed7295", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798663, "uuid": "bf6466cd-37bc-4b76-afbe-914909859e65", "comment": "Malware payload", "value": "57a1708e4169ba49d374485fb2a6d080941987a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798663, "uuid": "db08a03a-62c7-44aa-9671-95d3d653d4b9", "comment": "Malware payload", "value": "0542509fb9e93c3f08fcad4de1bde1813c70856cac14128dc65d76e96a8e65233c116063afc5e792a346a7b043aeb07b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798663, "uuid": "7663f788-7c7a-424d-afad-b07c0074befa", "value": "T19A96F12276E2C036D8735A70D52DD2F991B9BC60DB32848BA3D47F1E3B309819639B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798663, "uuid": "57ff2773-66a1-4945-a67f-57f35cdd6060", "value": "a27c1b1bab0fbd6878da04b8d3715f84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798663, "uuid": "2c241384-f814-4f55-9781-0fecb3df5709", "value": "196608:V7Bh7IdhOhAxv4rTcNhVDb7vAXzxvgOvjlt:V1h78hOhA9HVb7oD1gOLlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798663, "uuid": "d793f86c-8d40-4a61-9eae-8f9dcc9ab90d", "value": 9467408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798663, "uuid": "47429fe2-1c4f-4ccf-945b-4c337df859f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798663, "uuid": "8515c344-6b32-44e7-8fb2-65d40c94376f", "value": "839bcd58ef0bbdccbc0e0a96eed6234e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc71eaf-3ee6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748781988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781988, "uuid": "30d27d13-bfd1-4d39-9bdc-844183034638", "comment": "Malware payload (Prometei)", "value": "5c4b8b256329ac9897a5aa59fe9e716e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781988, "uuid": "83990409-7728-44c5-8559-f446d3caf634", "comment": "Malware payload (Prometei)", "value": "517b525970d2a493515124abc6f25732157c09c434cbe7806f47c3613a6dc021", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781988, "uuid": "69bfecc9-197b-438a-9f3a-90ca1af1e07f", "comment": "Malware payload (Prometei)", "value": "f92e424638d4a89220ce67dc22a69b0a10185920", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781988, "uuid": "bf8a5351-d563-406c-b998-07ffae89cf35", "comment": "Malware payload (Prometei)", "value": "287769e2142eb58a632a5ad457d9ac04704b3b29c6ec65ad9ed7c911ff69c5b85c3cf74c3035db0071d78d5951182930", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781988, "uuid": "802550ec-4972-41c4-b837-109d59a89764", "value": "T12C9423F8C83D2E3098169B3CBB5A826CF0E15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781988, "uuid": "26a70daf-d3f2-4d52-af27-985685ddbf83", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgX:25WOSACZSV6eKRH5EPiamb4DsDwwcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781988, "uuid": "9363a174-ee55-4596-8187-8515ff234861", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781988, "uuid": "810e181d-9d63-4676-ba58-596502262dee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781988, "uuid": "800629df-0e76-44c2-bcaa-1f40aa152dc3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19d2a47-3ec2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748766664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766664, "uuid": "44af5722-eae9-40f6-a800-b0a5b2ca37a2", "comment": "Malware payload (Formbook)", "value": "bed60acc09ba30c16df109a0a39d3e06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766664, "uuid": "c6525ba9-a412-450a-9d7d-a9f233cf9f10", "comment": "Malware payload (Formbook)", "value": "51c8330454a219e7a33c65f0dc63deef85785db94c42591961ee65e80d59fca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766664, "uuid": "6030dd18-79a7-4e7f-89c5-17217e2fcec8", "comment": "Malware payload (Formbook)", "value": "90b36e1591fe6470fe7eb04c77438d8371c59de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766664, "uuid": "f3989924-cf8f-48fb-b150-185737787047", "comment": "Malware payload (Formbook)", "value": "302d5dc97e70c630e13b1e17b6ad6f6cea12c30b1b5cb52d29c692b054e6ff868ed85e908972282eb3ff88c5c039b2e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766664, "uuid": "b8a36401-5ad6-411f-ae25-6ab7216c3b29", "value": "T185248C3955E15B33C5DD92718DE12723AC016D232742ADE786B43F0928BA1EBFCA53C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766664, "uuid": "f11f51c6-e6df-4f2d-9b8a-362dcd528c76", "value": "7c2fd6552813b68acd0ea0374612a67b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766664, "uuid": "46dae40c-0fe4-43af-832a-f6c83506aa49", "value": "3072:C18RwaGleGQ76ea4gIQhc5LuGXelY120LEAkvOxNn5Itl:C+Rw4bSdrGXwY120LEpOnn5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748766664, "uuid": "ed4c2af9-eb97-4001-97a1-ce912a541ef5", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748766664, "uuid": "b89a98e5-1334-4ba7-b641-c8452fa6bd70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766664, "uuid": "9015ca16-9a81-4b21-8712-6726ef48ad2f", "value": "SecuriteInfo.com.Win32.MalwareX-gen.3274.20197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa9b88b-3eb4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760379, "uuid": "bf052a74-2754-4e36-bd33-90289845b4ec", "comment": "Malware payload (Mirai)", "value": "94c410c824b033faefe49854833cc3ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760379, "uuid": "9c6e9ddf-dff3-4a8d-865a-335479db665f", "comment": "Malware payload (Mirai)", "value": "5218b58b2d21ac19415fc3009af56bd92b816a57b9455e5169f65b1a1dc46d1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760379, "uuid": "1f4198ca-7506-4957-9433-cdcbf707b496", "comment": "Malware payload (Mirai)", "value": "f2c240c89ce7152a8b5795d580996124ae67b7bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760379, "uuid": "a0fe1365-7ba9-4628-9ab0-4dd0de53518d", "comment": "Malware payload (Mirai)", "value": "6d52d54067af46ecf6202f4376bbd941be3b08abfeb26a973f442be2c535591f37ed3786937485acc1f357c3a534e880", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760379, "uuid": "ff97762b-775a-4aed-bf7e-a93a4f14de11", "value": "T1A4234A21BD3A2E1BC4D8617A62F78228B1E9671E34F8CB2E3D230F49FF5150092576B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760379, "uuid": "c385ee6e-4dec-441b-8958-c271f79e5ed3", "value": "768:4oQWuqiruhncVmqsYQRf/x+387+e9VO+dXzKIT:4+uqir+ncVs91Jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760379, "uuid": "6bbd4121-31ea-4bae-8dbc-f0de6104a6d1", "value": 49996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760379, "uuid": "4ccb0dca-6c67-4c6c-9932-76edc84f8fc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760379, "uuid": "8df940bf-eb3c-4703-b771-7604b21d5326", "value": "owari.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f098cc-3e91-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748745706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745706, "uuid": "be2483b8-5417-470d-8377-c2fdb39890f6", "comment": "Malware payload (AsyncRAT)", "value": "e2f52e11dabfb48595fc3a56f97b2014", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745706, "uuid": "76f181b9-3c64-48e0-ae93-64014548dce7", "comment": "Malware payload (AsyncRAT)", "value": "527582be7272b4bf53a88748dc7b94566ca43acfe151a91cc641a273bf1a3e7a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745706, "uuid": "fda2aec1-246c-40d2-9ee6-a97786c34d16", "comment": "Malware payload (AsyncRAT)", "value": "307fda95937beb41bd25f843468da7e63d326759", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745706, "uuid": "f42e8726-fd9d-4ae9-ab3d-331d02beaa8d", "comment": "Malware payload (AsyncRAT)", "value": "2b71b0b95a05ea6c8fd7deeff63bfdface0e208d5dcd9d5c0db53fcec39bba0c9bc6d1f44562f6d335950d556b96fb28", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745706, "uuid": "1709a0ba-8307-46b3-a2b2-5819f76bc075", "value": "T1B4738D5877E94415E1FFBFB16DE532A2CB39B7231903965F24C5024A1A23788CD41BFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745706, "uuid": "85c36b4c-ab60-40f8-89ba-3ee114399953", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745706, "uuid": "df949eee-d87a-49cb-8aaf-0d0f1dcd6e65", "value": "1536:EPYTRGMZFvyKYXRO3OpdoyRZbSgSHSgtR69C7OOGxfuBZt/tE:EPYNDlyfROd4ZbSwaHOOGxfu7vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745706, "uuid": "d37b5083-8aa7-498b-8c58-2665f4693c61", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745706, "uuid": "f4776ab2-2a75-4b07-96bf-f102eb89e144", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745706, "uuid": "f65b8075-9482-4b06-bcf0-e87925b69db6", "value": "Start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c79ff8-3e97-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkCloud)", "timestamp": 1748748043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748748043, "uuid": "e8bdcef8-717e-4cb2-9f97-b6f47d91fed6", "comment": "Malware payload (DarkCloud)", "value": "c00610b6a71f24ad8f73e491dc1df0e8", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748748043, "uuid": "4fb19323-3532-494d-a490-bd44c6518354", "comment": "Malware payload (DarkCloud)", "value": "5283ab39f60898d4bbe81b8de3cf5f169f283a8fc9ad018c2ffe63d123a2d6ee", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748748043, "uuid": "25abb253-e076-4807-9dea-901a4ee49180", "comment": "Malware payload (DarkCloud)", "value": "c27cd7fc41d8fcdb77f50d7b1e811c4f2767e204", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748748043, "uuid": "4942d84c-4387-46b9-af15-9757017d3830", "comment": "Malware payload (DarkCloud)", "value": "eb15e5f0aead872202a391ac780f8498bd7e907dd65bfc9cc7ed9c1aed850ae679ae1ae085e12e8dabde871d163b5b7e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748748043, "uuid": "6ad5946f-3582-4d6b-9d83-9d78d43dde11", "value": "T1B2C2E90017E4863AE7BE1774B8F3162006B0F947B963DF4E5E44D1E9285378A19837BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748748043, "uuid": "1167efcd-e3c9-4d8e-b48d-780a5654b418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748748043, "uuid": "d0096ee9-8d63-4fde-813d-c8a3142f90c9", "value": "768:XA4wflG0xNKeCGYaK0yZmPvxeEgKXY5/25Tl:pwB6f0yWpeEgKX7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748748043, "uuid": "a998f115-9c98-4949-8a4a-1b0b3e4a73fc", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748748043, "uuid": "4d2349c4-7656-4e33-b686-dafb5b67a78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748748043, "uuid": "ba6c9c16-2905-4523-8e30-2079534b620a", "value": "SecuriteInfo.com.Win32.MalwareX-gen.3475.29447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84954f8-3ee5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748781680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781680, "uuid": "47bc3d16-a040-4809-89c6-6826dfa637f5", "comment": "Malware payload (Prometei)", "value": "dd42643a2312ac6b3ccbef46968d7906", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781680, "uuid": "8e51a4ad-796e-46ce-94e8-830624dc5c55", "comment": "Malware payload (Prometei)", "value": "52eed5886247529292ff3bcf1f89c2e7dff5f414d051320cfdd696af64198677", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781680, "uuid": "893124a8-5df1-4ece-ad64-b9303741227a", "comment": "Malware payload (Prometei)", "value": "1a2d8b7dd04187cb28597fcd6483a0fdab78d3fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781680, "uuid": "98bda1be-86f3-4196-807d-4bb2314ed20e", "comment": "Malware payload (Prometei)", "value": "25a7cc5ad865e96f641806edf8c733442638f132456ff0d99242a393abcd9c5e0755bbe7248ba92d82d1fc13351a61b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781680, "uuid": "c532a869-2227-4d47-99db-be4daea231ad", "value": "T1CB155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781680, "uuid": "ddb428b8-c554-4475-812f-e1a67a24698b", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpld:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781680, "uuid": "083316c2-89f0-497b-bfec-6a3842ef3e03", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781680, "uuid": "88963c79-bd0b-44fc-a7f7-eabebb6c9d4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781680, "uuid": "088002f6-6a28-4864-849d-3990e1294fc8", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a733595-3f44-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748822191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748822191, "uuid": "b0963f18-d336-4105-933d-6d061c8c7b41", "comment": "Malware payload", "value": "6a10789ea1636c9fb6cc650997427435", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748822191, "uuid": "53877ef0-5419-45db-99e8-e370731f7335", "comment": "Malware payload", "value": "5311c51f180d9936a076799f3ba6074bc2e136f8c3258de588d88f14ef723748", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748822191, "uuid": "4f927fd0-c109-483f-b329-35a06b0a75ab", "comment": "Malware payload", "value": "b0f0380709442ea18cb7d84e01c40a1f0d7b0c12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748822191, "uuid": "6ea0db6e-8a06-47fc-8aa4-df5a71d4b42b", "comment": "Malware payload", "value": "fa7983e672d2da2861f7a41d5065e90c5225f8d4b3332d933104dea494fd37aeff13b250b9c5d05c2fc71b4ffb6f818e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748822191, "uuid": "fc4b09f6-31b7-410a-91d3-3560ddd39485", "value": "T1DBC6336443D40ADEFDE6E73E88628495C6E72957074AC587F3A884E22D337C6A13E743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748822191, "uuid": "84087ece-c4e3-46a2-a5e8-6e558abc1f8e", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748822191, "uuid": "4972f3f3-8ecd-4dd6-9a8c-53b64b3fafb2", "value": "196608:j9isZ4ZVf4sop1Y9RmwKCYckuMlrvNTwhLAGurH1xP/XRLkWXIpk0ax86Lq2KJUC:hfZaKBsRvKCYckuNLAGuLX2MIzaxXyUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748822191, "uuid": "d81c9762-1d40-4861-9aa3-125227b99338", "value": 12418837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748822191, "uuid": "eb8e47c5-3b2a-4479-b96c-2cba09b27d84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748822191, "uuid": "704ef624-7461-4c2a-8f8b-297ccb89f210", "value": "defaultwindows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec6417a-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744862, "uuid": "cbe6d2e4-2d30-4e15-8c3c-3c88c594083b", "comment": "Malware payload (Mirai)", "value": "af2aa0d9eaba10e61b308911cb4cf9de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744862, "uuid": "455ad3af-e9d5-4c48-ab59-3440ad332219", "comment": "Malware payload (Mirai)", "value": "5387d70021b2815fa4f2e795e6ae370cbd3822c32b4b7d1226eb80708411b109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744862, "uuid": "15786a18-fab7-467a-a0d5-c5dbfbf25254", "comment": "Malware payload (Mirai)", "value": "a1f8f0ba78d3f5db236392c402e126e2b30f39b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744862, "uuid": "98455274-7581-4fbb-9bf4-45ec2d05dd5b", "comment": "Malware payload (Mirai)", "value": "830d89db258d8c3163e6dc24cde4746f32aa60102cb71600d23c765807bdc103a0d367bd5b1de2f317dbad1588e21495", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744862, "uuid": "5d9f7e08-79fb-4ad4-9aa9-1fe34c7c8638", "value": "T1A773A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744862, "uuid": "19abeb29-b882-4201-acbd-67b3054ebbe6", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStm:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744862, "uuid": "15121ccc-5754-40fb-9790-57e644c9e4a6", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744862, "uuid": "9c15904f-e31c-442b-aaea-0417ef0aceb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744862, "uuid": "4b967289-f84d-46f2-bd0b-986df28601b6", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cb285a-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748799819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799819, "uuid": "c2e86c88-aa6f-42a0-877d-51cb6023682a", "comment": "Malware payload", "value": "043dbd1534e88b1a147337036c92bf07", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799819, "uuid": "a104c32d-1ff1-4d2c-84e0-44867041cca1", "comment": "Malware payload", "value": "5430f21e56324187cf6688c2dd6eedb9de703f4c72a8b8c4437154b371d2b37d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799819, "uuid": "0d007957-157a-4cee-821d-e30564145575", "comment": "Malware payload", "value": "12c5b9b679b833fa481d309b458eaf49a8dfb195", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799819, "uuid": "15dd0ce7-e614-47cb-8152-a927432bd66b", "comment": "Malware payload", "value": "78ae66ce7ec51abbc4f31b7e47d1f05b4fb44761be962e1b0fb3d6cfb30b30eb8b2428249e865027e43bde13583e3a6c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799819, "uuid": "2857d8d7-957b-4d8a-92a5-a9cbb0f7f0fe", "value": "T1B7511F122BF50B19E3BB8B781577A350467BFE14AE08D70E1060460C18B2628D87AF3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799819, "uuid": "7d735dc7-b3d3-4826-ab28-bcb87ec68428", "value": "24:8Jwtn+wZ0KhtKWQWAlWI5bbeCxNPS9ddNXuHY8ddGRgGbvq+3Ym:8JC+wdQNRbbg9dLXuHJdGR/bvfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799819, "uuid": "c89728e7-c213-421b-962e-16f2b1ae85c5", "value": 2473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799819, "uuid": "80b58235-e0fb-4c01-a93b-8b2682db9bbf", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799819, "uuid": "6e416c89-d2d0-4953-aca1-623b9b9c3c0c", "value": "ApplicationForm.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536bac7c-3ee4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748781082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781082, "uuid": "74237391-3283-4bcf-bd08-040f6c93db07", "comment": "Malware payload", "value": "522fc23e863bb060b6273098b396ce39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781082, "uuid": "041dde7a-9601-4ba2-bc3f-626774782e56", "comment": "Malware payload", "value": "548af8d818c5cbf30efcba8a997fd4b8f331a325b6f76a0660ded4892f11f88c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781082, "uuid": "1426f2e7-c073-43f0-a7c2-6eb35de39945", "comment": "Malware payload", "value": "59d1399bb9e78c224b6509fc93d09609ae97dc9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781082, "uuid": "b4aafd6a-736a-468b-b606-afdf64fe60c3", "comment": "Malware payload", "value": "97561e8a5a9f113703ab67ad0613447980a97be4522593a729109db91f4b07e42bf7bda037f2d1e1b686ed89d7447d40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781082, "uuid": "cb80c377-6481-418c-a46e-3f37e0c9b142", "value": "T142A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781082, "uuid": "44fcf22a-3f69-4e09-9736-a5158911e9de", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781082, "uuid": "3a7b26f8-5472-474a-b3d1-7cf5a1694325", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781082, "uuid": "c7253ec5-ec4e-4e89-834c-c6f7d7ccc174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781082, "uuid": "bd45ec09-be75-4487-a143-dda176ce4b2f", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb1dd4e-3eb1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759196, "uuid": "1b79ac79-b222-4ae6-a096-53ac6d937c6d", "comment": "Malware payload (Mirai)", "value": "e425986392e6ba9a034438abee6c1df7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759196, "uuid": "7e9fcb5f-e4e2-4881-9644-d26c8141fca5", "comment": "Malware payload (Mirai)", "value": "54a129c018db569858366e713dc19715a149ab8eb1f696056f12a30c3870436d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759196, "uuid": "413d22f5-e1ab-44bb-a93d-86e5c3a06090", "comment": "Malware payload (Mirai)", "value": "0691493b5088e85fe3310f5c87f1aeeb7176caa9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759196, "uuid": "2d2024aa-c1a9-4b11-8b81-a53966a29e5b", "comment": "Malware payload (Mirai)", "value": "7517cdc34d305197e300bf5d04f0912325b6fb37401505b577f26e7132c6ed02b98a55161fedcb2176122cfa63c56e1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759196, "uuid": "84c5001e-a14c-4816-8d6c-5ea2737d979b", "value": "T17293D609FF510EBBC86FCC3709A90B0139CD599722A97B367574D928B64B24F1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759196, "uuid": "e81186d4-4de0-4763-bee5-73ef0c4057e3", "value": "1536:k2vB7jidOWxr6asx7BjAdeo9tRlV7ZXoExhlXKg5N6Mic:k25SdOWxrV7RlV7/EVbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759196, "uuid": "808ef62b-62bf-416d-8895-7bc15368c673", "value": 93104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759196, "uuid": "dfc8a5bb-13dc-4edb-8cbf-23a7d9af18d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759196, "uuid": "8b10d3d0-13cd-45e8-9f39-a965337ceddf", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d5bfd5-3e83-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748739669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739669, "uuid": "8bf72679-8ab3-48f5-b177-389fdec09e34", "comment": "Malware payload (Prometei)", "value": "229edb59ce78d0ff4b48a7ef66508699", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739669, "uuid": "8153d67a-8009-4441-8feb-2ce4db531bb1", "comment": "Malware payload (Prometei)", "value": "54abbc81704486b9c87d0d005b8bcaf91d7e827f280b27d725a6ea8819f5142a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739669, "uuid": "a3530d28-f40e-4de4-a6b2-b750ed71e890", "comment": "Malware payload (Prometei)", "value": "e2298cca57b65d36dd27ac28d9466694f8a23d7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739669, "uuid": "63a81450-216d-4f64-b459-38c48c6454b2", "comment": "Malware payload (Prometei)", "value": "d6bc76f3bf1d67d49b64698a6f14a42261df912ddb5aa14d806f15cf51cc976908dbadfb87e531530f0541aecbf61d2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748739669, "uuid": "b4cfae78-f1a7-47f9-8517-ecfd5da3d04d", "value": "T14D155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748739669, "uuid": "c4d685c0-5617-4870-b6bd-f4a1d50c1022", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplL:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748739669, "uuid": "38081a9a-9e21-4393-a7ff-b91ed5b38525", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748739669, "uuid": "0eb7716d-a3b7-4540-89f2-b02e1b48159a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748739669, "uuid": "55eeb977-7df8-4617-bf41-14cf1805f155", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6d7588-3ee6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748781954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781954, "uuid": "94babc54-69d5-4599-a1e3-babe1754506f", "comment": "Malware payload", "value": "5307883f4bab3993ca9b7b78a340cd08", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781954, "uuid": "a0da67f4-b186-4bbc-972b-4657cf575c64", "comment": "Malware payload", "value": "5533e7db31764210c05d6e56b1b17c87c7c0c37c20539769ea03a9976ca7df5b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781954, "uuid": "c87c2231-4b79-40e5-91d3-62f91b70b225", "comment": "Malware payload", "value": "c7c16f49e7219f81e6644ed1c34130c85933f95a", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781954, "uuid": "051878bc-caae-4ede-8b46-5e1d91697cbe", "comment": "Malware payload", "value": "55137b1b66ea3b81ed1a6418ffd2a84c49fcd13961ce16aa081278e8db14cd56686ae688d616511b4caa86545eff3e33", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781954, "uuid": "8c430911-9ce7-4e88-8971-34cde14b3b20", "value": "T172C47C1677A447BAE17BD238CA538A46EAB278455721E34F03E853BB1F23360593F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781954, "uuid": "5c9ea023-2651-4ece-aaf2-8bcca72d96a7", "value": "899f4e66b96bcd1ff6ef1e5c5b118fb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781954, "uuid": "4df523e8-7fdd-41b6-ad59-5ec9346fc071", "value": "6144:FU5PmQqvsnVIq3RtzVnmtQbisNmQkFIQx4Vr8r:FImQqvcRrz1FisNqhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781954, "uuid": "379b5163-6038-44b3-8fe2-2b2820eb251b", "value": 558464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781954, "uuid": "99e742fe-b720-4bd0-b1ec-456f8410dc0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781954, "uuid": "7fda55c8-869e-424f-94a1-71b57d2037f1", "value": "BugSplat64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9dbf3e-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1748800188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800188, "uuid": "fe992dba-e4a6-4424-9c40-ebb970a5b210", "comment": "Malware payload (Amadey)", "value": "cf876c35faf27b6c93ecbc0b9ab5a307", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800188, "uuid": "1697bfb1-928a-4f7f-b92e-3c5f29ae4b1b", "comment": "Malware payload (Amadey)", "value": "55522582eb8929ddeaf30a998dc28942cf3d4a8c69279dca4eb73b3aee031c50", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800188, "uuid": "5830d8be-339b-4d41-845d-799656766f84", "comment": "Malware payload (Amadey)", "value": "a95d2baa22b4e7060b1e6153fa71443e5d9dc5e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800188, "uuid": "06470f29-e53b-4746-af1b-86a7b37c551d", "comment": "Malware payload (Amadey)", "value": "f9e277cc819741505999d8c7112dbcb6e42fbe897dbe1474cd1d72878067b1b2e1900f52db02618f8ac4a1e5a640a532", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800188, "uuid": "576afb65-17d7-4390-9d3d-c80bd8ada372", "value": "T165D54B52A44DF2CFE48B16749527CF81685D03B9172206EBDA6CA07A7E63CC716BDC2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800188, "uuid": "e32720b5-493e-4fd4-9ac4-37e8150d597e", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800188, "uuid": "78108bed-2f6a-4483-a916-a69ba88fc004", "value": "24576:GrNXBfGvxLcTo0mTVTHM/p9FIMOpQvIRKcszRZEMMvQ/otW2RmVueTnap3MDERAq:eXfUs9eMCWvZUgotVe4MoRAaBYrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800188, "uuid": "080fbd6f-a023-4a63-8c0b-d02ae72a3f47", "value": 2968064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800188, "uuid": "19e69431-bbb0-4894-a9b0-38859d94feb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800188, "uuid": "362f8282-8632-4bda-a0e6-5b8e5909a42f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95af75a-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786514, "uuid": "391027c0-abd7-407c-97a9-4def985ad7f2", "comment": "Malware payload (Mirai)", "value": "accf922df1c98a1ad6c3ff0a4108cd47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786514, "uuid": "2380ad30-11b2-484d-b837-022fa6031bea", "comment": "Malware payload (Mirai)", "value": "5637b61674a16c28c084a4f2b0bb82c979371d83f66eec3b3b3dc7ec36910e8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786514, "uuid": "df5d2e3e-35cf-4184-b718-45f7d97215f5", "comment": "Malware payload (Mirai)", "value": "d1cd3cbb87a806a4302d82080cd2b47d5bb70936", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786514, "uuid": "5cb1fe0f-b032-4834-93eb-4d0a6867df05", "comment": "Malware payload (Mirai)", "value": "79b9ab872c6ff07dcfeb290c72cb2d2d8d8d426f67af3a6fa2bea44616f851e2608597ec25fe33087a33249efd2d01ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786514, "uuid": "efceaf5d-049a-4857-a779-a8613a9ffb9d", "value": "T132C2D1A47424BDD2C9306C76DA688CC63B8621BC50FFBC7751210D28AED58CB5BF8187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786514, "uuid": "e3247eb0-0a95-413b-a36c-f71584b320d8", "value": "768:7MKyhegCCMqfN11zqcEobtfUxYaOcM0HT9q3UEL3u:QKy4qf7ISPayL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786514, "uuid": "3746287c-1e52-4faf-93bb-08bafa6fb8b6", "value": 27292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786514, "uuid": "fef37d4e-a970-48e7-b473-9648598c4f28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786514, "uuid": "79bdda42-300b-4332-a2b6-51348dc980fb", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91349b60-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748798795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798795, "uuid": "e8978dba-e2d1-4426-9754-3eaf01cd9243", "comment": "Malware payload (LummaStealer)", "value": "e1033e27df112be42702d2c38dafcfb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798795, "uuid": "dc55d7c9-99be-4495-baea-f861fc019f02", "comment": "Malware payload (LummaStealer)", "value": "563dcda94b0f745da7217a8dd0f828d6fc6955b0cf3ded69ec462ac3890206e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798795, "uuid": "e9ff97be-960b-4b53-9778-ecfbde559a0c", "comment": "Malware payload (LummaStealer)", "value": "181d1d7f44fe0416f542a09734dd1fed2eee4013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798795, "uuid": "ed6eba3b-2223-400b-b30b-c788a20bf2fc", "comment": "Malware payload (LummaStealer)", "value": "62cfbdfbbb11587b2550aedfa1fb210c7c309cd9ae7cbc1744b9fbafd7791582b5f0da23a1f5d7d8d2e38df95d2dff95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798795, "uuid": "7f36d50b-10d9-436b-81d3-47e30ea41bf1", "value": "T10B85336F7FC48A27C2BCEE3D8D57B0ADD53DDA4A00892666260B209E855F0FEB1D05D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798795, "uuid": "7ce2b386-f282-46c9-8ae7-98d03a636364", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798795, "uuid": "59f28275-b37c-4104-9f8b-74afb718d786", "value": "24576:eA3bmEVks1IbGSYHjrz8F5n4TtDshDxbvREu180HwKaGEFuwPbeWvWL9c5LHH9z5:eANSyINx1Aevr80H9aXdSWvrbvQbuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798795, "uuid": "174a386f-f88d-4cb2-a337-f75675920661", "value": 1869312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798795, "uuid": "c62ec3ba-f84d-48d7-aaab-4de62d87a7ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798795, "uuid": "8f0c17e5-278b-4b2c-aae6-5cf661b6c37f", "value": "e1033e27df112be42702d2c38dafcfb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55c33a8-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744766, "uuid": "9d1a222f-c0b1-4da3-b26c-58aed5cc3e82", "comment": "Malware payload (Mirai)", "value": "829258657532813393ff7da4e164bcc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744766, "uuid": "d6243a7f-aeea-4a55-8498-6a64ea47a693", "comment": "Malware payload (Mirai)", "value": "567e3f49fa2c36f8ff1fe5e03d6fe3595d688d3e9e21551fdac0653ae575da97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744766, "uuid": "8296754e-a879-45db-8368-de4c26f43bca", "comment": "Malware payload (Mirai)", "value": "72bc04b4dfdbb6b4af795bbe790e43408ec7a0da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744766, "uuid": "6b0cd14a-492f-4841-8f1c-6eb373246f90", "comment": "Malware payload (Mirai)", "value": "6a3c072990fc788b424266bfbec346b6933a29fa8c7008c9825184585133d0f534654dfd374d2eb860ab1a6275e553ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744766, "uuid": "55ce4f10-3d99-44d3-a888-c1d48933a936", "value": "T115C2E1E07726ED31C4206C3DE52B4C8A3A51067C90FF393664258D359EC269B67F48F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744766, "uuid": "b4232640-2430-4047-9b5d-0f25b7dee027", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrb9q3UELuf:OKy4qfqoeJdXWg6Le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744766, "uuid": "e4081769-930f-4b0c-bec4-2f1874852b53", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744766, "uuid": "16bf5750-8417-4875-b38b-5293f5b0b57a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744766, "uuid": "ebb12e47-93c9-4861-b0d6-dfb6efa9c4f9", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f16277e-3efb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1748790980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790980, "uuid": "2a634504-c30a-47c5-a024-ddb6c0ab4cc2", "comment": "Malware payload (Gh0stRAT)", "value": "6b40353afa45ebcb56eb73cc232c583b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "xiaobaitu0331-com", "colour": "#6B75B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790980, "uuid": "2cf08dd9-3879-4a8f-b050-87a68dd136a9", "comment": "Malware payload (Gh0stRAT)", "value": "569d4b6bd85b0470ef2fa447268eed75c4e2754e971cecaa51d4b20a222d3636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "xiaobaitu0331-com", "colour": "#6B75B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790980, "uuid": "da2bfaed-e77e-4b2e-a4cf-4b7901a9dfbf", "comment": "Malware payload (Gh0stRAT)", "value": "f06e47a72dad1318cdab8be9eb8afe89e0a3f0e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "xiaobaitu0331-com", "colour": "#6B75B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790980, "uuid": "76cabec7-f682-42bc-8c52-6a797b0ead4e", "comment": "Malware payload (Gh0stRAT)", "value": "fdef7281d56cce60a861aa1d134826c0b91428716255b6b4b55f183a3fcd4c517dc11f1456a2b911ece9bb570e1bb70a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "xiaobaitu0331-com", "colour": "#6B75B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790980, "uuid": "994583ce-6f7d-4d74-b67e-ae6987511466", "value": "T1F617333FB3A8653EC4AF16314572A390597BBB64781A8C1E1BF4091DDF264705F3BA0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790980, "uuid": "be9e7794-9d21-49e0-b50f-e03385252725", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790980, "uuid": "485303da-2c97-4f6f-98d9-d3d22d18bf48", "value": "393216:amXvbQRrawAhxR6SbMIworRVDPCphUv6iLGHxhysVsxxyq3nO1n:am/bQbG6SbDwcR5qpaCiLWysbq3nA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748790980, "uuid": "580c5857-1e82-42b0-b99a-63bc90684ad1", "value": 19063472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748790980, "uuid": "877e99ba-0314-4de3-b58b-5f444c3909bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790980, "uuid": "c6b7f071-8b8c-4a55-97b8-b185f81f0f7c", "value": "[System Process]32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdbb95b-3f11-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748800344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800344, "uuid": "0e94c0ff-2d70-43cd-97e0-6704ccc279cd", "comment": "Malware payload (LummaStealer)", "value": "f49ccbbf4dbfff8185a54ae44ec362c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800344, "uuid": "88bdd8e7-b6c6-4ac0-8c6e-7255076bb4ce", "comment": "Malware payload (LummaStealer)", "value": "57a03250b11c9714a95849f1b49a2f91349631333469ee35d92ad020173c07b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800344, "uuid": "7e1a8fe8-9d32-4e24-b171-ab9004053201", "comment": "Malware payload (LummaStealer)", "value": "522c7821117695125c8a93a79059d5229a43121d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800344, "uuid": "ea9c40bd-5c10-4f6a-a0e5-bb50aa14e121", "comment": "Malware payload (LummaStealer)", "value": "fade0bb76f4837a72ec4951c2b9f9d011847f9271fd9b2bcfda4895b7d9a71ac1a1ed3d73cd383a23cbc522a3076ce9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800344, "uuid": "1bf72d15-bdb7-44c5-afac-d421f72fdebf", "value": "T1E4D53991BC0971CFD48E17788167CD82599D03FD4B2048C3E86DA6BE6DA7EC12AB6D34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800344, "uuid": "30a8a1e1-1456-4d81-9b7a-ae05c42ba924", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800344, "uuid": "524329e8-8e4e-4222-a79b-75c3fddc2183", "value": "49152:Jh1bgzA/sGPsnwHh2MqcBDy/hAumVeRSQbuqDWeWs5iXNhW8X0L:JhxgesGPkwHh2MqcB2/hAumVeoQbPDWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800344, "uuid": "849e8087-9e1e-4910-8cce-67ee1a3c330a", "value": 2980352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800344, "uuid": "639125da-0d59-4f4b-95b8-a633d1c0dbb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800344, "uuid": "9ffeb06f-0527-4907-bdad-0a882811c62f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928a7ca5-3ee4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748781188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781188, "uuid": "721d0c9f-1a8d-4acb-8658-6a93f9a2af2c", "comment": "Malware payload", "value": "7f6a5449b2a2a421ca953011ddc33fa9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-8466", "colour": "#DBD8FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781188, "uuid": "a0411fb4-8fff-47f8-a229-c3f714157b02", "comment": "Malware payload", "value": "589cf3bcc9cefcb07bbe0b83b7869fe6715f3f60f7051ecb56c32a2598f1a1ce", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-8466", "colour": "#DBD8FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781188, "uuid": "90c088c1-d1be-406f-8a4b-d72d4222233a", "comment": "Malware payload", "value": "da550a4b85c3818f4d37ec2e95f2fdc8ba11f393", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-8466", "colour": "#DBD8FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781188, "uuid": "bbdeb2fe-31ce-4337-986a-bf8c2efd72c8", "comment": "Malware payload", "value": "8eeedb62bf0233e083e06e6768e0201ffde9c0ed5f27d0485903791e835197053d6a7cda9919a934c5945013c3cdf4fc", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-8466", "colour": "#DBD8FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781188, "uuid": "62d545df-76cd-4508-aa43-ccc5bc2e513b", "value": "T1DB073354E89B1CCCB142A03EEEF3A99A5C23D44964CB36E12D4D63DCBB44436AE1FB45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781188, "uuid": "32afa451-0adb-4a49-be2a-0f0bf8f4e596", "value": "393216:4rKjkxVxoJkN7+Mgtap3nSxm6jfqfu1TyvB+e:FkxnoJkNKKiQ6jIukB+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781188, "uuid": "2bd60b94-874d-4f2c-9f96-b85540993293", "value": 16805378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781188, "uuid": "886f32b3-05b6-4df9-ad17-b7d09d467ff1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781188, "uuid": "16e5ebbb-a59d-415f-9ae6-b288de552a63", "value": "\ud835\uddd7\ud835\udde2\ud835\uddea@\ud835\udde1\ud835\udddf\ud835\udde2\ud835\uddd4\ud835\uddd7$ \ud835\uddd6\ud835\udde2\ud835\udde0\ud835\udde3\ud835\udddf\ud835\uddd8\ud835\udde7\ud835\uddd8\u274f\u2916\ud835\udde6\ud835\uddd8\ud835\udde7\ud835\udde8\ud835\udde3\u2737\ud835\uddd6\ud835\udde27\ud835\uddd7\ud835\uddd8#$X__8466.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b236b15c-3ee9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Metasploit)", "timestamp": 1748783388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748783388, "uuid": "b6a2f257-bf4a-499e-9cc0-036d882105d0", "comment": "Malware payload (Metasploit)", "value": "02566ceec4ace80a7fbfd0cadc35e993", "object_relation": "md5", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748783388, "uuid": "be8fe0fe-2df1-4eb6-8bbc-74aff0019146", "comment": "Malware payload (Metasploit)", "value": "59f430d175e3b837b6475209a8edfbefc1c11e196c05e8536e29fc2a481beec2", "object_relation": "sha256", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748783388, "uuid": "f24c416b-5ef4-4c32-b7e6-1331068410b6", "comment": "Malware payload (Metasploit)", "value": "9c7f7f6d42ddfa7895ecb61fb3683bb4c3ec9abc", "object_relation": "sha1", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748783388, "uuid": "6b14c09a-7c13-4274-93a2-501d32716e49", "comment": "Malware payload (Metasploit)", "value": "a23786dc31f4402e71d182b1454266dd9189d2b0f1883b7eed053a662d483240c850cf6d758055340d47c34d4ffe926d", "object_relation": "sha3-384", "Tag": [ { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748783388, "uuid": "a0e6a64c-a22b-47c2-a1c7-90f2985c6ff2", "value": "T1E5642367E152B2A0F449EBF41733824B10323999176DF8F1EAF93BCDB9E2445C926079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748783388, "uuid": "77915583-8560-4861-bc7b-12b694b91487", "value": "6144:E5SqVsT9o4NoHfhoJwMniNlb9V/S4Etf9xAhNKrph9JWdz4poosMs+9UOexcJyP3:E5SqV0NNRwMninRdS4qf9KhQrpm0s+RI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748783388, "uuid": "338b28a8-ee69-4119-9be9-3f1074255844", "value": 333534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748783388, "uuid": "53c41b3f-65fe-484d-9308-15a782b717e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748783388, "uuid": "fba2238e-1012-4471-bc0f-968b18b99931", "value": "shellter.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1368c9c9-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786558, "uuid": "c100557d-8283-472b-959b-55d35470144a", "comment": "Malware payload (Mirai)", "value": "dbeafb98fac305857dc2a2c1e813e916", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786558, "uuid": "7b653253-17a2-48d8-acff-eddffc774669", "comment": "Malware payload (Mirai)", "value": "5af0b2793f4f40f206f6225fbfd174a0c527983410e56a8dd1708e4fac1c4178", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786558, "uuid": "98e0d360-8159-444f-8cb6-36ba1772dc46", "comment": "Malware payload (Mirai)", "value": "63624fec55469866352a475a57815966d5bdb65e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786558, "uuid": "d88df14c-e12f-478f-8bba-c0cd86b4bd67", "comment": "Malware payload (Mirai)", "value": "f45bed8e946349bc0aaf874b8f9c1b6f3c2caf257b0de7319ef0732b44083ed62da8242b2fed5a0fa9f3ca6c90812d8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786558, "uuid": "3b80890a-e9af-4e58-b65a-25563ba45fca", "value": "T170336C36E029DED4C5960134A4E88F751F03F1C883536EBB2AE546B2685396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786558, "uuid": "18a9788c-edd2-440c-a5bc-9b7e23f7ca10", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+ydZCZQoVjfjmCozw:Oa4U7G7SvT6ftBTydZKVHmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786558, "uuid": "64492119-5ad9-4147-8b90-2cc27613de4b", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786558, "uuid": "afbef1c3-ab87-4ef7-9762-70f5c3da6d96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786558, "uuid": "67cea544-7336-4515-b8e4-77a3ea56e727", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4656466c-3ee5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1748781489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781489, "uuid": "99892d15-1fc1-42fd-ad1e-3e07377ebdbe", "comment": "Malware payload (Rhadamanthys)", "value": "b5a9ee473d885913dc46a67afe416f35", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781489, "uuid": "486f2050-bf7a-40b3-9d16-b6a31f527777", "comment": "Malware payload (Rhadamanthys)", "value": "5b00a1db09a0319fae091874306df568c619f954e01d70786c9d469665917512", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781489, "uuid": "c09a87e9-45d0-4b35-a49e-01935b9933cb", "comment": "Malware payload (Rhadamanthys)", "value": "348fc9d332051d13e8cea3c4a31ab66d7e102f76", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781489, "uuid": "2c8ee588-cafe-4f9f-8799-94343f01ea5a", "comment": "Malware payload (Rhadamanthys)", "value": "2cdc575b823ea2153fe838b123d5075317133f2fe1989e99e7038284aeb2ad67eaa6a53163ecbad5a9535f71ba2701b1", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781489, "uuid": "ef5240f1-6bcd-4e39-a975-86b1e4788ec1", "value": "T16E361A3EEB1C1236AA93371E037E30798BA5958532990F0FA1A1CD6D1543474A35FBBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781489, "uuid": "8509f623-101c-4753-9b9d-7f1eef398673", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781489, "uuid": "73cf0156-17da-47a8-b823-6ef804c42664", "value": "24576:/0ad8yer7jzp2a0RVyW72zgBZ8pawaP9MeEWdoEyFV05wSl11RqckyiDOc:/Tijzp2a2VyWXAauezyFV05b11Ic1st", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781489, "uuid": "9e40c876-663d-4697-84d1-655d846f3428", "value": 5254256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781489, "uuid": "802b88e8-c7f1-4b79-bb47-19636504f59d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781489, "uuid": "038b2b2a-d717-4ad8-8f14-27cf82487ca4", "value": "SetupLatest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448e0645-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748798666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798666, "uuid": "93ad2b47-3b18-44fd-81f9-1962b79c71e8", "comment": "Malware payload", "value": "a53fff2c810a5143ad4cf63b222ac23a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798666, "uuid": "32f2accf-578e-4387-aff7-8a670d26c2bd", "comment": "Malware payload", "value": "5b05c20216a256d3873f39cd661fd0e030931265fb42123ddcb04c79a480fd09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798666, "uuid": "1a01ceef-966f-4b66-ab66-a7d3fd6d89f8", "comment": "Malware payload", "value": "8f47377ce8e1a8cb94860bd4ee4bf6eddc4a8090", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798666, "uuid": "23c02848-1d27-444e-b063-0764cc541f65", "comment": "Malware payload", "value": "c4744f1944327b90ce745bb7c27a31b4dc7deef0ede29ffb30c4b0fc16feb9833c165eccf1b52511815616636a4830ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798666, "uuid": "8508ca15-ba94-473e-a7c3-fb045cc87be2", "value": "T1D785331524719C00E776E73F13F9AADF7368EEEECCA2F911644318B8AB469C96146C34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798666, "uuid": "51ad08e4-5080-4b9a-a713-b300f4da2489", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798666, "uuid": "93da795e-403c-43e7-b009-e03d6dd9b285", "value": "49152:0HaQJOeV/046RC09adCEzuy6yhVdQh+SchsxLvs/:O3JOm/v6YSYhZU+VC1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798666, "uuid": "bdc1d65e-1620-4da6-8f02-6eb0b97ed2ab", "value": 1853366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798666, "uuid": "7ca60ffc-8e45-4066-9efe-407b50a8a915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798666, "uuid": "8238f6e5-b522-4210-aeb9-26066abfee1d", "value": "a53fff2c810a5143ad4cf63b222ac23a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dd560a-3eda-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748776928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776928, "uuid": "a5c3c708-5f3f-4a8d-b2d4-ea6859ce8996", "comment": "Malware payload (CoinMiner)", "value": "62189c48a1cf9f0c2ee146dbe1b568ef", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "pw-EYE", "colour": "#5B1860", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776928, "uuid": "00bc974e-341b-422b-a1a6-1137194c1aff", "comment": "Malware payload (CoinMiner)", "value": "5b43fcee4342991868c3c2f84329324fba1b8612f1ed3f92efab618867f1fc80", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "pw-EYE", "colour": "#5B1860", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776928, "uuid": "cd6ffe41-e539-4253-b200-96e7c38014b8", "comment": "Malware payload (CoinMiner)", "value": "d3e02ca010dbfdaa5b13e6478feba9179a442f93", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "pw-EYE", "colour": "#5B1860", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776928, "uuid": "6ceb2e7a-4246-4b04-a778-4445a5bbaad4", "comment": "Malware payload (CoinMiner)", "value": "eb8b1f1844d198d6366a700f8e01def8ad10f67f3e1b04da92db51302557f242791f5abebc23b9eda8bcb15731c6d4e7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "pw-EYE", "colour": "#5B1860", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776928, "uuid": "6dbf6b47-d891-415b-87ec-89ffe116dbf9", "value": "T1173633EC3377FCC21952E236A1688F3E571059358FCC9C2992AEDD70E89213D56B2B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776928, "uuid": "41d362e7-9851-441b-96fb-70895d1c247b", "value": "98304:aTTprkcHr/I/9czPorLPZhtjGxY9I1vLrMzuCz/j57:amb1uofNj10MqGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748776928, "uuid": "acb806a0-c22a-4fb9-831c-c3288f82313d", "value": 4956974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748776928, "uuid": "422fd3f4-f212-4020-94a3-4c390edff8b6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776928, "uuid": "687f9f8e-8344-43e5-8259-d4a38d5c8c6d", "value": "EyeLoader.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b1826d-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Metasploit)", "timestamp": 1748765226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765226, "uuid": "a3f55a9f-cb7c-462c-946d-a2f210a744b8", "comment": "Malware payload (Metasploit)", "value": "ecbce3a6cee8be13a3499e8b69d57ed7", "object_relation": "md5", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765226, "uuid": "79de7f09-62bf-4064-a7f0-e9db3d9e5bc8", "comment": "Malware payload (Metasploit)", "value": "5b9ebd4dbb739ad537f43b577b93deea3f180702c5e0f1073fcfef8a779e6357", "object_relation": "sha256", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765226, "uuid": "9bf9d6ec-9eaf-467e-bd69-5a103121b519", "comment": "Malware payload (Metasploit)", "value": "3db0db6b4e03fc3492b084d5624375b7bcb663b0", "object_relation": "sha1", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765226, "uuid": "94c3143b-4189-4e12-88e1-1890c33bb54f", "comment": "Malware payload (Metasploit)", "value": "64e28fb5df6c6a3c8f0f6237ef2be5e28fa3021c4a1d76cce5c8c0f5593ea7efec4ccae3908e2d94347d472ef18e074c", "object_relation": "sha3-384", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765226, "uuid": "619990be-e2ba-4b39-9f53-a4a22075e44e", "value": "T10D445CC5BBC9ACD6CA044239889B43293738F6D157974F272D2973311E27AE4BD8760B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765226, "uuid": "35710825-5923-472a-8531-5ddc4bf17611", "value": "6a756e5db3934c4fad8741205849011d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765226, "uuid": "c2efe9c0-aaa8-400e-b947-0e084f9b12e9", "value": "3072:zFGlr1ckyr0meVA1JYTys3FzRzHXti2O1qPZg6QSa/ImggX6EeIuiWFEx/eLRd6:klrbR9zRrXgrxT6suN5Rd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765226, "uuid": "5431fcf1-2e57-4213-a3e1-c2d4562efe55", "value": 274171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765226, "uuid": "10df5f7c-7da0-44eb-8bb0-67392a6b6fce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765226, "uuid": "a473e83a-bab8-48b8-821c-1df5eb54ad57", "value": "windowsupdatetimer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f3e7a4-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748765094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765094, "uuid": "d56f8387-faaf-4499-a2b7-42f51133fd5f", "comment": "Malware payload", "value": "c9d25d7dd8aca239428b79be932ffa33", "object_relation": "md5", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765094, "uuid": "f10a592f-eaf2-4d7a-89da-f6aca19d41d6", "comment": "Malware payload", "value": "5c37d283469f0677e1b8247d64740fe88502fa7adb77932996e62568044a77ed", "object_relation": "sha256", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765094, "uuid": "358ed79b-808f-4b30-8897-41465c7bdbb7", "comment": "Malware payload", "value": "10fd576eda16c2f73d5622319c6d2a9d5be25bcc", "object_relation": "sha1", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765094, "uuid": "9361eb2a-2c29-49bb-9101-370cd66c0777", "comment": "Malware payload", "value": "48eeab2e14180385ac4e2d905e5267272be63b303f0590d9c59198aece5ca44769fcf6a96fceaba827cf9a7f2cdd3dc5", "object_relation": "sha3-384", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765094, "uuid": "6d8ff8dd-e34a-4cc8-a41d-ebdaf3056a99", "value": "T14441650566D0C919AF47823DE9EF8D4CB62D816BD8A65D00B45D81C1BF7877C4BD2C3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765094, "uuid": "ebf4db9d-db8b-48cf-ac03-0bb0fb891fba", "value": "48:wQlnwVwZfy4Y5NHkPikQES0pGcGiS9KLgS1zSBR:LwVUarL0vSoFBSBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765094, "uuid": "47251889-1e3e-4cdf-8ff6-ae974431c166", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765094, "uuid": "99b3b124-e2bb-461c-ab2d-0241bf67910d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765094, "uuid": "dd26345a-3d78-4663-8475-db653ae31dc7", "value": "b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce83c403-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748799757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799757, "uuid": "c95c4938-f3f2-4471-9f76-b3fba2f53af0", "comment": "Malware payload", "value": "1595eeb5b2d6a58037312e5483ba5a5e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799757, "uuid": "353a466f-00e2-4e55-a4b6-5015b897750f", "comment": "Malware payload", "value": "5d3c1dde745eeaba48ee0cac0b3c3f5097bf110f1424bbf706121088cd3a035a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799757, "uuid": "295fb58e-dbb4-494c-85fd-46f2f0a92c5e", "comment": "Malware payload", "value": "1e9d3a1dbc31823c292143758717df485372ead8", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799757, "uuid": "c9f027ca-7501-4df0-8b32-6de458a3e5d4", "comment": "Malware payload", "value": "a50b1ce823a101fddb1862bd66b8474a5a44b55c8922b6f3efbb4f59e8a492e90e93ca34a1d287a62cc0e48a0ed1adba", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799757, "uuid": "d48e4a23-a84d-4d6f-9eb3-65b514a23cae", "value": "T1BD5147241EF102FAF673C7B5A7F973F34576FA92DD2946BC118052440622110E4A7E3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799757, "uuid": "e8fc90b4-70e6-47fa-b5d0-a7adfae116fc", "value": "24:8Ayw/BHYVKVWO+/CWaO0l4wzbJ7sHw1TjpcBGlsMbLYmvfdd79dsrab/BiT:8y5a2TmwzbFppLaMbLYmvfdJ9AabBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799757, "uuid": "c5efa0d2-9596-4d66-9bdf-b7217ad744b8", "value": 2564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799757, "uuid": "1687ed5f-7dc9-47fb-890e-bd6f7658ef09", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799757, "uuid": "d795f8e5-f1fc-4d54-a7fc-2c3819a62a07", "value": "UltraViewer.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165c9e19-3f0e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1748799018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799018, "uuid": "2b6169a3-7733-4494-857a-4f80b5e69185", "comment": "Malware payload (ValleyRAT)", "value": "b866a266ee13d3e3b5071e3ca05c9039", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799018, "uuid": "fa57b915-f6c0-403a-8d55-2640aa8dde67", "comment": "Malware payload (ValleyRAT)", "value": "5d89c4426d185c16d25e572efe882afe58d2ef9d660e247b3a23e612e4c94b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799018, "uuid": "937fd8bf-2800-4651-a9cd-7a13a416fa7f", "comment": "Malware payload (ValleyRAT)", "value": "20e39f17e5ba51da15ed7a78f9853e4efb31c6cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799018, "uuid": "941e6c2d-2cf7-4a2b-87f5-409d1bdd9304", "comment": "Malware payload (ValleyRAT)", "value": "dc207a4efbb0048c67ba6554054eb3706fc979e009e2ea11a73730d1476a6ecf6d0209458527995d5580ca063a8f0be7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799018, "uuid": "668412b5-762a-40d4-b29c-0f647918d3b3", "value": "T18055234A93E035F5D97587B284EA02A7D934F8B04B201BFB23D8E52B5E337C46531B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799018, "uuid": "e9ffae1c-997d-47e9-9037-af1d423c9b6e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799018, "uuid": "98e8a81b-4b27-40a4-abc1-63f5229a2aed", "value": "24576:YIzyX89Jjj8QK2YUSBCrrDw11VsAF0U0FTQYbfIbXFjonns0php:CX6JkQsUxQLVX0U0FcYzCVjons0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799018, "uuid": "93e5870b-9534-4a16-90ea-a01dcdc4b645", "value": 1297920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799018, "uuid": "489a76ed-f8b4-4216-b932-09ee41631cd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799018, "uuid": "5376788e-7158-49e7-8603-de739306f0b4", "value": "b866a266ee13d3e3b5071e3ca05c9039.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f358bbb-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806898, "uuid": "38ffe7a0-a953-488e-a0bc-16a8f43c5494", "comment": "Malware payload (Mirai)", "value": "66baa81019b156da53f044975c78e6d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806898, "uuid": "912119c9-ae12-41f6-8163-39124fa9e39e", "comment": "Malware payload (Mirai)", "value": "5dfb15d5ee478622a60bac52dfb7a87432803d1550ea07524fe3cb2e34605eb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806898, "uuid": "82d9086d-9fc4-43cc-b5fd-2ee6d8bb0c99", "comment": "Malware payload (Mirai)", "value": "c862767b6b37faf86b46d14326432c5675ff6234", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806898, "uuid": "c1d9f2df-2cdc-43ed-a861-e1562e2908bc", "comment": "Malware payload (Mirai)", "value": "cf68809b17eac625edfae6fbcd7d5f2e268562669afd4c4f7b1e2047d053c00162c821757a9966eb4cacf57ab5eb6f49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806898, "uuid": "e8869245-353e-4cfe-baaa-982b74d512c5", "value": "T13CA2E115F6DD9592CC8177F5DDECE1CDA522B508422D83CAC748C36F94BA82AB490F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806898, "uuid": "20daeca4-4420-4c67-ad11-7a6ef8629818", "value": "384:MBgagW7L5avOVYcSdUWTqOixGXqkNKL4PLutvyvF7ThQOSyK:bXcSuC8UXqJ4P0Mt1QSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806898, "uuid": "af658ff4-c509-4024-b8d6-d076badd257b", "value": 21476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806898, "uuid": "3b7e0534-1ff2-4b97-999e-df084780812b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806898, "uuid": "84da2977-a4f3-47bd-a1aa-96ed8e8e2d97", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fcb3a1-3ea0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748752036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748752036, "uuid": "6fb10eee-c097-45d2-8121-e51387a195f6", "comment": "Malware payload", "value": "810d42177538ad5ca18d4dd597c00658", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748752036, "uuid": "eef3d4e1-40e5-429b-8070-d3d22d0cce66", "comment": "Malware payload", "value": "5ec174af8a18a5516b8a6e11d8a27481d70df14d1edb67c48b5458ff44df9146", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748752036, "uuid": "3f3b3769-462f-4d68-a427-4ec874ba59e8", "comment": "Malware payload", "value": "7374bbe63c44de9536c22cdc111894c6d4929eb3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748752036, "uuid": "942768c9-3fb7-493f-a2c5-81d77e4ecaac", "comment": "Malware payload", "value": "0ed0319d0e5beffaca58781f945c8bed17b03b2bcd8adf635501a88919a5e896397e62568394d3cb73a6a86749245822", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748752036, "uuid": "b2191fdf-4952-4d19-9840-553a6adb0d4a", "value": "T164547E00B651C136F5F318768AFE9B79993DBD312B1551C363C40EAEBE22BE1793121A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748752036, "uuid": "3baff508-86e1-4617-bc92-aa333b1cc84b", "value": "5a058b4df04da1108ea582b3a3965f02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748752036, "uuid": "0b2e56d9-3ac1-43c6-a605-9a32354dc62d", "value": "6144:WEDFuBN6zANskE9qgfyMEvt93L2kx3W71+KL:WiuB4fyzvtFt3WFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748752036, "uuid": "adc70ab6-35a2-419b-9098-a1f36cb1a968", "value": 293488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748752036, "uuid": "ec943bc1-a9f2-4e72-9397-a7c0e5424cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748752036, "uuid": "619a9f40-07dd-4d65-9150-92b95a249658", "value": "XPFix.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094575ba-3e92-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748745739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745739, "uuid": "554c71f4-cf04-47a7-b815-74224ebc600e", "comment": "Malware payload (AsyncRAT)", "value": "b1163bc9db5df78b0017a8b9b6c75e03", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745739, "uuid": "1c68bbb3-8a67-4862-a075-4ec68c428c92", "comment": "Malware payload (AsyncRAT)", "value": "5ecf60d1a4c33f0ae5766fcb0d5c5ecc177ba11001ffb783f49bdc1c349fbcdd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745739, "uuid": "d138064b-6b63-4ca7-bbd4-b9eff681a89f", "comment": "Malware payload (AsyncRAT)", "value": "106cdd32b8a9631c9eafa3d04be0cff94e63ac58", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745739, "uuid": "1ca2cf5d-7971-4e10-a75b-28254c5b23cf", "comment": "Malware payload (AsyncRAT)", "value": "36e4a3f3b3891c780057995c15108762c20dc41078e25c491a4144619e907d4d92004d2d6539d76bc586cafaa84931ae", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745739, "uuid": "d0f06c9f-23c6-4f02-9a0f-88a441abc942", "value": "T1BB436B4877B00225D2FF5BB45DB17212CE31E5165827975F28F6608B2F22AC98E11BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745739, "uuid": "5a92de2e-8927-4faa-8c6b-473339eea131", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745739, "uuid": "73b41431-4dd8-474f-abcb-66424c4ee0d3", "value": "768:zQBlgZllOrbH51t4ofdkys+wls2AqBwYg9Kz7kbgwQzXJEKI21qxO3hoEM4DK:SbHtWL5DidKfkbgv5DI2oO3AMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745739, "uuid": "0a2453b1-871d-4a36-8976-6f931c2c94c6", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745739, "uuid": "77a54f2b-1b0e-45e7-b36a-63371727a6ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745739, "uuid": "fb45135c-ce7f-42d3-af52-116e7d43c8f9", "value": "windows defender.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5155589-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748798909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798909, "uuid": "47f7e581-7a08-4a4e-bdee-3f7b316de281", "comment": "Malware payload", "value": "7c305bf57094845b2c5154e74e44cb8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798909, "uuid": "9b6f7bae-1e16-444c-a6ab-9db3db81bb22", "comment": "Malware payload", "value": "5ed41d497e0e078f5b622b5f295a91366bd5154c57061237f9983bd5dd78bcfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798909, "uuid": "734af024-34f7-4545-8f66-adf5ebc449e0", "comment": "Malware payload", "value": "af80bf4338f3cac039922867d35871f2ab431663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798909, "uuid": "8e4990f3-8f73-4025-8211-4775dcc76eac", "comment": "Malware payload", "value": "66115271e89504ab57a3989c595ba7f574a7599442d57c53e4bebaf946fb2bd6b5780aa1a5feb4e6e661faad847a2b08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798909, "uuid": "c6ce9261-f331-4e78-bf4e-fb271bf4b2db", "value": "T192C6BF16E2F900E8D5BAD0BCCA575527E7B23455133497DB56A08A292F37FE0AE3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798909, "uuid": "dc6abf49-3a4f-46e0-a72c-615811a40cbc", "value": "37b6975fd92ab187a69ca6f8945800ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798909, "uuid": "12c9cf16-6281-487e-ad09-c949b20423f3", "value": "196608:p7at47TJ7z4OW1pBeG57b0uZhCLJHG/FQTvJC:5atW17zli1b0WELJm/qC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798909, "uuid": "bc656b89-fc67-4b8e-9cf2-9dae93c29f80", "value": 11658279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798909, "uuid": "1464209c-e8fb-4aed-bc66-82bafbfcdcc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798909, "uuid": "55eeda20-710f-451e-8f2c-f8216f389b29", "value": "7c305bf57094845b2c5154e74e44cb8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79760e5-3f09-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748797222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797222, "uuid": "206b3891-5699-4467-bf35-d3cc2c63b9b0", "comment": "Malware payload", "value": "89651a1b79eac206006801eeb5862764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797222, "uuid": "461d65ed-c250-465b-b67f-cf0152154f32", "comment": "Malware payload", "value": "601d2ad6da07d3df8bcdb9d29e79b823165607cfacfcb0890934ddb0ce9c51ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797222, "uuid": "70e8ea1e-d4a6-4d08-b0a9-21c6d58db14a", "comment": "Malware payload", "value": "73fa79da773837c40722f6ae694d19f13e6de422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797222, "uuid": "cec623d7-23ac-4af9-ad6e-ab6d97d6365c", "comment": "Malware payload", "value": "aae9836df0a881559c6b6c7ebce6a1944023b7f0d2d0c8f732327a7923fa56fb00d1d6ef9352f0acdd1d45ce1574607e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797222, "uuid": "23e2970f-1870-48cc-9e63-5fb7e6505823", "value": "T1A3257D0973A4419DFEABE1B7CA13C607D7B178460277862F01A49B766F337716A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797222, "uuid": "f2afceaf-3675-46ea-8bc3-c4edcd23836c", "value": "fadc5a257419d2541a6b13dfb5e311e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797222, "uuid": "7e314614-76d1-40c1-b407-c5860fb8ac86", "value": "24576:drORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvaGp:d2EYTb8atv1orq+pEiSDTj1VyvBaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748797222, "uuid": "e293fdf2-3a8d-42f1-ad4f-f9417c4bd632", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748797222, "uuid": "c5b7bc86-6a8c-436d-aa8a-7fd2f27194e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797222, "uuid": "06b57f80-2a73-42b7-b72f-834c0deb6064", "value": "hjTbbEifA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98787c0-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759778, "uuid": "e657478f-922b-4024-87e7-e58090feee45", "comment": "Malware payload (Mirai)", "value": "e3127512b14ab22a2b125a77741692a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759778, "uuid": "3d5f7317-6078-4c7e-8966-255982ec9b80", "comment": "Malware payload (Mirai)", "value": "604dbe78aaed5e9b871c5ba7f5f3c7280e5d3bec811a1d7fa24dfc9315e75754", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759778, "uuid": "932f63ac-cfbb-4823-85a3-7c5e4e8222f2", "comment": "Malware payload (Mirai)", "value": "72bb9b6865f7fac6e2903e3054e9f5e8a53ab723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759778, "uuid": "6fd6e24b-976d-419d-a10f-fed7cdcf467f", "comment": "Malware payload (Mirai)", "value": "422414be2dfe50dc36dcded7c5909b85eaf24b974795721f51371e2b09195a0e32dde73b43390c4f04cee48de1aa0e78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759778, "uuid": "ed63e7fc-553f-40f9-bcf5-496233d3f57a", "value": "T1E8731A9AF401DC7DF80FD77B4457490AB630E7D116831B67376BB9A3AC721A14826F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759778, "uuid": "e2660df0-7300-4796-90dc-41827f4c8df0", "value": "1536:W1awVRhj8X0VW0/mEuHC3NgHDvf8x1FbhKUnuSZWGYihjHO9gYFVojkzzF:W1awVj20F3EC3NgHDvSbhHZzYWYFVoje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759778, "uuid": "9efb1b13-165f-4384-a74c-5a2408cb219d", "value": 80360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759778, "uuid": "9c9e252f-4f52-4c3e-88a8-fb2fe0dfc53c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759778, "uuid": "0b7c04f9-1cab-4efb-8fd7-6a089d2219d3", "value": "neon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a8d460-3f08-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748796737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796737, "uuid": "5eca2ef4-7380-468e-8617-73712141f1bb", "comment": "Malware payload (LummaStealer)", "value": "60aa6026e8a00734dc7a9a7e8ab8cd3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796737, "uuid": "4946cc0f-a9c8-4ea8-b534-2ca09624fb65", "comment": "Malware payload (LummaStealer)", "value": "608491db37ee9b07fd0f261b8986fe0821ee11bf245f8d2414045eba5102aca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796737, "uuid": "3268ac10-fc17-4eeb-9aa8-3dc85fe7c65f", "comment": "Malware payload (LummaStealer)", "value": "1de098ee51949d8dc472633f389fa4d0342b7815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796737, "uuid": "5a65da30-8174-4641-8e17-af4f4933b105", "comment": "Malware payload (LummaStealer)", "value": "335ccef0d60bb94d131bb6bffdc14c2649345f6d6373e2b739f8366bb3446f787b6c6b7be24bd3444cbe3850063d2872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796737, "uuid": "4c7ee727-cc6b-4f9f-bd23-e451e085b2c8", "value": "T1AD960201BE828472E991027549BAE37A5A7DFE100B2146D7E3EC3BAC1E703D17B35796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796737, "uuid": "23eb9cbc-865e-43fd-b233-ca9d09f11b71", "value": "52d6367a47f23e19cf705f3c443a048b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796737, "uuid": "0f4103fe-6850-496b-b56a-6f8f85730566", "value": "196608:wK2+ofOtWJbQU+6+iG0d/nmINcvQaH0utg:B2+ofOtAsI0ISvEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748796737, "uuid": "2204f669-808c-4dff-ba5d-5a286fa82b00", "value": 9325072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748796737, "uuid": "c5cec1bb-851c-47f9-ab5e-1340f20114e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796737, "uuid": "7d2f5bef-2031-4332-8b2b-2d5b5f57b6e6", "value": "60aa6026e8a00734dc7a9a7e8ab8cd3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ed6cc0-3ec2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1748766678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766678, "uuid": "d101844b-074f-4666-9f26-fd335932fb74", "comment": "Malware payload (Rhadamanthys)", "value": "bdf1441521bba08231d3f130528e2271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766678, "uuid": "07fba98c-07a7-45d2-ac78-9956a7f5252e", "comment": "Malware payload (Rhadamanthys)", "value": "6121afb75497dc965a57f4e9e7e9c7a90c22d5a2c12d03f1441674b964b89d23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766678, "uuid": "23c03ee9-0bff-4b74-80c5-bb4f6227f253", "comment": "Malware payload (Rhadamanthys)", "value": "27a8b6834cae691e5d36ef4c9263f415f8287f6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766678, "uuid": "3724546f-c9de-4e3f-9912-362a74cc2457", "comment": "Malware payload (Rhadamanthys)", "value": "89f53c3fb691527e32d927e569c2583c5fe83a6316eaa28682fdda614a1032d9a891bb14140683f56719c5e0c91fabda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766678, "uuid": "0aa0e062-eed6-4fcb-a8e4-264c8fed7ce3", "value": "T18836335A1EC82A88DC8DA7B15152FDACB1B61F9817EA8C4D42D8DBDF7E93F503831601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766678, "uuid": "67f70638-f1ac-41ef-8a0a-386df0a78f98", "value": "7d746b91e1e57b358f148ed3374f0079", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766678, "uuid": "761c149f-b602-433e-b183-862117d9052f", "value": "98304:tWLm6vmckUFMI5q4zGkUxU1v3IDJEIydehW9Z7OGGOtStCGRDcFPW5rb6ggLfi:ILmtcBuYz4cYDJEICOaZ8OIUGRDe2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748766678, "uuid": "9490b34a-c35e-4b33-85bf-e07baaf2cdf8", "value": 5060096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748766678, "uuid": "4fdac203-97e5-4dff-925f-dc11c4e0738c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766678, "uuid": "0fd9ae0e-6126-450e-a9e5-cba784555831", "value": "SecuriteInfo.com.Win32.MalwareX-gen.32466.22644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6daf9019-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806896, "uuid": "18a179b3-100e-4cb4-bde6-11d93d760ff0", "comment": "Malware payload (Mirai)", "value": "af78e64326ca28b01f1dae74d79a97c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806896, "uuid": "2b859652-92a1-4976-891e-a3812759fd3d", "comment": "Malware payload (Mirai)", "value": "61ebadac710dadb68272a7457030243cd58b5c5b243ba65680be21a635b8d97a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806896, "uuid": "acd5dff4-8cfd-4e97-837c-16b001a613ea", "comment": "Malware payload (Mirai)", "value": "a8970c3d8a551f94a92062d1c7e2637f6ff91f6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806896, "uuid": "52a5ed18-cec6-4480-93b2-f9634ad0afe4", "comment": "Malware payload (Mirai)", "value": "aa0580803015020c04d0eb9d3ac0b4ade68c3eb97ef0bdd9e31da7971b4a3955d0300149f5f6af723c081ded2f918a03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806896, "uuid": "f655d68c-652c-45f6-8edc-7e47fa6b81bc", "value": "T13F630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806896, "uuid": "006e8069-b2ec-4520-a86c-508a23401dd2", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806896, "uuid": "2e44a7f4-53e2-4d92-aa45-28fe4d18c48c", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806896, "uuid": "fec04137-79c9-4b9a-9491-bf4f63abcb56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806896, "uuid": "93cc5be0-3ec0-47fe-98ed-bf30dab00b9e", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30aecb9-3f08-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748796758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796758, "uuid": "1350f0c0-b573-442a-b719-972b94f6ec6a", "comment": "Malware payload (LummaStealer)", "value": "9d455384476314bd29b9e940a9d55f3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796758, "uuid": "b2703b60-b4c4-4820-bf2c-7089fa6fae6a", "comment": "Malware payload (LummaStealer)", "value": "6223e8d6fccca47c261c2ac55fa4bea355db0a2cfd0f31d21b8cd171fbd97645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796758, "uuid": "243f978e-dcf5-466c-bced-a20a1ad50de4", "comment": "Malware payload (LummaStealer)", "value": "b67b55999bbd25461fb81320ce22d891c3ae95be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796758, "uuid": "e47c64d0-f2b4-4c34-960b-67c921e5850b", "comment": "Malware payload (LummaStealer)", "value": "1b15d6645b10121d877264c0b302d467d65420e8e70f2f15b21885c298e8fa0757beb1311896a833eae7ba6bbf392e68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796758, "uuid": "40a27874-a141-4e45-b490-207e45d6e748", "value": "T12DB64B356B1002E5DB431AB94E07E3F5BA6C9D20632114DB62CE7A47AA634DC4337E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796758, "uuid": "b51267b3-2274-4d50-b9f0-851b53f377aa", "value": "fd044d6469cd3b63465c9654f134a3bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796758, "uuid": "925beb00-db03-43dd-9c39-07d619f061e6", "value": "98304:yUiPeWZKm6oO8hphZsYzctxIll9OSo3ZuMdASNR:Log8hFgkll9OSkZuEAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748796758, "uuid": "fd743fd9-01a3-481d-9a7d-820bb473bd59", "value": 10869971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748796758, "uuid": "4e526dbe-020f-4729-a8e0-c875571f7155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796758, "uuid": "8c8bd3ed-8555-4944-ac17-6d27e63b2e01", "value": "9d455384476314bd29b9e940a9d55f3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8191ecfd-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748786313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786313, "uuid": "638b6ecb-c8d1-4d18-8e6d-4c79c7d675a5", "comment": "Malware payload", "value": "5be83ffbebb0cd135ad2a12e3e3d9255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786313, "uuid": "6be609d8-18f6-4db6-a5a3-8a6d626958c1", "comment": "Malware payload", "value": "629721be47e024e1823475963e64d8f3251e7d0a7f0f968f219ad1d18bfb00f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786313, "uuid": "b44c745b-1926-41fc-bd5f-ec43e44df140", "comment": "Malware payload", "value": "4e6c4743c8447168f63f46d4356023898511d578", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786313, "uuid": "cab91197-5c5b-486c-9fa2-88daeecd0758", "comment": "Malware payload", "value": "7d62b9677f791f1ea56d6c822529407bc8f17a890f8625883c53798269da9ffcdc7021353ed3966858ae0ff306af2077", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786313, "uuid": "2f72a9f2-aa8a-40f6-af20-cb6da8b897d6", "value": "T186F41213B3C30031F5265A35CC76C044AD2779B949F0606A2EF9EB4E4EBA6C69D77B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786313, "uuid": "29bfdd08-a71e-47e3-81f4-36b23db32f68", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786313, "uuid": "877d87fe-f33b-4a71-b4fc-2c0bf47fa094", "value": "12288:uaHc64b888888888888W888888888888oscV7/9GqeMo3KM5oXM33rD+zG/oBidf:F86JjW7/9oKTyezG/aYFkJR30F6rp8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786313, "uuid": "daacfc9f-b4fc-4b87-9245-a8ebac8cd330", "value": 755304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786313, "uuid": "69b35228-6309-4ced-a39d-ab3f5b819858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786313, "uuid": "0293f20b-65e6-429b-9ab2-e7c359889e97", "value": "GitHub Actions 2.283.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03dc020d-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748786532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786532, "uuid": "35e15643-810d-40e5-ac2b-3f078f7c5d1b", "comment": "Malware payload (Gafgyt)", "value": "b186c3d1a75db7b42ae04ff9fcd548fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786532, "uuid": "f3130218-dab9-4fa4-8535-895e82346100", "comment": "Malware payload (Gafgyt)", "value": "629c8296a0c22dfe4825ef0231b8c1be1ffea32d44ec68f42de9bf7ecab69078", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786532, "uuid": "66046996-0625-4a89-a47d-a578fc576c06", "comment": "Malware payload (Gafgyt)", "value": "09345ad70f6557cd9f303396f5c99f5331fed883", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786532, "uuid": "41997861-df8d-4e78-a893-a67b7fb4a474", "comment": "Malware payload (Gafgyt)", "value": "e1da6ec9864024594ef667fab01fab69eadec9694ef52806731b68d53af91c6cf16aebf2f400a47151a0707f6dfe6d59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786532, "uuid": "225f6ce4-cd1c-44f3-9386-aa8fb24c42df", "value": "T1E5D3396BA61C0793C45789B12DB733E097AAEFB304D621C5E41EBE805B729752236FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786532, "uuid": "615032da-a474-4d2f-b5f4-6948acc02cb4", "value": "3072:2JwVD93OAKtIXQCvsetJ8add9QzxsGws6WIZ6bqKQibhgBik:2JGDJOAKt0QCEetJ8addQ3gRZ6bqKQia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786532, "uuid": "2ff1d905-0452-416f-b59c-28a32961835f", "value": 138048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786532, "uuid": "7f0167b2-285f-4b29-998a-536ec1f69c6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786532, "uuid": "945b7374-02f4-40ce-a4f1-5cdf1be90b8b", "value": "cron", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7c41e2-3f08-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748796772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796772, "uuid": "ba1b34d5-815d-409a-b4a7-d96668dcfa2b", "comment": "Malware payload (LummaStealer)", "value": "adefff5111bff19dd01ee7759e4a650e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796772, "uuid": "17bd3fbf-648e-428a-a421-94006e5cc4f5", "comment": "Malware payload (LummaStealer)", "value": "634a512b09d0ef806aa64b9cc8c3ff8e0ed4d93e460b142e9a59c83e293bbf7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796772, "uuid": "2588f2c4-613d-4dbc-8525-c6890e5541a7", "comment": "Malware payload (LummaStealer)", "value": "a14edc8ad157f286104991eca1e45f7e8f0de94a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796772, "uuid": "f4ef9b36-9569-4d37-bf73-3d1bd0f46cba", "comment": "Malware payload (LummaStealer)", "value": "0ebbac233a6276da9935bfeb9bcddfb4b2c93102191c75b4f84d4a27d164637f18cea045fd948ff0a6f834c34e16e1cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796772, "uuid": "c4385ee2-d0c4-4c67-8dff-51056d0ae894", "value": "T1B3D5F158115D22D8FC344D7B450CBAB2666A0E603A460E9E65E8BB9FF7B3781C43E353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796772, "uuid": "8d81c1bc-98fe-4b36-9737-264d4d2db47a", "value": "ba6dfbcc38fbaf057b0509ab9d75a796", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796772, "uuid": "742cac58-b25c-4a6b-ae36-a1f67d7134ed", "value": "49152:CtF9O+PG2xr6dm9v8r0eWTn+xs+kygkdbJ4Hu+WAtxdpkSyMgMtlcL/IW:Ou+uK2dm9vS0NakVUmHuGTdqLMgqlC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748796772, "uuid": "85cc57f7-2a3a-4707-9159-12f6994944e0", "value": 2940416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748796772, "uuid": "0dfb6bac-75cb-4d77-8f28-39314e1814a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796772, "uuid": "d94386dc-1475-486e-8498-8015b3f491c5", "value": "adefff5111bff19dd01ee7759e4a650e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c7d664-3ec2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1748766666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766666, "uuid": "c94e22cb-6922-4bda-952e-2fbf79fbb465", "comment": "Malware payload (XWorm)", "value": "d49694ed230c61fb55910fee06cdfa4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766666, "uuid": "6029a247-d120-4c7d-9a59-4bd58a14bad9", "comment": "Malware payload (XWorm)", "value": "636e66f5ecbf7f358ea5eb04daa54ba5c75df148eb1555bf95b2fb58b49ee6d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766666, "uuid": "00f95c89-fcc7-42c0-8113-5ddbe276eac5", "comment": "Malware payload (XWorm)", "value": "fefd97db4fd7792bebcb10f3d3b7680c0fe902ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766666, "uuid": "66e3825b-d907-408a-ab83-f7f3c9d0a697", "comment": "Malware payload (XWorm)", "value": "5a645b0dbea9b9c6d029a5de34c2e8b724b7a55469f9e038439eec88cb77f30df4b0c4d7ee26002e85497096c504bd28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766666, "uuid": "520cbc83-4a28-4004-af47-362576b78387", "value": "T12814F491CE49548BDC359F31E2B0F7A90B7BEAD0B8D99FA8206D3D3D7C949409802779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766666, "uuid": "dd2acbea-f352-44ee-a717-9215603402c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766666, "uuid": "cbf45ee5-6c82-4d57-80ee-ebbcbd3480d7", "value": "6144:+bVUiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWVm0jVLVVOVVUVZVVVVVjVM:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748766666, "uuid": "bfe24757-d9c3-49eb-b615-c09ed0db2d5d", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748766666, "uuid": "d87ab036-49cd-48d3-a2fa-63f6ed7bcdb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766666, "uuid": "957aa8ee-9d4d-4b55-a8fb-a2147f692bbc", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.154475.5901.32740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c39d6cb-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786546, "uuid": "eca665c3-eacc-4192-a828-89273643517d", "comment": "Malware payload (Mirai)", "value": "42626faf617d265d472e6e54bde2f722", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786546, "uuid": "14e65841-05fa-43cd-96b7-8a16279729d4", "comment": "Malware payload (Mirai)", "value": "64775a489c988d888c388e2941f39e297d2788b404fc23ebc502f5c1e8ce3b5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786546, "uuid": "17d4ddac-4054-40b3-8ec1-216bad48b43a", "comment": "Malware payload (Mirai)", "value": "c7bc042b589005fd4c5587a72d644f298aa6f40e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786546, "uuid": "461e856f-fe4d-47a8-9fc8-83146e583294", "comment": "Malware payload (Mirai)", "value": "2d6546c6c59c4442cc02daadf27da24110e98be58e6929cc43b22ebd041511f1af03ec19447cb776fc8620ac68f656c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786546, "uuid": "0fbc1249-cf54-42f7-baf1-d1d3388c6d60", "value": "T1A8530280B7695A94578044B79C984E58FEDA4B7C80F3B4638692CC2C67F0582E37CAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786546, "uuid": "b2b248af-8125-4dad-b9d7-5d203e4db4e2", "value": "1536:neaMB4FaF1NvoZ2crDytRB6L4nLBEV2A3Uol:nfMBrvyDybIL4nL+Vr3U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786546, "uuid": "ffcbae5d-b152-499b-a8e8-d7db40ec3a1c", "value": 61032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786546, "uuid": "14504fb6-3d24-4b96-bacf-59c5d0a38aab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786546, "uuid": "e421d020-e920-4452-b00e-f9ca712ffd7e", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc67ab4-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759547, "uuid": "a984a99e-40d3-44e3-a05e-fa220a11c1fc", "comment": "Malware payload (Mirai)", "value": "f33e3327f0ac39e481a9401f349749ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759547, "uuid": "768d1e2f-bdbe-4d6d-9663-dcb097523069", "comment": "Malware payload (Mirai)", "value": "64d0733085d87dc3ae1538b3eb32688c4de5faea864ae9ba8a09ce4b55f0bdd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759547, "uuid": "963953c6-39b7-4ab2-8186-4cc79ed31d54", "comment": "Malware payload (Mirai)", "value": "5ddfada61290ea1c176ce4307c5f26e2e32fbfa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759547, "uuid": "1df57046-5417-4fee-abf1-bb50eda010b3", "comment": "Malware payload (Mirai)", "value": "55483f685120cdc717096de3b49dcfe3c0d11c9495ac00ef94ff26b41eb0062ff68d03118dcdfc1fcc49ab501c8e6703", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759547, "uuid": "4f3be46a-5c46-4601-aaf7-e23313d17520", "value": "T15B14E70AAFA10FFBD8AFDD3706A90B0229CC544722A43B357674D528F54A64F5AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759547, "uuid": "228baf9b-9c0f-4d61-9359-335505e2bcf0", "value": "3072:vrkkEdyP4Y85mY05MCXeQ+KrJq1pybOUc4:zk5dyAYsmTMOeQbksOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759547, "uuid": "64eff914-4af5-4662-b104-28a8aed84ed9", "value": 206344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759547, "uuid": "1405e635-b6f1-4af2-a5de-e275f8af0a75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759547, "uuid": "52eba94e-7c42-46dd-b5fd-a12b478f043b", "value": "neon.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d10ebf-3e96-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748747617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748747617, "uuid": "9f732d0b-7e1d-4d66-82ca-b0101f5e0def", "comment": "Malware payload", "value": "67ff46233f432ba0a0b70145ea307cc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-kodawxxx", "colour": "#9FB626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748747617, "uuid": "f9649658-9fc2-46da-8469-5f98bbc65e21", "comment": "Malware payload", "value": "66454518430e1931d0a87ee7d5c59816ce64261725c271afd7b9a1a3f7e0b5c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-kodawxxx", "colour": "#9FB626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748747617, "uuid": "384a8abe-62ff-44a4-86f6-a33544517a2a", "comment": "Malware payload", "value": "8d39c4727b1d3be2e82488d24024a6eb75df580c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-kodawxxx", "colour": "#9FB626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748747617, "uuid": "6379aed8-bebb-4f80-88f7-9cd456f81dfb", "comment": "Malware payload", "value": "b27cec099318855426ac4747eb57da7de88594eac434398bd15f4c74c56c4bd5cf60ebe5184f4255b51503ee31198b60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-kodawxxx", "colour": "#9FB626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748747617, "uuid": "5f125382-df32-4c5e-a569-fff6bfca5fd7", "value": "T1B7739437DB1690BAED698436860B1D05BBB9F88943605BC767CA0CDF0E657F49E3A301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748747617, "uuid": "46655a06-5b56-4598-84bd-dc2bfd0e7283", "value": "16e425ea6fec3acd91cd254b59c9d5c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748747617, "uuid": "7bbb0f72-80a6-4be9-b20e-f71a3986b2b2", "value": "1536:E8d+mmqixFCFHtif8MO8p5d4xFIxBG9vCHG:E8Qnq2kFNif8MBkxFIxB2vCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748747617, "uuid": "ee6779b3-40f6-4ff1-9563-429ad2f1ee90", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748747617, "uuid": "3b4f1528-212e-416e-9cf8-621ceab30f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748747617, "uuid": "fbdba29f-27ac-4d99-8c87-edc44390a6e8", "value": "Cobalt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9ef4ec-3f11-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748800475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800475, "uuid": "b834c799-4c37-4d14-8dfc-4dd9d12c08c4", "comment": "Malware payload (LummaStealer)", "value": "bd4f2a6a03f8c0ca2f7ce886cbda1fc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800475, "uuid": "a0fecaac-1b70-4021-8ddd-a86fac480674", "comment": "Malware payload (LummaStealer)", "value": "6688df50d8f852b1190ccf68bff4be905cbf433080b2a02550a7c9050632ef7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800475, "uuid": "a5f2474e-e532-4056-971a-ea819ccfa261", "comment": "Malware payload (LummaStealer)", "value": "a4727f281eb4c33691af18a8ecaea8a3a416b9fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800475, "uuid": "d0a88db5-e94d-427e-ae3b-511d9cf1507a", "comment": "Malware payload (LummaStealer)", "value": "292aeba3ffaa4cf4d3edb8c98845d086b7f7e1896f15bca375e042364a5ddb456acbe8c7bdd19f35fa7154e82a1a439a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800475, "uuid": "91df84e4-f944-4961-b0b1-605e3e9d0a0c", "value": "T1FE95331528719C10E779E33F42FAA7EF3338ADEECCA2F91164436878A657AC96055C34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800475, "uuid": "8fce492d-a6c9-4b7f-9600-13a7790e50d1", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800475, "uuid": "e7a86303-53fe-4b32-b70f-0922444296ff", "value": "49152:0HaQJOeV/046RC09adCEzuy6yhVdQh+SchsxLvs:O3JOm/v6YSYhZU+VC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800475, "uuid": "28cd1273-9589-46ab-bf65-c3648b683338", "value": 1906688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800475, "uuid": "b4da27b4-a287-4ac2-9f06-e74568c7fcd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800475, "uuid": "2ad62cad-d26c-43a9-8f8b-fb134d868c84", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319a5470-3e83-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748739364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739364, "uuid": "52eb0a7a-38aa-4545-9ded-a6881289b3d1", "comment": "Malware payload (Prometei)", "value": "3d2bbfd66baeb286b3fa0a561ea635bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739364, "uuid": "f02bf08c-72a6-4138-bc30-ffc8468c12fa", "comment": "Malware payload (Prometei)", "value": "668f9e0a977fc1897ff39aabe6ea21a895ff68c21a4d1d7b02a12cc6e220f2ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739364, "uuid": "b44e3cdd-5b2b-4145-96b1-b16d892fa77e", "comment": "Malware payload (Prometei)", "value": "fe92d95d0052ce83204591249f2c0c4ecdeedee8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739364, "uuid": "c251baff-2c27-433b-afad-dae93a9072ed", "comment": "Malware payload (Prometei)", "value": "a7f20f39f39bb403b8a879926991835360b4874ca82d2966f319a4045a78c81502f793ecb0173a1e4b8cc346c96f92d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748739364, "uuid": "3563bd5b-54d0-4d97-b7a9-d1f228a78c21", "value": "T1CF9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748739364, "uuid": "e4e215c2-528a-4f82-bebf-66f4110a7222", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgX:25WOSACZSV6eKRH5EPiamb4DsDwwcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748739364, "uuid": "e27610b2-4f7f-409e-ba87-9e0a0247e6e0", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748739364, "uuid": "6ccc0146-3698-4486-9eab-dfb6c3d4dcf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748739364, "uuid": "f076f587-1beb-42db-8dc2-91149da7ce8f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95595685-3ea9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748755852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755852, "uuid": "3b9e0100-95a8-4bf9-ba5d-726d9b05bc43", "comment": "Malware payload (CoinMiner)", "value": "fae1ddef6409b0316f1052c41f02e212", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755852, "uuid": "94bb3bd1-4779-43d9-a4ad-490a8a2ca339", "comment": "Malware payload (CoinMiner)", "value": "67912a6766533a444eed4d57ff14466fd08f17db4f43659853429c776c817c90", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755852, "uuid": "6560c385-6e38-4c2c-9462-7fdd4f54c041", "comment": "Malware payload (CoinMiner)", "value": "38baaa4f0de3795157af8fb1146b2854a5908fa7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755852, "uuid": "8646981f-3903-4440-b26f-f39f994e28ff", "comment": "Malware payload (CoinMiner)", "value": "e64cdddf9f133b53f3444bbcb640e40898ee2bcb3606577a10b386c5f9e22339aad239e068e4da5a589a3b4f60ddadc2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755852, "uuid": "8d97a14c-0318-4c5a-9764-f6dea14405cc", "value": "T1E9A53343C9E0EC5BE7674DB13CC8D13AEF77670118D18387637AC6673BA12C2A46A1A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755852, "uuid": "24b96945-35dc-4b6e-9f52-c99409f70e0f", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755852, "uuid": "2238d73a-b2f1-4c36-b252-7791ec40ef98", "value": "49152:FegTPGb+3sMd+ZCklncvH7+vbVKY6fjtj+SLMBc4yD469K9:F/OMs4kJU+vbIRjxfMlyV9K9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748755852, "uuid": "7469e7a0-55eb-4697-a675-af7d76f4909a", "value": 2180533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748755852, "uuid": "5c24f4c8-384a-4513-9e89-73e47959dae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755852, "uuid": "46cc966e-e28f-4a52-8db3-e7c997282a5e", "value": "InsightsBuildings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea539e3-3eb7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748761639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761639, "uuid": "ac3b9646-eb0a-4739-a746-0895c2665cdd", "comment": "Malware payload (Mirai)", "value": "1becbf92db4cc44605f7f5bc38f54893", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761639, "uuid": "3e79bfd6-5257-4854-b252-1916df0e3bf3", "comment": "Malware payload (Mirai)", "value": "68b327f2681199048223c1643005dde7006fd03a877feec5e782ce422211ebd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761639, "uuid": "e521af28-336b-46ee-89f7-97d64df292d8", "comment": "Malware payload (Mirai)", "value": "ca4f05eeb214e347f8b0d09c5f6557512e8b7d96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761639, "uuid": "a44d48e1-359e-4b79-9476-e0f2872c2dcc", "comment": "Malware payload (Mirai)", "value": "f1eff5d6c49d04f0e077806fda10d7e6f3d247ff0bebb49e992638606a9949af958336ac76296bcbcd9e481f6f8ce600", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761639, "uuid": "825ac68f-82cc-4cb1-838e-d9f35e95320f", "value": "T14DF30946F9819B15D5C112BAFE1E124E37231B7CE2DE72029E246F707B8B86B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761639, "uuid": "9042e962-03b7-4dae-a5e0-5a4ba5613367", "value": "3072:f4zMiZwe3RWRl48wrtX2PbzratlLpzEr1KNv5AOzyJDy:Q3wGRn8AX+b3axaKNmOzwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748761639, "uuid": "9091d402-43ff-40ae-b57e-8a93e1f301c5", "value": 166588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748761639, "uuid": "3b317cc3-9177-4240-81df-12ce8c435a8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761639, "uuid": "8a5dc138-29bc-4e40-89f4-d65b4253558a", "value": "neon.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0130ba8-3eb4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760675, "uuid": "4ce0a15a-de2d-40c1-8cd6-05cfe07d812b", "comment": "Malware payload (Mirai)", "value": "611da6d555f8e569d21b6b839937b8fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760675, "uuid": "365fc3c7-00e9-4ed5-8694-97f145a3403f", "comment": "Malware payload (Mirai)", "value": "68cf4d35aadd30e93cecc51dc42a2d86224debd284c6252cc320068e5dd3e47f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760675, "uuid": "bd826a96-d8c7-4474-a151-9e6a3f3bf7d4", "comment": "Malware payload (Mirai)", "value": "e471e788a8e61d539060bb926ed355e869e6b874", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760675, "uuid": "26e1af9d-3155-4b95-b0bd-3afec915f98c", "comment": "Malware payload (Mirai)", "value": "5ddfa7fc6e4eed4a6bcfe3f095a71fc632e8904e63a4402493d7face2c95fec208b59219e12c1a56a1d5869c00a00028", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760675, "uuid": "7df1c9bf-08ce-42fd-a0d3-c4532e3147f5", "value": "T1BA233BA6F440ED7CF85AF6BEC1170909B620726441A31A37A7B3FD839C331A85E6AD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760675, "uuid": "adab26b8-345a-4b7f-976b-1ef764cd3130", "value": "768:d0BCkwNUhLPPZAivKWmSstIo1P/g0KGB2T5uY9eDXMFxJ+uRB0c8yPshv:y1PPZAODoa0NwT4YkLYxJjRBp8cshv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760675, "uuid": "007355bd-7d43-46fd-930a-99ffe22d4a55", "value": 46488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760675, "uuid": "533b27e8-8db3-4ea9-a44d-9b07240b364e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760675, "uuid": "628dd611-25cd-4dba-ba5c-b53fd33006af", "value": "owari.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4d3107-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806890, "uuid": "44a131d6-62e4-4e5b-9cb5-c60101420e88", "comment": "Malware payload (Mirai)", "value": "c11509bad43cd2eaccef92819afd4c01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806890, "uuid": "7e689c00-37e2-4029-ba92-c4871e6cb995", "comment": "Malware payload (Mirai)", "value": "68d2af97f7425190da4ce45a73e4a4827709fbf052296ef7011bc8efca96a266", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806890, "uuid": "bcde0a89-5932-4bfa-a2c3-798522609288", "comment": "Malware payload (Mirai)", "value": "8740b529b7ccc44c29d5265986a609fc269d1a23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806890, "uuid": "a7486a6a-83c9-4a8c-a610-3b4bdd9347a3", "comment": "Malware payload (Mirai)", "value": "d0f9430e87feba784382ec7f968c536ab2664183adef9212f45844449b00bce6639ba9ea04f661e3a1f306bc185a78f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806890, "uuid": "6a3401b7-4f0a-4849-96d8-618104d9b966", "value": "T1E5A2D11172A32D66E3ED1C3CC96E8357B9671BFC80F6327579456620C90D24B3E39A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806890, "uuid": "487dced8-efdc-4ab2-8edd-0dc66400a2e5", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjhgu4hymdGUop5hy:vvQn4j+ZO5fKAlxJ4s3Uozs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806890, "uuid": "03e0f67e-70f4-4afe-ba12-a229d0d6ecfa", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806890, "uuid": "5b8d488e-b6ea-403d-8949-3e0474f6d90e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806890, "uuid": "5edfdff9-d10b-4a64-9384-326097188ca9", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b248e5-3ee5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748781678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781678, "uuid": "1d1ca371-c234-456e-9002-58a945bde3d9", "comment": "Malware payload (Mirai)", "value": "39ef980574fbb5d26268ed7f66b2d3fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781678, "uuid": "55c02599-368f-4627-ba1d-01ea956a93c2", "comment": "Malware payload (Mirai)", "value": "68d3ce3bced2498629bf054631f78332f8b68f5df7fd6c9879da05059024f688", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781678, "uuid": "dd8ed45d-8beb-4640-8d5b-bb5db6bb282b", "comment": "Malware payload (Mirai)", "value": "5d261b96425b02d130c32ce4487345a066f4d678", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781678, "uuid": "9dd0faba-5157-47c3-80e8-ae5800e70f75", "comment": "Malware payload (Mirai)", "value": "cef04e56f6a1488515af87102b0bec5a28f0aa6125bab909bfdd74b0125794f05ef4b44605adf446c39205389d2a05c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781678, "uuid": "600405e3-5d12-46a3-a88b-730a947c8050", "value": "T172E33A02731C0A57C1532EB03A3F67E193EFAAD121F4F680255FAB9A9171E325586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781678, "uuid": "b47ab01a-4684-4da6-acca-0b9be14f9c7b", "value": "1536:1vO/R1sY3broTs0IjgdIxiYO5xRBq1Ne7ZN77GSSlvAK8vr1J/gZqiT0vvpqv:mbjWIxkxq6NHGKKbKvMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781678, "uuid": "bc7a239d-1128-45f0-9f09-4f40fab36fe8", "value": 150484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781678, "uuid": "fd3330df-6752-4c77-a84d-318d14e4783a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781678, "uuid": "a70a225c-3b10-4cbf-b9ad-ad62739a1079", "value": "navo.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c13d258-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748765205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765205, "uuid": "6a5f9cbc-a235-417a-9bc9-6a53ed939579", "comment": "Malware payload (Gafgyt)", "value": "ccd9c66057f9d1e26f7641c081aa5169", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765205, "uuid": "507f32a4-3ec5-47e5-8f4c-468258e793ce", "comment": "Malware payload (Gafgyt)", "value": "69381739ee97ba4e1d72e5296ab75c19077f865343f4ecdd29a046ec19bc0e5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765205, "uuid": "16f1aea8-e188-4a24-a2bf-aa2c92fb4bbe", "comment": "Malware payload (Gafgyt)", "value": "8ea9069f94b4be17fdf36f3835e4c45707cdcec6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765205, "uuid": "37d35e8b-c9a1-4f4b-9f31-e813da714c10", "comment": "Malware payload (Gafgyt)", "value": "67a5c08d911f6d6a3a4d3df96e2661cca8e343803b6946bf3885633d454bdabcc2ce00b7e11f83f1486587d80e6dc7ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765205, "uuid": "55d69bfe-6ec5-4826-b2df-d1a8e3c9db03", "value": "T12DC32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765205, "uuid": "9542144d-23d8-4075-88c0-5868b06c9fce", "value": "3072:ekYPUfsgnsb0J2ag/VfakDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0akDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765205, "uuid": "20ac748c-b1c5-4959-b7a5-ad61f6f6e299", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765205, "uuid": "da521b8e-8b5e-4a46-9638-8ecbd27cf22d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765205, "uuid": "e7ca4174-52c6-406d-a145-c5cc86c04bb9", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f3fab6-3ec5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748767897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748767897, "uuid": "2f4adc69-dfc7-4bc5-9ef4-095f92205992", "comment": "Malware payload", "value": "862a5399ea95a8381034ee4850e14b02", "object_relation": "md5", "Tag": [ { "name": "bookneg-com", "colour": "#62E8D6", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748767897, "uuid": "62d2b417-9c8d-493e-95f0-e4f6ca82f324", "comment": "Malware payload", "value": "6956b1dac18fcd13cc66ce1dec2977e19c917f8000ae2b64960c97f5acaeb48a", "object_relation": "sha256", "Tag": [ { "name": "bookneg-com", "colour": "#62E8D6", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748767897, "uuid": "13d2f01f-4ec3-4068-a824-dfcec7a1bb49", "comment": "Malware payload", "value": "9570a0070a8cbc65f71a4b5698e04c9a13870346", "object_relation": "sha1", "Tag": [ { "name": "bookneg-com", "colour": "#62E8D6", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748767897, "uuid": "b9fa4b3d-f6e5-46d9-a874-71394093bb66", "comment": "Malware payload", "value": "225b6b13a6c798d8d5618d12f7cb98c1c2e15cbbbe972af11b9433df8245888a1a09e83b18246a76005333e649cd13b6", "object_relation": "sha3-384", "Tag": [ { "name": "bookneg-com", "colour": "#62E8D6", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748767897, "uuid": "ad125794-ff72-4c42-ada0-d1faeecf17b1", "value": "T1FDC08C27CADA1A6D6A2FC30956682950009885F89F42FA48B9569A84A3816070206DEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748767897, "uuid": "4d6f1e2d-dc95-4ab9-97a5-a4764dff78f9", "value": "3:1QbHywqywzL9BnunmHAi2LuFxvcdnb5KexTcXgW2LHXHon:6y3NzBBuwAuxvcdLFmgP3Hon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748767897, "uuid": "8ab47266-8007-4506-824b-6b9cf23e36b0", "value": 150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748767897, "uuid": "9f87ef4a-3b80-413e-bd6c-51aa9c154ae0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748767897, "uuid": "b23db222-dc40-4f35-a53d-0651ba824f07", "value": "asd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f4b5ed-3e88-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748741752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748741752, "uuid": "7f49f666-37b6-4151-a488-d67f3622f654", "comment": "Malware payload (MassLogger)", "value": "7f1d69a0e40176d32ba1572f29edf64e", "object_relation": "md5", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "aewn-buzz", "colour": "#D57922", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748741752, "uuid": "89da9645-4a4b-4012-a428-d386920be0c6", "comment": "Malware payload (MassLogger)", "value": "69f81d677a41d9cdcea7d67ca0afb52708ad74b40788e2f101d414bcc5b6b670", "object_relation": "sha256", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "aewn-buzz", "colour": "#D57922", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748741752, "uuid": "e59b69e4-e525-49aa-9f5c-d8f260e947d6", "comment": "Malware payload (MassLogger)", "value": "919dda7146e6812baea221f49cbd74ce02c92a96", "object_relation": "sha1", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "aewn-buzz", "colour": "#D57922", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748741752, "uuid": "5bf3c376-1ec9-4cc0-94a3-562f027163f2", "comment": "Malware payload (MassLogger)", "value": "7203327d2e8665eb3e325fccb38e29842358c2a70ef4bb32cc05036756f029dacf175082a463da40e63dfbec2374f374", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "aewn-buzz", "colour": "#D57922", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748741752, "uuid": "9ee22880-1899-4770-8e80-2588bf1cf0da", "value": "T119358B22E39E9264C2B37173BAD567316E7F782506A0F47B2F97CD3CBD20021525A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748741752, "uuid": "715a3eb1-2ba7-4097-a216-e50668237310", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748741752, "uuid": "5981cd21-0ace-4143-a8bf-409fdd743e5a", "value": "12288:gtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaY3h0iip68In4Fe6A:gtb20pkaCqT5TBWgNQ7aY3ILIn4Fe6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748741752, "uuid": "d4405599-50a8-49f3-a4c5-690ce380d058", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748741752, "uuid": "af9ab79d-a574-4667-aec8-926b8e814767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748741752, "uuid": "c9a37dbd-8a5d-4415-826c-cfcb6b7b0708", "value": "cathh3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6356557-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759773, "uuid": "4b453284-5c60-4e1a-b913-1490c458d28a", "comment": "Malware payload (Mirai)", "value": "588b11691f82e25df315b698984bfbbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759773, "uuid": "97f1b78f-76e2-4376-8169-08dad07bcb21", "comment": "Malware payload (Mirai)", "value": "6a8c8fc6eaac1c8b91627fed3ca27aecb48e0fa43f0fffe0639f32b738b562a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759773, "uuid": "c8525fcd-7669-40f7-aeff-983ef73a445a", "comment": "Malware payload (Mirai)", "value": "d3f76f40348a2b1dce50cb2f4d58d75c814c9406", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759773, "uuid": "aa99aee5-10ff-4ddb-a7cb-618b44a0a94c", "comment": "Malware payload (Mirai)", "value": "76d1d780953ca11a21b042eb4bdb3076bed53b87037d5a7ac97ab76ddbd44596def77d19b7d115ef70535919f4480695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759773, "uuid": "446e26cb-006d-49d6-a91f-c784e78daed6", "value": "T13EA3E617BF614EF7D8ABDD3746A91B0539DC510A22E83B393970D82CF54B24B4AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759773, "uuid": "9f647a2e-f9c8-4b93-a544-a84b4b522ef5", "value": "1536:WKNo8Ji30NCeCce8lbSynVoUu13591ZatG/iVknZD:Wqo8Jqvc7u1f1USnZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759773, "uuid": "ef7dcd5a-4d76-4b8b-bdff-1258428cd4e5", "value": 102132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759773, "uuid": "9f2560c2-f43f-4345-a350-f047cf49407e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759773, "uuid": "946be2cd-7981-4849-91d6-672f7d017143", "value": "gmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bb143e-3f09-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748797163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797163, "uuid": "8f2268f0-0454-4768-b398-82e22dc9d4dd", "comment": "Malware payload (LummaStealer)", "value": "3df0fbcc03c66c0af47c3da62ddb1fc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797163, "uuid": "a91532cb-97e4-4850-b90f-d987439d65b2", "comment": "Malware payload (LummaStealer)", "value": "6a8ffc766f3861e5e0ae9f4e6124abf1d13a687a84aa18e178d37ebac5bdde2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797163, "uuid": "fe1d34e5-d6f9-46af-8b9a-6ebabb744a11", "comment": "Malware payload (LummaStealer)", "value": "cde550848df8c302d506361e5016ebe43e91a1f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797163, "uuid": "b017cc33-5a1a-4b04-afdf-3901637b0cae", "comment": "Malware payload (LummaStealer)", "value": "7ef1e7bfc4d4a4a46a7cdb81887ce7eb63fb8ca5cb51dd8b8968380c64e9573088110b1733cfb457185820f5d29009af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797163, "uuid": "e50375c2-19ef-4d57-aadf-1e84c7aa9618", "value": "T1D7168E732162E60BD7D783A09F3752AD2A6E1634D2CF746B4BB8057C28239BD4D1193B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797163, "uuid": "bfacb609-b162-4469-9da6-e31e4b0dc281", "value": "1324c08487e768993bfe23caf1b5d358", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797163, "uuid": "5c65c733-5e29-47de-ae00-5650b657db66", "value": "98304:3VQ0/+f3M+sjcO8pqDNMkiQo3BNpJPgONYHcQtppXIBOYCN:lDy80pq+9gONYXts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748797163, "uuid": "e23b464e-2e52-4378-8199-0dd40c45d955", "value": 4124160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748797163, "uuid": "d2cb7541-bb88-424d-b509-574310248a36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797163, "uuid": "450fe58e-e99e-4384-88bf-f35ca9f8a043", "value": "3df0fbcc03c66c0af47c3da62ddb1fc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff84dbc-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786579, "uuid": "72284b31-8a4a-4e97-ad48-1c2fdbc6c4ae", "comment": "Malware payload (Mirai)", "value": "5ae5f94fa7b5255c018ac21fd906b00a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786579, "uuid": "3b71160f-14c0-4003-99e7-c06cf182dc65", "comment": "Malware payload (Mirai)", "value": "6af28f9c2c298dfed27c40de20245e2a80b010cdfb090f03dcb54b9223f857b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786579, "uuid": "50357a28-a656-4c3b-8704-155716468fb6", "comment": "Malware payload (Mirai)", "value": "cd09b578b13221e87a24d8c372a829d5a072a298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786579, "uuid": "e5c1cd30-15d5-4ea1-8239-34ac59300e59", "comment": "Malware payload (Mirai)", "value": "1b3dcfded47b6ee89926217a9d3ab167a5fe814c95833d29ba932d440e718b84cdc6012bd43151f7583df19e6a8fe83a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786579, "uuid": "d23a3c52-f541-49e6-af0a-108007526ed3", "value": "T18EC35B42EB418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786579, "uuid": "a48e2246-bba7-45a5-86c8-1929413ee33a", "value": "3072:r8wxuQyBKaeWyRSxscBqPmGIvdWD0zrScVM/9Q4vSik:r8wxuQyBKaezSxscBqOGIvgYzrSmM/9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786579, "uuid": "4112d803-d456-4882-9455-73e401af74bf", "value": 129932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786579, "uuid": "154fb486-74f8-46c6-a76c-147bc3a68c39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786579, "uuid": "36898623-99a2-4b4e-9bc1-cfd6d98986e2", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a61a98c-3eb3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760075, "uuid": "20f7fed9-0b5c-4599-974b-fddec60990ef", "comment": "Malware payload (Mirai)", "value": "18bfc7b711c6149d13330def8b2bc78c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760075, "uuid": "34608707-1ca7-478f-a25d-371d6056d280", "comment": "Malware payload (Mirai)", "value": "6b9b31b6690a4f8369d1ee3555bec2b3f26aa95dc98e682440119c456e995558", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760075, "uuid": "a33c3689-eea5-42b2-8fd6-3c15102fae43", "comment": "Malware payload (Mirai)", "value": "16fe1a2fd7c211095858f70388a16b168a1e26b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760075, "uuid": "eaaa7bc6-d220-49a1-8f6a-6800ca7d1db2", "comment": "Malware payload (Mirai)", "value": "90894b029aad1f7b33b773f3d38f943b924c6b3e9045b811c09397b40ea21f2fcb82f9bebe15fa140264f40780826256", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760075, "uuid": "a5aa2340-7506-4b76-976b-93d2b598d090", "value": "T16553022FB1A8CC72DB912135CA3204F5A5EB7E56F6EBB26331051058D68747A9FF9081", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760075, "uuid": "e3fa766d-9a7d-472b-ab1a-c8ff59ac4f73", "value": "1536:auIH+ZivDitu4cbm+pOyNEpcX1daT7iLTgk6bFRqBnyNkTmYSWaDt:NIeZiv+tuD1WpOsiLTp6hkBnyNXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760075, "uuid": "2b76074c-c77c-4953-8d27-88a69371ff0d", "value": 64276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760075, "uuid": "09f669d7-fc4b-4e3e-87c0-86fe161283e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760075, "uuid": "63f26823-287b-4e51-ad66-772ec0a7e338", "value": "neon.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bafc27d7-3f11-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748800583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800583, "uuid": "a6e60dd5-8898-450b-815f-7030710667f5", "comment": "Malware payload", "value": "3bc57960162b250eec1204095c8248e5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800583, "uuid": "c420483c-46c0-44ea-975c-a3dc65bde048", "comment": "Malware payload", "value": "6c0e04d46a8a19a5c2e578549fa57b2804f8e319cc0aa66b3e7808d7a677ea99", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800583, "uuid": "9633c081-d5e5-414d-953b-3ddb8e92b0d4", "comment": "Malware payload", "value": "7359344b8b6189484d0d94cca2bb7a389bc6d8b4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800583, "uuid": "6c2611bf-7cc8-4b93-af90-50f5d86771ec", "comment": "Malware payload", "value": "473fb1ca612abd2d9ba01264885629be7aea73a2f923dbcc83392d6c3ca90ab16aea41351ef2584cb270fee7ab3c55cc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800583, "uuid": "75d2d4d1-063f-4d13-9cd0-3ad31883b5e7", "value": "T17711AC8D3151968A0F498F01B05987D49E458BEAF279EE0EDE8D58BB5CCC6007078F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800583, "uuid": "0b86e402-1f6b-4bf5-881c-f86d3a72403b", "value": "12:Jp+kxI8E+khNIaOA+kq9K4H+ktT2q+khWbJ+kPx+kQ+k0KA+k3+kpcA+klHAUn:JT9OhNIQ8KKjyPLCzyxplpxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800583, "uuid": "6b08bb84-0cbf-4d63-9a13-9d5c13687ea5", "value": 957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800583, "uuid": "c9955b41-a01b-416b-9548-bb9eaeda382d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800583, "uuid": "b06146fe-78e0-41cf-b8a3-6e80158d8871", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511ca8c6-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748765186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765186, "uuid": "fc5ad482-820b-407a-bd92-c3d649645ce1", "comment": "Malware payload (Gafgyt)", "value": "376e46269432e5f85c552481dee03ac7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765186, "uuid": "822cfa7d-cb29-4310-8d17-ec973981121e", "comment": "Malware payload (Gafgyt)", "value": "6c2a6476f5edce4b4b5c4e4234d246c739e68e168264d6dd5067f9f48c6be036", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765186, "uuid": "7e0e9c94-c131-411e-ae18-4476900248e4", "comment": "Malware payload (Gafgyt)", "value": "646574a93a2fde5c854842414cd56e4ac85538ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765186, "uuid": "ab197ad6-21a1-4b36-a2be-a80aa1d55be4", "comment": "Malware payload (Gafgyt)", "value": "656d2ed2d073290b19714c274236adc34bc67feaec708483469b02f9623414b75bf52170fc52d0f99cd6856a9233a6b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765186, "uuid": "23991c7d-9f72-44a0-bef2-2960377fd60d", "value": "T113833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765186, "uuid": "93755939-b5ff-49c5-a27b-267d80e3ae91", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCFdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JeBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765186, "uuid": "d4e23690-3c6e-4d3c-81f6-41563e00990e", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765186, "uuid": "9c4e1b46-1185-434d-a82b-739e73979a46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765186, "uuid": "a6af41b8-b15e-4425-9123-94eaf2ee118b", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2006ec-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748798811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798811, "uuid": "43bbad11-d968-4e7e-8b81-f3eb73b63bc8", "comment": "Malware payload", "value": "b5b4196abb9028ff05eb0e6b401e184e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798811, "uuid": "ba109121-cdc6-4554-8f10-435e4b681cba", "comment": "Malware payload", "value": "6c8f8f0ffeb6db1afd3c7fad4d93455d19b0a966c24ddb1c6f7ee816b542ddd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798811, "uuid": "383349b5-af1f-4d81-82a6-071b8e32191e", "comment": "Malware payload", "value": "be4f5062447f0776794879943ef9ee330ff2c852", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798811, "uuid": "b6735342-5003-46dd-8593-9d303cc159e8", "comment": "Malware payload", "value": "fff322e96f4f08cffe9fd4abdc773a98f586d4d32f5ddc325e1bd5a0436a7b31616a74c47158ff06dc2c6caf591039e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798811, "uuid": "cf01ed86-fb71-4f63-96af-6a82a71ee582", "value": "T14EC6BF16E2F900E8D5BAD0BCCA575527E7B23455133497DB56A08A292F37FE0AE3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798811, "uuid": "c054781d-fd24-42d7-a110-c62867a49695", "value": "37b6975fd92ab187a69ca6f8945800ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798811, "uuid": "19637630-9992-422a-8479-b76ba150a864", "value": "196608:p7at47TJ7z4OW1pBeGi7b0uCRCLJHG/FT391G:5atW17zliIb0RULJm/p/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798811, "uuid": "359f3f85-9c8f-43ba-ba19-355d234a9ede", "value": 11656559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798811, "uuid": "5d550a60-b973-4235-825f-f5ea15746431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798811, "uuid": "f483ac11-9f5f-40a0-89a9-02581b7d5c54", "value": "b5b4196abb9028ff05eb0e6b401e184e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077a3ba7-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748786538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786538, "uuid": "d2fe94df-97b1-491a-bf74-e3aa06e9d54d", "comment": "Malware payload (Gafgyt)", "value": "9614778a8022d500a1d9b390c2269e6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786538, "uuid": "f2d49f1b-da5c-48a1-9184-71ddd198deba", "comment": "Malware payload (Gafgyt)", "value": "6debd217fca64400f2fa474a110704ab59e9e5322caa7509989245d0b5993198", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786538, "uuid": "fb267071-85fe-482e-8b64-b6630f5d6456", "comment": "Malware payload (Gafgyt)", "value": "dde74e2c702dd48b3ef911b1a75476dac81dec44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786538, "uuid": "2a91c0a4-6684-436a-bdce-4ea057aa5a6a", "comment": "Malware payload (Gafgyt)", "value": "0b102d4ae633c6ec41acb5856f3421d5dfcc8dd55de5332640d7f21f331c006f60fb1641065d14687141697868b1ead2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786538, "uuid": "535d60a9-8749-42fd-91ea-a575b08c4876", "value": "T11304E81B6B618EB3D81ECD33029A1201108DDD6B55D93BAFB6B4E95CE76A84F05E3DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786538, "uuid": "33fa8039-91d8-4c1c-a713-b5f86a7ca167", "value": "3072:C0uScDGYmQ1ZrQ4etJ8add9Qzxs3RoOiUYdfi+KqLwZi+LUk:C0uScDGu15petJ8addQiRofdfi+KqLwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786538, "uuid": "ee17f7b0-3e20-48f2-9c9c-8c351aefd27a", "value": 174954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786538, "uuid": "8d32b66e-1552-49a0-8990-e9e778512de9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786538, "uuid": "51d43b7c-cb0a-473e-9898-e245720759fc", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fe44ed-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786534, "uuid": "d43c84c2-516d-4737-b3d6-40ad89886f95", "comment": "Malware payload (Mirai)", "value": "1beccb10c35bd27e76c6221bba46d140", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786534, "uuid": "4373c9d4-da6f-4ff8-a59d-33527ef12bcc", "comment": "Malware payload (Mirai)", "value": "6df66b5e1a85544133d305a57c15b816e42ce53bfecc34cd3dae2cd959994ea2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786534, "uuid": "d5b6114f-ef45-4eb6-ba7e-c3185cf44472", "comment": "Malware payload (Mirai)", "value": "9a8bf90011e436f7559772d9d973f529d5d19128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786534, "uuid": "1dcbb790-8db4-422f-b95a-22b211578e8b", "comment": "Malware payload (Mirai)", "value": "8d072e2461f7b6bb3e4875fc262de0ff12754dca6367c854836f69f57071978479e408042e78df5a1886f5443e462b74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786534, "uuid": "18812f41-13e5-482c-bdaf-f6c7663784fd", "value": "T15E330A9AB8029D3CF90FE6BE54164E0DB93177C152830B2767BBFD936C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786534, "uuid": "cf515811-e05c-4da0-bfb6-746456dacfbf", "value": "768:oBCP9hTzoEWRcqOCLuYUc6xe+Tm806Msq3zkHQXOZrupiQGA:TX5qCYWxeqm806M9kHQX0ruiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786534, "uuid": "77fd9841-f7b7-4d10-9d7a-4abcf4623f8a", "value": 54928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786534, "uuid": "a606d18d-ecf8-49e8-87eb-3b47a7e321d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786534, "uuid": "44604f8e-7923-4a1c-953c-74886ff19696", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77d75e6-3eda-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748776955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776955, "uuid": "a3eec57d-8f79-4541-a0a0-677a6fb7447a", "comment": "Malware payload (CoinMiner)", "value": "58e7c8de472b286a33b107dbf4b29db5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776955, "uuid": "a6596df9-4d7f-4d24-a9f2-edfca5ba2eb2", "comment": "Malware payload (CoinMiner)", "value": "6ee74390fbed712dd7f117f17c85b78df457f821cfd536b30c24cdf291ad3aee", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776955, "uuid": "2c998aae-ab3e-4ac0-83dd-26fa66af17ca", "comment": "Malware payload (CoinMiner)", "value": "8114ec52d5af61fd44afc8c1cbcbc4f58646cc77", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776955, "uuid": "e24961d0-1092-4f91-b524-3ccdeacf71b2", "comment": "Malware payload (CoinMiner)", "value": "f8f49d0bd6f29ece4b6d3a279012854ce62ca3226ce788b262d2e8691179d43361a4685180b110e740473424ac040817", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776955, "uuid": "e60cf34a-92c1-42ea-a10a-49730d6af99f", "value": "T18956235DCCB6EDEAC84181BBD3C9A1B516B57C6632E12DC7466064031C2FAEE50BF9E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776955, "uuid": "f9d34c3d-a258-4095-b965-5fec2a90e8f0", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776955, "uuid": "b7d20756-cd13-4d5c-bf04-0b03f6c6933e", "value": "98304:6g5PWxWr0Kd5HXM6UIKfu6qFu3ECo5hZJhqdD4sSYcS8laANUanSH:6gZ5FdJJUXqAWfqRuaWUanSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748776955, "uuid": "894e89ea-73ab-468f-9098-0a3038ae6730", "value": 5923840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748776955, "uuid": "ffc003c4-0d38-409f-9619-191beb06f5a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776955, "uuid": "775fb8ff-8b0f-4179-b8aa-c2676edd015d", "value": "EyeLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e7d33d-3f0b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1748797736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797736, "uuid": "89a29820-cc0b-48ee-88ad-3190a8283c8a", "comment": "Malware payload (Vidar)", "value": "a2a92ac60d3d3bf738842a48b21176df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797736, "uuid": "2218d887-22cb-442d-9ba4-edcd76d05176", "comment": "Malware payload (Vidar)", "value": "70022e1e63c0b10794874e2e83256e954396be6a12307c37f77526f841baf367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797736, "uuid": "6ab50d39-eca5-4475-980c-418e63f51fe9", "comment": "Malware payload (Vidar)", "value": "1fb8e68710220771d3d3e1d4ef15b15565a29bf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797736, "uuid": "28def9d7-21b4-4ebc-9bd8-816cc4ecbdee", "comment": "Malware payload (Vidar)", "value": "669c14241a1d971e62cc22b1b997379644ebf9bad68070a20b7316ba7dd8c03c2bf8d0bf62a4def6c261d450f14ecac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797736, "uuid": "d59c1673-188b-4263-b22b-203f58fad051", "value": "T152162B210EA25690E4F756A0D52B12E6209C73FFA7CFF4A98FF48C7456279AD40124FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797736, "uuid": "bd05352d-8178-4ad7-8786-a6db4dbfe606", "value": "1324c08487e768993bfe23caf1b5d358", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797736, "uuid": "80462c95-41e9-4121-9e06-53d68126cb7d", "value": "98304:F+Vpy+Pvbo+g2yuux0CD+eprikpiCJ2n2uIzO2JV:F+Dy+kRSdepriknYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748797736, "uuid": "3e835c33-d9f1-45db-8b56-738e322e6c38", "value": 4253696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748797736, "uuid": "324dab76-b426-41e4-a8f4-eb82d56fb655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797736, "uuid": "06c03580-080d-4397-94a0-239c1aa5f6f4", "value": "a2a92ac60d3d3bf738842a48b21176df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c38f779-3ec9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748769393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748769393, "uuid": "4629328f-a280-410f-b578-8cbcba164a2d", "comment": "Malware payload (Mirai)", "value": "16334bf69c745a4de62736ee78805c3f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748769393, "uuid": "1f04402e-c94a-40ea-8660-7c7e7b516cb6", "comment": "Malware payload (Mirai)", "value": "7036be432a3246cf318e2fa7eb3e94939e7bfb867ecc18a8900c3372c1ed4495", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748769393, "uuid": "0d2cf07b-da09-4133-a7f7-c971cd18ec90", "comment": "Malware payload (Mirai)", "value": "87dad2ee7778593e0455675044446b917f969fc5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748769393, "uuid": "e39b7d0a-5a63-467a-b4fb-c1c009ececbc", "comment": "Malware payload (Mirai)", "value": "2a82dbd87a8c940d99f1aaf2b181b0a786c0b6d952c8e3188f1971a114e5b0f3f3f533ee3b37b7d353e6d5fbc9b12515", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748769393, "uuid": "771b970b-84fe-4374-8495-14e2e3c0390d", "value": "T19011B3EF35A2562790D84E89A065A8D45008DFD298B00BCDB7CC5EF7D18CD28B715ABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748769393, "uuid": "ce6588e5-06a2-4543-99e6-c19b25809a61", "value": "24:juPPNNI93VhKj0KT+f2V5N6xVgKJPaJk8U:juPahbQVDsg0PEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748769393, "uuid": "479eed94-52d6-425b-98fd-49aaf85d57d1", "value": 927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748769393, "uuid": "33f122dc-5c0d-40ad-a4fc-e77bb6f16fab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748769393, "uuid": "75d0e08b-8228-4669-833a-beb766a3516f", "value": "larp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd51979f-3f1c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748805311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748805311, "uuid": "03bda2de-d8d7-45a5-b930-38dfe77f77fa", "comment": "Malware payload", "value": "d797209bee7e880744b84dec1690bf2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748805311, "uuid": "f21910e6-742e-48c7-a64a-a1d454d8763e", "comment": "Malware payload", "value": "709120936c2c663715c264f499fa919ba172650c31f73722b04a2c9602187aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748805311, "uuid": "36284d95-510c-4c79-a4e0-5ba97a04e383", "comment": "Malware payload", "value": "b2842cd0d76ffd69ebf44beaa5faa6ba7d3d566b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748805311, "uuid": "010f8e6c-11bb-4270-b661-0d5287ea69a8", "comment": "Malware payload", "value": "15597ca80c6fffaf7e26dc805c908da583717d435cf7c914aab0d034935f7c5c91ed204c3315968b7a116442e75afffc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748805311, "uuid": "5aa8ffda-4106-4ed4-9f69-1efc3c7e9765", "value": "T12224BF2C2FA18D16E5ED4D7404F3A368D27C9D732D0D8513E6587EA91B37E886E22363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748805311, "uuid": "912b1415-1742-4e45-a4e1-80f31092eb87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748805311, "uuid": "8bc82ab7-dd3a-48f9-ac67-806044548d51", "value": "3072:gMlz5tkbpixOpZOUh8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLn6:zlzQb4EOGUhcX7elbKTua9bfF/H9d9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748805311, "uuid": "7df6c247-a71f-4bc6-acbe-11cdbc6183c9", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748805311, "uuid": "1d6885cc-04c1-4b54-b8f7-5d54c1bb1d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748805311, "uuid": "70148827-5601-4c60-bbe3-cd8e79917e15", "value": "CoderscriptTool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfda3b8-3eb7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748761879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761879, "uuid": "06630852-9f89-4066-ae6d-38e2e1684ee5", "comment": "Malware payload (Mirai)", "value": "f2f534e9e420e84dada9e7794f019b4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761879, "uuid": "9e8adf87-b674-4b30-b74a-ca4df4e67cdb", "comment": "Malware payload (Mirai)", "value": "7207766e197ab48cb77c43ce782b5c7b6144e6c5c4dc5b9d00e60706d9fbff4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761879, "uuid": "b306040d-ec5f-46c6-9d06-03f6075c3961", "comment": "Malware payload (Mirai)", "value": "7ce5879ecc93e316841521ab9d72e6bb6c3c682b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761879, "uuid": "5ea42af3-e406-46cd-95b9-72382b3403eb", "comment": "Malware payload (Mirai)", "value": "422570ed7e31d25cca2f5ca369bb4dc29d154e375f2537baf40a7600802309c6992dd6148897c5f78ab3bf8b2fdcd872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761879, "uuid": "7dc13051-91da-4d0f-9ee2-2ea04db5fa82", "value": "T1F6430210F3A79C14F7D8AD3EEEFC450A51B74DB191B74080671CEBA4318A89772EA74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761879, "uuid": "b63742fa-d8d7-44e4-a918-0d492512d36b", "value": "768:dYjghrmW2Co8SMB5gtdmMYzKUtGdoAWfDAgxUOTEGxy7jTMwVgq+F/WrauidSXlp:6cRRobMfQUtGGpbAgsp7PngVCCS1yLzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748761879, "uuid": "7515f68a-a4d2-4bce-8878-37c49b3e0a37", "value": 57532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748761879, "uuid": "07b66839-1080-46b2-a2dc-4e5766f92fc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761879, "uuid": "a6cce2c6-8304-4fb4-87c4-51d41b0123ea", "value": "neon.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727cef42-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806904, "uuid": "19385ace-a0bb-456b-8f95-6589d1c3bbc4", "comment": "Malware payload (Mirai)", "value": "de69d6f2e23942acecbae960dd311dfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806904, "uuid": "018c8aaa-52e0-4960-a432-9c4b14ddd9f7", "comment": "Malware payload (Mirai)", "value": "73349c600d91c41b7e39762022aa467fa35f44d8243ed2ef6f91307e075ad2ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806904, "uuid": "9842f4eb-7ff1-49ab-90e4-d236b134d665", "comment": "Malware payload (Mirai)", "value": "e57ac27cf18bbcb17d957533c9e68bbc83dcb723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806904, "uuid": "6119af4a-7a98-4001-91c8-283d12064119", "comment": "Malware payload (Mirai)", "value": "3f528a00587b1d009535b84448fa0cfb84098726d29f1222748e8a8da96c4031d8189acc943d538302cc0c609a005b46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806904, "uuid": "d32a457a-c853-4d24-b657-6675063e7668", "value": "T1DAB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806904, "uuid": "d54e4bf1-7dde-467e-ad3b-1a40d98f1ce7", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1z/LWy:c9sSyzz36YaWWgg1zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806904, "uuid": "d1dc0517-16de-42d4-9918-e9ad0ff13a7c", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806904, "uuid": "4c984a52-07a3-416e-99bf-3bba46545d34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806904, "uuid": "c80aad53-f015-480d-a69b-fe8b593d8925", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c905b7-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744771, "uuid": "f60c327a-1f02-4977-96fc-0cfc37b39405", "comment": "Malware payload (Mirai)", "value": "bd973b8f1793b0eb1d9a78237cc4ecdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744771, "uuid": "8765e90c-a699-4f5e-8e6d-a97e1ad78164", "comment": "Malware payload (Mirai)", "value": "7343c7c1f16a876af8080e35df46996548121ac8e376ba502a0755c6f75298d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744771, "uuid": "f7ca85e6-c126-4007-9c67-aff2951b8a88", "comment": "Malware payload (Mirai)", "value": "ca9402da16e54f663bc2b4dafe0776fe99a67517", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744771, "uuid": "cf7524d2-ef8c-4f7e-8af1-e252bff6800a", "comment": "Malware payload (Mirai)", "value": "8bd3e960e4de576b2674a1ca924db85a080e0961fb8a31839c91ae858936304b963129b3966d1b057a8499055d90d394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744771, "uuid": "3115d60f-dcca-4246-aa3c-eb37be94a333", "value": "T113B2C0CC60543084C98D7C7C278D4A664F6CA1D0BADD9B26E354CDE8B3BEA4B745D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744771, "uuid": "b5a5b71c-a619-49dd-86b1-d81ea89251db", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpOZqEWvk:/QlS07FUXqIYSXQKquCqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744771, "uuid": "8312e61f-284e-46ab-81a7-bad518b18bd4", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744771, "uuid": "b0b818cb-2221-4349-ac32-79a5902523a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744771, "uuid": "ea8d06c3-60d0-48a7-ac8a-21d23327de8f", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715b7e68-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806902, "uuid": "bc38e57d-483c-4715-ba81-da8d71f90c8b", "comment": "Malware payload (Mirai)", "value": "8d60431bd0f7b5eefa8727966e563c55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806902, "uuid": "c1f8c32e-7e39-4423-9d71-41310ae7be6f", "comment": "Malware payload (Mirai)", "value": "7375dc8dc928f9a7bb4cca9cf6a7311191073f8175ca9b2b71d8006954ec5c68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806902, "uuid": "a0f941e1-d278-4bcd-8961-79a85bac9fc1", "comment": "Malware payload (Mirai)", "value": "6db82fb63241406c27f85a2d1499454c4b154f57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806902, "uuid": "86397831-b3f2-4074-9e7f-e8b2869906ce", "comment": "Malware payload (Mirai)", "value": "a4522eba59f56752e68fe3dcd3cca07cf46dd82b9e9fc6ad1dd33cc414037ad9ed890cdd4f5e3cae7651077c64a34ba9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806902, "uuid": "3055e4a2-d99a-4f32-b15f-905f1006a260", "value": "T1DB230231890E8EB125703C72DB99D3937AE126B1C6673013DA280A386F797631E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806902, "uuid": "72ff2226-0bdd-432d-af78-8084883423b4", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3v9q3UELbUXfi6nVMQHI4vcGpvk:DECFd+A6YHAxeLRQZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806902, "uuid": "1044ebf4-2369-438d-8ea3-ca6e01fdd1be", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806902, "uuid": "d9d6b46b-9538-40db-81e4-15297dbbc517", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806902, "uuid": "d7d5622c-37cf-4c33-a494-cf1eee7c4a26", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db110f8-3e92-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748745746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745746, "uuid": "6e830e98-eb3b-4fac-87dc-226afa51cd80", "comment": "Malware payload (AsyncRAT)", "value": "4da8e672b075c9b58818f1bd1717d8a7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745746, "uuid": "6c6f2902-5faf-4785-8eed-5e03634836ff", "comment": "Malware payload (AsyncRAT)", "value": "73b5ed13bfb5ccc54b5e21aa1020549bc2d774b8e251f1c1c14cf9d9a7777880", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745746, "uuid": "88c528d7-48a9-4881-97e2-9d6060365998", "comment": "Malware payload (AsyncRAT)", "value": "c60c7d228fce18ae651bbf50066480f033fe6bf0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745746, "uuid": "9e8c0c32-afb3-4f3b-a053-3f4a3f42be83", "comment": "Malware payload (AsyncRAT)", "value": "f012433695d6ff8375d46a82f206317d07e6d0fb57b87505addc267bfbc9d51f97f21db7cc35d92d02a5ad5eebbd8fbf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745746, "uuid": "45b5c2ea-496a-409a-b666-32395c68bec7", "value": "T138E23B4877D44712DAEEAFB12DF362061670D517E823EF6E0CE485EA2B67AC047407E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745746, "uuid": "a91d10b2-5465-454b-a786-0efb63ddc7d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745746, "uuid": "e4749dc0-f4cb-4747-9d1a-61edbf0b793d", "value": "768:w5Va+vNtg+PB93Tw42pzVFE9jHOjhtbO:wxvNtgw93U42jFE9jHOjXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745746, "uuid": "e3f2cec2-4b39-47c0-9e80-d5a6c754c282", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745746, "uuid": "ab836d7d-73c7-4c92-85b9-0900da1e9279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745746, "uuid": "685a4314-c09c-4024-b389-db2f9d731662", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b5c395-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759790, "uuid": "0eb6f481-26df-40f7-85a7-ffd23f8d87e3", "comment": "Malware payload (Mirai)", "value": "59d69fb92a8895ee049bd47c02d662b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759790, "uuid": "873654d2-0faa-4c64-a2a6-646b636c99a8", "comment": "Malware payload (Mirai)", "value": "7432c5735f332d8db4e387f001c5addb55bd4daeb056e0cb15be5eef1ba01536", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759790, "uuid": "07e1b863-adc6-4028-9e8c-4647c9d4382a", "comment": "Malware payload (Mirai)", "value": "50fc278fdd0e362a0f07c2734923624e8317e4c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759790, "uuid": "c43a80e7-d360-4418-bf61-503ede171b6b", "comment": "Malware payload (Mirai)", "value": "1b39d822a9ad0184b06c2f474ace4806e57e0a0a7b436a4946f4601fdcc29f05935f4ad476d927be8816cfc4ad69915e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759790, "uuid": "61c6c492-dc94-4d6a-9ade-9dbb4b0dc86e", "value": "T104F21995F8868A2BC1D51379B66E6A4D3770B3D8C3CE3707C9A81F31378621B1D66E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759790, "uuid": "8feea1d2-36da-42ee-a8bc-e83a3bd9df8b", "value": "768:rL6iXRtb48frJ5DsPDOFnmtIheki6BoZgXgFX/ocs:rnRdZDsPDnIheki6Fuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759790, "uuid": "f10301ab-7b1c-4823-a7d6-73d595d3e812", "value": 36768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759790, "uuid": "e78e8b3e-d95d-44df-b504-8811b61c9368", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759790, "uuid": "7461815b-e405-42af-bcdb-94ca5388debf", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ffb3d1-3ec5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748767902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748767902, "uuid": "3f07dc52-3de4-4295-a57d-1e0d0fb15500", "comment": "Malware payload", "value": "4c3ea4b623ba99fb4283f54c45563398", "object_relation": "md5", "Tag": [ { "name": "bookneg-com", "colour": "#62E8D6", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748767902, "uuid": "0b5fe6ec-7f0a-4fc6-adfb-62b670cc0834", "comment": "Malware payload", "value": "74c07f7df45cde57f41768f0cf5d2252121941cd676503b090017a2e75fa811d", "object_relation": "sha256", "Tag": [ { "name": "bookneg-com", "colour": "#62E8D6", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748767902, "uuid": "8305c1c0-ecb6-45d2-b59d-5a26cff8d158", "comment": "Malware payload", "value": "0924dc6bff3d0e71580ee27e5ca60a3248590e03", "object_relation": "sha1", "Tag": [ { "name": "bookneg-com", "colour": "#62E8D6", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748767902, "uuid": "606da05c-ec18-4374-9722-f4c342f707ee", "comment": "Malware payload", "value": "6a9c0543ef0b1461d75b785b9a000384868a5a4167dfb653a724df95c2c3349da3f642e9eee91e9d5e2c0a48c469ee20", "object_relation": "sha3-384", "Tag": [ { "name": "bookneg-com", "colour": "#62E8D6", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748767902, "uuid": "46c9e264-589e-4fee-9941-86ea84d77d32", "value": "T18501FE56220F0262C573CF71F8C6532AEB72046B102F1A1139BC48DA1F31A6BD2CAD8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748767902, "uuid": "ac6dc5ad-df5c-443c-8a93-9ff49f6748fc", "value": "24:/Uu+RHHhAlK1XKc9ZJjiXwndncGSKbl/9anz/HOJ:czn516c9SXwnCGllsbOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748767902, "uuid": "87d030cb-8e94-407a-a032-1cbc14239093", "value": 784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748767902, "uuid": "3c48bf9b-5eb7-4267-a1c0-c69d1f5c40ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748767902, "uuid": "804f6571-bfe6-4a4d-a770-2acd004171e7", "value": "bookneg.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1868b8-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748799751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799751, "uuid": "0eadc213-913c-46c1-8cdf-e10ff8d5eda2", "comment": "Malware payload", "value": "edf1dfbee837d5a6f22e5268587dc257", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799751, "uuid": "e73d25e8-8771-4865-a903-dea7dbf5c9ca", "comment": "Malware payload", "value": "75ac86de9ca2f3cbca0153030194b8921f6c514c4b184b89a3f0dc31ce0778e0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799751, "uuid": "8da60199-21a8-486c-b3fd-f370c58b22ab", "comment": "Malware payload", "value": "5377d9fd598f813270a270e6760cb45413aa0672", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799751, "uuid": "8e20731a-d431-4d20-8e60-f6edda233a6e", "comment": "Malware payload", "value": "fd002fcdc55b2ebe6b06e3871a24ceea21374e3df71ca205aadb24ef0e8de430bea531ee191606f9b3ab4d902e776363", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799751, "uuid": "0cf4a580-5c6b-44fd-968f-c1e469273e35", "value": "T1D031D23809E102EEF63787B9ABF5B3B38510FB92DD6546BC118062451716150F467E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799751, "uuid": "328e7a53-a532-4c88-b1b7-767907be5754", "value": "24:8y/BHYVKVWO+/CWKlzO08aTas++7pMq3hpcBGlsMbLYmvqarab/BiT:8+5amTn+s+E5hpLaMbLYmvq4abBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799751, "uuid": "6d43f69b-a5bb-45c8-b716-944b389a3e21", "value": 1710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799751, "uuid": "c08e32b6-ece9-488a-9986-d384beff0238", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799751, "uuid": "02a3dae0-94d6-416c-9bc4-866524b29134", "value": "UltraViewer_setup_6.6.113_en.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde67d9b-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786522, "uuid": "b8743dc8-5036-4aa2-a8ff-fe26f8bd77b6", "comment": "Malware payload (Mirai)", "value": "16d3a2d8491292a250fbe576d2385d76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786522, "uuid": "2f4a36b4-b84d-4122-b7a0-baf5d1aa4ec0", "comment": "Malware payload (Mirai)", "value": "766d1e39fc86e4b24bd1b0b0dcd526b4271d717521f5d3c2eeeee36fc5c57d22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786522, "uuid": "83f179fc-95e6-4ced-ad4a-d12167f16386", "comment": "Malware payload (Mirai)", "value": "e1a10b52e281ee38b59d71ede73f99049e56d6fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786522, "uuid": "7001fea9-8795-434f-872e-a50a409b5bc2", "comment": "Malware payload (Mirai)", "value": "c6ade5bfa9d92469c5b38a6c51f29e6891129c8c28176a0e303ff61c7ad4a9dc47f4b42c0f813b512321a02ae6bf46d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786522, "uuid": "4f48d930-ef78-4177-8eea-45d0b8eec029", "value": "T13323F1616940AA10E3A50A31EC2DD787E7C997ACF2B974E537D85D2C1A835D20EE7CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786522, "uuid": "ff53be7b-488a-469b-9ec6-0376f4ff9578", "value": "768:JW2myW5zrY3m+KDOtELVpuyUEQNIM4ZktwkVlXFbkdzxQu9q3UELMIk9r/e/lQMq:A7d5zrY3mVqtSEyUE0IM4Fk7FbkdzKTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786522, "uuid": "4f9cec26-b1d4-49af-a455-c7e3a3a86051", "value": 46648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786522, "uuid": "ffa9673c-a742-4103-afdd-e9825b1be43e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786522, "uuid": "530f3551-ce3e-4207-95d6-49db65ba6585", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d680ff-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748800245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800245, "uuid": "f5f1c1f3-dfb1-4d75-8ad7-9e6890cdff11", "comment": "Malware payload", "value": "8ce062ec5f7c25a3291ed6a89aff3406", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800245, "uuid": "c3ec1540-3982-4d0a-9414-620a2b24b961", "comment": "Malware payload", "value": "77d75e7c72f85ee6dac90beab9fc4ae2f5ef30ccffc7abd2f16db099c595b29e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800245, "uuid": "07d85477-d165-45e2-89e4-e92d58ae2a0d", "comment": "Malware payload", "value": "aa8567a480a296197e6711f05f804e317c06947d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800245, "uuid": "459c3934-15d3-4695-957f-a5e58db74ed6", "comment": "Malware payload", "value": "d3c45b7d154cc0ed83eb4e8bf778bb87825a27f5d2d4f0184d039b36aecd3fdbbe5d4830df98bc3985dee2268a9d1e4f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800245, "uuid": "d930eb1d-28bc-4158-997e-efa00808282c", "value": "T1B94106C9F4E7A47457E480FF291A8E8BBC2765D9251E0E2F1CDAB61EFD578828C10129", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800245, "uuid": "584efb7f-a354-4fec-aec5-0001924b71a8", "value": "48:+gSGWqtmG5BPm6ZwNqN/7joJV5mGutvAMr2KOyT1X41NftyqMiCNK3d0d2WWYIqv:+qAuBPnZMe/70JV9oAMrqyT1ozcq5CNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800245, "uuid": "b16bb2b8-9cd8-4a65-b0fe-1d07823987db", "value": 2166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800245, "uuid": "7197a72f-a867-492e-8f26-f85b3631e8f2", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800245, "uuid": "bf203f86-8bbd-4a1b-84ef-428da64c24e3", "value": "UltraViewer_Setup.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b0442e-3f09-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1748797183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797183, "uuid": "e0505f01-8a63-48fe-8111-3caef09fd471", "comment": "Malware payload (QuasarRAT)", "value": "a793e13f7d2a8263e3e412068c889683", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797183, "uuid": "910dc654-8347-45ec-b471-31b14dd20ea4", "comment": "Malware payload (QuasarRAT)", "value": "78daa33cb739c0b1648f17599695cf0fc5ad0b1c7640d55d91e1d534a024c6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797183, "uuid": "212862c2-1824-4b96-bd4a-595788fe061e", "comment": "Malware payload (QuasarRAT)", "value": "f4dd5537cf26ef2ba14caae3f4c5d090b340bacf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797183, "uuid": "360ca8c6-4a2f-479b-9d99-10546b715c2a", "comment": "Malware payload (QuasarRAT)", "value": "de352509b25b892a20873103e40acaced6cebc403ff4afbce4bc47a1f113ca90eea22f17d4f3f44320a3f04867f24fa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797183, "uuid": "336f4b6e-13e7-4b01-a14d-f0c64246bf5e", "value": "T102F67A0AC700A7C09D435EA6807B55710A4DCDFB8BCF8B91A344CB059372B9B6695BEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797183, "uuid": "6fe8ca39-f1dc-475b-ad1a-de12204a735b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797183, "uuid": "96fa70be-4cbb-4863-a347-bf6f3af469cd", "value": "393216:9XyO3Ymi2XVxfID0R1uRRwWzDhzKp9whFd:NyOoglxfID0OsWyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748797183, "uuid": "ce60587b-f0b2-4c39-a0a6-cb085a67c44a", "value": 16655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748797183, "uuid": "6a2152d6-a507-4a0b-a261-cc7cbeb6e143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797183, "uuid": "e901f993-0287-48a7-9f94-17cbe51c7acb", "value": "a793e13f7d2a8263e3e412068c889683.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4802094a-3ec2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Akira)", "timestamp": 1748766460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766460, "uuid": "0dc43715-5e71-48d7-93ab-7020fa1be691", "comment": "Malware payload (Akira)", "value": "3dd09859e6326eeb09f023dbf1b81290", "object_relation": "md5", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766460, "uuid": "ea68273d-238d-4856-bb43-0a9cb26dcad8", "comment": "Malware payload (Akira)", "value": "78ffecf887f745fbb0bf9a1fff8b5ad288c7fa0d86989edfa928a40da12e9a33", "object_relation": "sha256", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766460, "uuid": "e1dc2416-4a7d-4c38-a292-a40b456db55c", "comment": "Malware payload (Akira)", "value": "0690b0fba2a0d3ae5ec50f8feafcef306dab3cc7", "object_relation": "sha1", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766460, "uuid": "6358d1d1-ad86-41aa-8eec-39f1531bac05", "comment": "Malware payload (Akira)", "value": "ee568db9e15d2fcbc0f227d701cf69e5f8b0cd78a35d84f67ce28519b1517cdb8dc77fb68b602d7820fcd4b98fffce3c", "object_relation": "sha3-384", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766460, "uuid": "20947cfb-b2fb-496f-a398-0b60e6be755f", "value": "T129352A41A5164AF6F6528ABE4A32C02FEEF736050B11DAE74581763A2F070ED2F7C359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766460, "uuid": "0ecf80c6-16d0-452a-a5ff-24ae1c1aa33c", "value": "6c864ce260dd3952094fbdbfe5597535", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766460, "uuid": "f93b9dd6-7bea-428a-a39c-b92e8286f4f0", "value": "24576:FTyLPsJjVjzhWwiENiUGC86pNV2GNxgr+oBwGDGs:FTyLPsJjVjzliE0opNV2G7gr+o+Gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748766460, "uuid": "3b7f58c4-8cc2-43f8-ae19-edabddb3f138", "value": 1076736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748766460, "uuid": "21944cb4-1559-411a-b751-69aa7ece55fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766460, "uuid": "315634f3-d11f-4be2-9129-4e901a130cba", "value": "78ffecf887f745fbb0bf9a1fff8b5ad288c7fa0d86989edfa928a40da12e9a33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b2ce68-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748786540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786540, "uuid": "5912ff23-c94a-4a5f-aa4a-e6e8b530a427", "comment": "Malware payload (Gafgyt)", "value": "66088b44e11687b9359d9877489c497a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786540, "uuid": "60bde324-7045-4c00-a575-2efc04330d98", "comment": "Malware payload (Gafgyt)", "value": "7a6a7192dffcfca9817b6d17eae68da7ab4ecfff60327edadc88619b6e8f5577", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786540, "uuid": "f4099621-40d1-4c08-8e79-2ada20ddd66d", "comment": "Malware payload (Gafgyt)", "value": "788c600e8a28bf4dbc20f9681f70a060fd01bcd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786540, "uuid": "a0281d59-0d82-434f-b1e7-e6d07b7bb0cc", "comment": "Malware payload (Gafgyt)", "value": "35f5dd41c5f0ea634772e2bef201143f787310f6384631cbd2cf3ec723a3909e1297823f5142cd73037a47718336e10d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786540, "uuid": "00b5990a-1ce4-4609-ad7a-277d8b2c19ee", "value": "T1D9E36C2B75C18CF5C00285B126DB63549923FE7F0AB62147B7947DA0BF398C94E6ABC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786540, "uuid": "66df7328-cb92-4f7c-815a-62197f7ab966", "value": "3072:x1gim2foydLGtd7XXbuQKk8utJ8adPF4KQTnsW/Q87w0TaiaebvfcivGmS+Qk:iyhyRXL1wutJ8adPF4fvQ87w0T0ebvfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786540, "uuid": "2565e0e5-e1d3-4bd9-901f-9c1e4a10eda3", "value": 143588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786540, "uuid": "2717a034-83fc-4937-935f-b2a188dee41b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786540, "uuid": "4ffea5df-3761-4c2f-a371-b304d9bdaf9a", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c51d2df-3eb1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759165, "uuid": "8b75ca8d-a824-4e94-84a8-5ef2301b6200", "comment": "Malware payload (Mirai)", "value": "3bbae46f44f9be739d994e95d6290638", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759165, "uuid": "9c8c826f-9cbb-439a-82d2-a085ca12d17c", "comment": "Malware payload (Mirai)", "value": "7a9facf0f24fb1243ae797a8efb3c804a829eef706fdb9fd8c5f25776920d3b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759165, "uuid": "764da048-cb41-4c7d-b2c1-00335a50c499", "comment": "Malware payload (Mirai)", "value": "a13a8c08211e5721fb94083623c3a0f7e294cac1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759165, "uuid": "8288a069-e6d2-4c01-a252-82a39821f823", "comment": "Malware payload (Mirai)", "value": "9d52368166a0a900120aa364c0a365840516a9e8100ff75ffcba8cbb6a137d88f5ebd2dbdac3455bee158a0c48fe19ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759165, "uuid": "0dbb9721-504c-4300-bc25-043f6989e2b6", "value": "T109F2F159902244F1DC16C5B10CFE0C4FC9B2F402BB17CF85A1AACB94CCA654D5265EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759165, "uuid": "2c67da30-9b9b-41d7-b921-c6ef9545962e", "value": "768:jFHTzenBhWaAOKCuwwAxSDiej9DF00BsWIcJImqo4qFLz71lCuF3:xHneWKJVoBD+6s5t+RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759165, "uuid": "5c0fc03e-f8a6-4fd0-8a2c-fa53e70aee08", "value": 34396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759165, "uuid": "acee6a4f-dcd3-4c81-8536-f5196afd9885", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759165, "uuid": "483bf960-716e-40c8-8c1c-2ad9a03fd555", "value": "neon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbc8276-3efe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748792185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792185, "uuid": "6bb953ef-13eb-4319-95de-db46c69d5df0", "comment": "Malware payload (Mirai)", "value": "1661a39515b3c9883ddca76f18494fa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792185, "uuid": "6458e266-7e27-4d84-b0a2-05e3db689f78", "comment": "Malware payload (Mirai)", "value": "7b2e70fac4a4ab21609ebd9b05fb271441726e8f26b3469853fdd70050e08f8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792185, "uuid": "dbbff323-20c1-4621-9b0c-65c031b891f8", "comment": "Malware payload (Mirai)", "value": "48cbbf91cf10811feb31f234303efb907b43a86e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792185, "uuid": "f14a52b4-58f6-42d0-8805-e1402e33ab5a", "comment": "Malware payload (Mirai)", "value": "457916ecd8cd82b8ebc17e8c625c9ed497486a168f67d059e86f2257416e517eafb63fbfc6cc196831c54685d2b475ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792185, "uuid": "745c4c7e-95d9-4bfa-bd00-2cd9b879c640", "value": "T154C32A46EB818B03C4D61776BAAF42493323E754E3DB730689286FB43F86B5E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792185, "uuid": "cda7f991-6a80-47b1-b83f-650b150b2401", "value": "3072:tXMvHQvzXKeN6y0LIJNNBi7c8y+2jvM/9D8zKEE0i/:1MvHQvzXnQLIJNNg7m+2TM/9Ei/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748792185, "uuid": "37421842-1816-4634-8b5a-0410c5e3213e", "value": 121950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748792185, "uuid": "604da5da-a5e4-4d98-b453-3cc34f026d98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792185, "uuid": "44f15609-3a7a-4fb4-83f1-b40fab3d2cea", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8021286b-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748800055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800055, "uuid": "597b01f6-d8fa-4be5-8e0a-40254683a8a1", "comment": "Malware payload (LummaStealer)", "value": "69fc91948da1ffde62e5f89cc49197d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800055, "uuid": "4aab60dd-8cfe-45d7-98bd-7e65eeab20fe", "comment": "Malware payload (LummaStealer)", "value": "7bb43f789b0b088bd5ab10c0f7a60cb1e34fbc70fc742914fc2f8bccdbf1eac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800055, "uuid": "16c7d802-0e1f-488c-ac1e-87701a8899e1", "comment": "Malware payload (LummaStealer)", "value": "7f30f9e6cfb28e1aac690f6ef601506be84989fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800055, "uuid": "b5704444-6834-4209-a7a5-daa8971d11e6", "comment": "Malware payload (LummaStealer)", "value": "314ff5998ba7041709668f78f0e2ef8775ea1e1a9fc4177003e874fce427ee50a9310a198c3a14f7c156fc2b796a37c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800055, "uuid": "1565870b-e065-4d96-bc92-42c2625db849", "value": "T123953338CFE677CCEADE01B64F526249D961539F72A4B74EC88E863DC09205AF9C3521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800055, "uuid": "7037608c-ef55-4ec2-92dc-45da31f00072", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800055, "uuid": "63d376c9-3bbb-44d2-9337-bde0b4745e36", "value": "24576:ZaTVtL6ext7eT69DertUv70mYPSqC1/st740dkI4nGgLfVfqZwCUzmo4K2ZU:crHAJgPYa/erD2Gcf6zLZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800055, "uuid": "7e71d1fc-78d9-4525-a802-bbcddb9841a7", "value": 1925632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800055, "uuid": "35b4d264-9a3e-498d-abda-8a19f107c619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800055, "uuid": "a5ab0a8c-74a1-45e8-8315-036c04ebfd85", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bde8aa-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748786181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786181, "uuid": "69817375-8d92-43c7-ab2a-a27c38f0ccd2", "comment": "Malware payload (LummaStealer)", "value": "fe4875804b03343e3c98726d681c2288", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786181, "uuid": "72665f60-27a6-47c9-a63d-645709b86eea", "comment": "Malware payload (LummaStealer)", "value": "7bc20c0d14b32bbe08817ebe1926bc293da2091bc4c18e8d61cc53c8d8bc6984", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786181, "uuid": "fe16a9ff-1ec2-40a1-a349-5a7ba0bd41fe", "comment": "Malware payload (LummaStealer)", "value": "39479a176610e6655fec8e8edc94b7171bb2052a", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786181, "uuid": "a2e600d3-480b-41b5-82b4-0fe3f9169be8", "comment": "Malware payload (LummaStealer)", "value": "10d841b4242a187296fa952388c373ffe336284059608d490e151846213a49910779b7d1919fd43a76b95a298194268b", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786181, "uuid": "92b85df9-0314-4b6d-b2f0-8eb4c1190bbb", "value": "T1E318332E388ED39DA2358E57D8C9BBCD50D2E116675DC12613EB839519EE03B780FC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786181, "uuid": "4e16f980-d74d-4c0f-b30c-e416aad70d13", "value": "1572864:hQZKaFPMQpmGH/b0LfOpSWRdCyxvHxlcJOhTspnrCuYtus556sWll7OgCWTw:hQMaVmAbnpSWR4ytReJks0TzbCTjCWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786181, "uuid": "527533c9-0020-42c8-8395-e5b2826e9f9f", "value": 85223646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786181, "uuid": "1c95a364-5de6-4273-83aa-90c8d82bec7d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786181, "uuid": "245f2a89-9b4d-4633-96f4-b7b777669748", "value": "LatestUpdate-20.05.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb52c8a-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748786550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786550, "uuid": "f3b421a5-4c53-47e8-85c1-0f106841eb7c", "comment": "Malware payload (Gafgyt)", "value": "55ea9784896aecd943ff89c8212358c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786550, "uuid": "ef0aa937-a12e-4ee7-a2db-8404753d7fd4", "comment": "Malware payload (Gafgyt)", "value": "7ce10f6336f0fd8a492a8f38552ae1a168af9c3eebe6dc29ec7105fefef2d910", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786550, "uuid": "88b9353a-6d12-4bda-8915-f8d4e3d93233", "comment": "Malware payload (Gafgyt)", "value": "dad7db395ef57ae8d0ff2e7fec5681cf19a0fdb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786550, "uuid": "0256f1a3-c131-4099-a602-adb62ebc8f0f", "comment": "Malware payload (Gafgyt)", "value": "6389ed97fa8d0581f2064aa88e21a24771630cbed4a5c80872381a7ab2e71f4c078388a71033adf0f9b048bed5672ef8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786550, "uuid": "f7f36d60-ea15-4bf5-812c-4bc2a49074b6", "value": "T1B9D30757F800CEA2F4099A7601D35721B671EFB70E8322B2A64B3966AE712D53477FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786550, "uuid": "08f428f4-b83a-471d-9039-5339aed6fd87", "value": "3072:wYH5Ycv1SUm9GGPwKa2ZyR4r/GRZgq321Ub6HtamMqKQiVGngBmk:wYZVU9GGPwKHyRW/GRZgq0kmMqKQigno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786550, "uuid": "35c10c6b-f865-4cbd-97b8-4e42c7cb1e35", "value": 141206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786550, "uuid": "b7b998d9-25bc-4f29-8366-6c5c1b177372", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786550, "uuid": "ec93f7d3-4fe2-482d-9471-0798b277657e", "value": "pftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8465736a-3eab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748756683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756683, "uuid": "7aaa1921-76a5-4b7f-85e5-fa4a9dab9bdf", "comment": "Malware payload (AsyncRAT)", "value": "4b4622e717c5a3099d32b98260b7528c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756683, "uuid": "4f6f4732-417d-444c-ab5b-9eaa23a98eff", "comment": "Malware payload (AsyncRAT)", "value": "7e4f335241d4ded5ea19bf5c92f8e70ea76de7167cd3691752b9386ff094848f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756683, "uuid": "9f031a40-66d6-40cb-9b09-86bd117164b8", "comment": "Malware payload (AsyncRAT)", "value": "300eca2f1db53da4e638b364531722d31e629c51", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756683, "uuid": "6cac5551-c2a2-4561-a33c-ab23451aaf61", "comment": "Malware payload (AsyncRAT)", "value": "ee27b498b3eaf12659fa790cea2c491b3ece7d7de535609fe4f18f8238c630ed2fd3ad587367e6ffef65a6cbd0782711", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756683, "uuid": "0ca9091d-c580-4e57-850a-fef655af527c", "value": "T16523C230CBC2CE7BFC088C26A1A39525558AD87F606D30F7BA7FB76A4C9520AE15F154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756683, "uuid": "0c2220f0-dc5d-43eb-b6ec-14975e9d71ef", "value": "384:lMztoxTRWPR3pNlG451imdbvpJLXdNIIEjbOljLr9hs7XiSZQSatQSnSayw8nh08:cDCnbnmn/nanr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748756683, "uuid": "d4ec8d62-0e48-40d0-967c-dab9a33ed1e0", "value": 46678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748756683, "uuid": "d450abd6-734b-41b9-a43c-8b603600fae9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756683, "uuid": "779c77e1-0d6a-447f-9e92-72439557774c", "value": "new.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e162675-3f0e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748799004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799004, "uuid": "5e752dd1-8c40-4ef7-8c8e-24e2401e925e", "comment": "Malware payload (CoinMiner)", "value": "5fde976692ae5ce521d4e2ab101548e7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799004, "uuid": "668d11b7-1ad3-46e9-a687-1de7147a64b7", "comment": "Malware payload (CoinMiner)", "value": "7e9754bfee8a75295b83f640bf0b9996c85737af832cc5ae7f88d4e41b07057f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799004, "uuid": "7bbb98e2-1fe6-47c1-866e-3fbe5e861379", "comment": "Malware payload (CoinMiner)", "value": "74de099aa3527fd873cc51384343055d717ef9b6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799004, "uuid": "57afa03b-8454-46ca-8a31-342e25bafae2", "comment": "Malware payload (CoinMiner)", "value": "cb1c6188e573c46ae39381eec267250a9607e0b78fa8bc5879009bfcbc33409e0914db20716feecc61dfad807e8bad36", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799004, "uuid": "8f2e53a4-e492-46a2-acb4-704a638fd4bc", "value": "T1B5B6E077E4272ED6D1B96635605192822E31BC872F62A3C33D80B6293BB36F04F75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799004, "uuid": "ec681265-64e0-4cdb-9999-b88018a131a2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799004, "uuid": "971470b8-ef13-4069-ae0a-e33f9be67061", "value": "49152:iQUkntsfnupqIjqWRKP3ba6D/iVrNe3KYgv3vyX4rF9P2zznV9HKhBRuujAqVR3Q:iWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799004, "uuid": "a908647b-2220-4f3b-b9be-e4ecdaca3475", "value": 10536448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799004, "uuid": "623fd300-c12a-4b43-b0a5-6c0a606f5af5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799004, "uuid": "f0d825e2-1021-4738-952f-275ab7da19a7", "value": "5fde976692ae5ce521d4e2ab101548e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040b9e40-3efe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1748792115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792115, "uuid": "71202a86-294f-41c0-94d0-3fc0120e5d56", "comment": "Malware payload (DiscordTokenStealer)", "value": "1baaac27895f19dce9f21cca0fe87b9f", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792115, "uuid": "14bb731d-09fd-479d-a5c2-049056248b5e", "comment": "Malware payload (DiscordTokenStealer)", "value": "7ea66dd7140c98bbfec90df4fb549e8a350d41abab54c4c6343f36ba9931db60", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792115, "uuid": "6650a2b9-3ea4-435a-adce-7e2febc9c938", "comment": "Malware payload (DiscordTokenStealer)", "value": "663d5ca4307229d5dd16631802f8f39b80e7fe0f", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792115, "uuid": "abadf92c-ca44-4622-b105-06211a7b091d", "comment": "Malware payload (DiscordTokenStealer)", "value": "76068b784e44e828818a1f6d29416d74293bbdaaf3cbf06c715bbd41b15063e65a1cabf645b432174c6481a5b692ac1b", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792115, "uuid": "3759268b-69c8-4987-aef7-947fe823cd80", "value": "T1FDF7335C7718698AE698933A45228E09DAD8F00E175FC44B67F424252C776CFE6FEF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792115, "uuid": "5586740b-71e1-492e-930f-bd1151e34e30", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792115, "uuid": "f6113a2d-15d6-40a9-bc63-487f84c1b861", "value": "1572864:hScKbWetPa89Vd1AEJ5Rh1+BDDy4gds8KN2LCooeSqjGUZC4dc:knrPlVd1AY5bADDxgds8kNeSqj9C4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748792115, "uuid": "1ce46e71-affe-4208-9b36-00113eaa2a5f", "value": 77006178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748792115, "uuid": "5a292f2e-27f7-4287-a0d8-c39e36b07c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792115, "uuid": "642e9fbc-ea20-4e0a-8482-68ff732a0bb0", "value": "Triggerbot_esp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f29445-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (WSHRAT)", "timestamp": 1748799663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799663, "uuid": "3a7c73d0-955f-43e9-9aea-f9be974f20be", "comment": "Malware payload (WSHRAT)", "value": "3e27c4384a51eb7f1a8ea593509e048a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799663, "uuid": "8a923210-78d0-4ed5-928d-31081a97bfe8", "comment": "Malware payload (WSHRAT)", "value": "7ebcd8c80f10d4adda75785fbe9f86df40315d49689c51c38c019f8f8f098c80", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799663, "uuid": "0f1a1e31-826a-4e9f-8a9e-e12b8f7afad0", "comment": "Malware payload (WSHRAT)", "value": "ee4d73c97a983169b12c9b6897edc2a4d88f3af8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799663, "uuid": "71b55780-b302-4124-b500-22832ef3d3cd", "comment": "Malware payload (WSHRAT)", "value": "986f0db739a5846939c7126df4ffe809b40a62e1add9b16f72c4564d97919972d7889f477a5a8008f9491bc1d9100191", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799663, "uuid": "4bcd1ee3-f257-4d79-ae1e-4eb4dfc036ea", "value": "T14865B986379DC9CB18AC372152EFBFBDA2D386316077A2FC14AF8497CD145D40BA446A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799663, "uuid": "a0bacca6-358a-4771-9345-c481e5b672fd", "value": "12288:YX9VLA7h8t1qWiwIo8j0ogKMbrnPSV1fwHA0H+i9gZFGGsKIqGYFUmM7c+X:Yoyi9o8j164foND94FGGsnqGEUmM7c+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799663, "uuid": "3951c5e8-5b13-41c5-82d6-c800666c7d95", "value": 1454907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799663, "uuid": "5d6d0240-d5b7-4770-b41f-973a0495bca3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799663, "uuid": "90ac6c34-7a4e-480b-b580-35e4033ae0e5", "value": "fi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdd9f6b-3eb1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759171, "uuid": "4845dee3-b4c8-4e0b-8207-6e8671f0cfe5", "comment": "Malware payload (Mirai)", "value": "e91951a13993e1d2ff64a5781d191ff4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759171, "uuid": "5f09aab3-bc78-4fde-bf5f-3091f06bcee1", "comment": "Malware payload (Mirai)", "value": "7ed1d1da1b8568bb39e205ef8863e4f321166c6d3637a3c4d4953a8527f81da9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759171, "uuid": "8dd09baf-03c3-4ebd-900f-967038afcd80", "comment": "Malware payload (Mirai)", "value": "5d23022be2ca4f52bb280555ea1acf322da3f61b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759171, "uuid": "3f6c9317-df5d-4901-9182-61d84f24be7e", "comment": "Malware payload (Mirai)", "value": "0387c40f74efb367de0078a7ff83bcbf4b74ad1ad7e3167e137ac62dadfb243345b2eaf9d85bfe0ded17586ee636c2a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759171, "uuid": "ef46c419-ace3-4725-b58c-55567be1d015", "value": "T1334302D1E651AADECFA34EB60CD69AE567405A81B251CC43ED4423707A62AB08B07FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759171, "uuid": "111dd314-fc7c-4ec8-97ee-b02d77a5d2ea", "value": "1536:8p43A4oKAmujRNIxf09WBBZYwrA4lCx3IAKq9ezW4u+qgw09H:8p43O6++BZVru3IAp914u+qgwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759171, "uuid": "50517656-5d08-409f-a56a-754df093e0c3", "value": 56944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759171, "uuid": "d92927f1-4837-4ca9-9d77-5341af1397fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759171, "uuid": "4057cb14-0df7-477b-aa18-2c422531dde0", "value": "neon.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f17f254-3f11-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748800348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800348, "uuid": "c88f4fbc-1b9f-4a4a-9159-2b65fa44e47f", "comment": "Malware payload (LummaStealer)", "value": "633b795279a51f0427a86f3bbc1a45a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800348, "uuid": "bec346ab-2415-4fe6-bef9-3e7422fd65b0", "comment": "Malware payload (LummaStealer)", "value": "80052df31374b409c3ea4c8829fb05e9c7cfa00b62a9720051ce947f9dfb4b03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800348, "uuid": "937ad647-649c-4831-8290-d8099d251e4d", "comment": "Malware payload (LummaStealer)", "value": "863388c6bb826c49097f02f91557b2bbfafe8d17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800348, "uuid": "1303fb6a-da70-402c-9405-091ae061d720", "comment": "Malware payload (LummaStealer)", "value": "fa97dbdfff5f661e31fccfb373f6bf4ffa7c5cc2a03345f681a9df2ca5bde5e366f6b12e60fdb88fa2546b9565fcc24e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800348, "uuid": "91f995bc-e48f-41a7-bfae-33b9bcaae727", "value": "T1BE75BE389151A1DAFC6600BA49B1A1957822B333C63D2FFF8290E373AE077C55F69359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800348, "uuid": "d5cfd3da-3085-435a-991f-72baec1fb02e", "value": "bb36df4412e03dad091fc4f040871a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800348, "uuid": "63039e95-57dd-4992-a5e6-28194b6e9a2b", "value": "24576:sS2f+i6umQ5MM0FeLVePFjvOQ5uCCXJnA2UGM7JeJIIfzgJPAZU4ldIfzgJPAZUQ:S6umpEVeF7tqaJe8Wf7WfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800348, "uuid": "818373fa-61cb-439e-80b3-3dd7280297de", "value": 1663528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800348, "uuid": "8ec4d163-3592-4495-b42b-954945124e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800348, "uuid": "178d3758-4c2e-4c03-bd1c-0a80c6ce2a40", "value": "sGe7ljJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813b11c0-3f06-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748795761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748795761, "uuid": "650f595d-96aa-4383-b8ad-4ece201637df", "comment": "Malware payload", "value": "140146295a7f1ee2ef72d69be21cd5bf", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748795761, "uuid": "e0f097ef-943b-4f5d-8288-f0ee22c84209", "comment": "Malware payload", "value": "816ec38b75587ab0c27fa093a903412afeb271829c0cef3d0493e8e161d1cb66", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748795761, "uuid": "0a70a31f-643d-485b-8552-02cda5f5b61c", "comment": "Malware payload", "value": "04bcd000a60011db51b398f75bf7040c9059677b", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748795761, "uuid": "0ab4c31c-c5e9-4f13-b2bf-3badfb94713d", "comment": "Malware payload", "value": "a0f0b1d6b6c77be8b3bd04b730e602adf167ca18d3f4fdf95482e8418582b510dc35ab0b15c3cc39b41d5ee189be0436", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748795761, "uuid": "4222e451-887e-4d42-935f-65eda436414d", "value": "T1BCA3E101E670C033E8B706301977552A6FB7AD38D0F5264B63845A9F79367828E1E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748795761, "uuid": "a92f9ba3-b5bc-48fd-86ec-bac0bd50569c", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748795761, "uuid": "6a59eda5-3692-4486-b45b-4f31a4fdac2c", "value": "3072:OUc061qnIgiFwmg7y5LTZDTbYr513Q3l3rE4rBM:20ag69DTa3QprE4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748795761, "uuid": "873c5000-2d97-4b20-aec2-52aa9fa0d0a2", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748795761, "uuid": "7e5db87e-a31e-4858-a861-d343abac4f70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748795761, "uuid": "f21549e6-7bdc-443c-acec-432169a31d08", "value": "lnstaller_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30828aa8-3efe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748792190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792190, "uuid": "ea0a7f5e-4edb-4eb7-99f7-ec9e7c007af0", "comment": "Malware payload (Mirai)", "value": "279cadc27f63604f8faf97d8922cc7a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792190, "uuid": "fc8d6411-e03b-4ff1-bdaa-9a0422962227", "comment": "Malware payload (Mirai)", "value": "825f68a91c26e29208f7365074ab4b49b94f1c36fb4f2172e979d1e6077bda2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792190, "uuid": "0f84ecdc-ec2d-4c20-b026-8ea5db0c9b28", "comment": "Malware payload (Mirai)", "value": "9ace058d027d03e2624790644b2b57d97acae7ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792190, "uuid": "6e5abcfc-a145-43a7-85cd-f776d3c18c5c", "comment": "Malware payload (Mirai)", "value": "a81fc660750c5fea5c5122a6b94db87574d3fda3a2b52fd96184d407eefecb2a376ededfadcf9573fc7a2090bdc20ce3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792190, "uuid": "a0b483d9-b0e7-4ea5-be01-60981151b47e", "value": "T12853970A7E21CFBCFBAC873447B74E219658339526E1C584E15CEA015EB070E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792190, "uuid": "52aa5630-ef2e-423c-9a90-0d3652d618cc", "value": "1536:fONIacDuqM/00/BTjEDovwGTJgK3z6sCqltS23BkB4:WNItDv8ZEcvwGFz6sCqlU2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748792190, "uuid": "349de70f-3070-4ea4-b7f5-f07e79155ed8", "value": 64604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748792190, "uuid": "e7b8c66b-d1d2-4502-a349-831b366bb274", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792190, "uuid": "821950a4-2e29-4fc9-b83f-4ceb34a8e69c", "value": "hoho.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a3ad94-3f00-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1748793264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748793264, "uuid": "4902e729-b2ba-4c8b-9165-d5084544be75", "comment": "Malware payload (Gh0stRAT)", "value": "1b84a3e63fcf0044132ba1af27d2abeb", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748793264, "uuid": "651969fd-7028-4b1a-b581-38709942cd15", "comment": "Malware payload (Gh0stRAT)", "value": "82f5167fbf9541fb2f97add03ae8ddb5eb37c1c785948291be4f5bdc4e0b9828", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748793264, "uuid": "91ce7b25-e9ab-426a-b236-a10e0725121b", "comment": "Malware payload (Gh0stRAT)", "value": "9ef3a0d16f9190af6b439cb81d99096d846f277c", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748793264, "uuid": "b90db5be-4b68-426e-85fb-00e10cd5efdc", "comment": "Malware payload (Gh0stRAT)", "value": "76fa857171d6ebc4a34c247ed8d4bd06b6c40e4dc87dfa2908f7e366ec853334719f1b16fa810ba29c580b63d6c73a42", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748793264, "uuid": "d6fbae14-b14e-4d93-a015-1619707978c7", "value": "T150B63348CCEC1679C99F3FD730A4A67365C9B8494B7BC992BAB8D8C1115F90DC832386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748793264, "uuid": "27620775-a042-4783-939d-cc335297182a", "value": "196608:WrZvgHgDYkIYfp21gWqRkFUPh7621fLQREeZb7FTATsyBomcb40RC4JsfAD:WrZvYUYkSzqG21fLQ6eb7F8tBDcxCJfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748793264, "uuid": "624f0591-76d2-47a0-a504-bf8670c9e18e", "value": 11302863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748793264, "uuid": "b3c2d0b8-4f7a-4b36-8c97-e6e5fa003155", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748793264, "uuid": "2f996b33-a411-45bc-aefb-fd7c4410c8f2", "value": "sharedcon.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5ee35a-3ea8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748755270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755270, "uuid": "804cf1a1-762a-46bd-903b-bc449d7e3f2f", "comment": "Malware payload", "value": "f86b63e6925e860799e3c9d05753d087", "object_relation": "md5", "Tag": [ { "name": "a17rrr1.oss-cn-hongkong-aliyuncs-com", "colour": "#7ECBCB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755270, "uuid": "d8dd2bc9-8f0b-43e8-9177-5fa06787f4ad", "comment": "Malware payload", "value": "83980c19359ee3b803a7f62738e6392bdea11e84e8d8c4502f1d82f1132382a4", "object_relation": "sha256", "Tag": [ { "name": "a17rrr1.oss-cn-hongkong-aliyuncs-com", "colour": "#7ECBCB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755270, "uuid": "13f1fbd1-5cf1-4acd-b8a6-1cda4fdf9b89", "comment": "Malware payload", "value": "cfeaaafbc94eb877cdc4bb06a97be4da23cc7420", "object_relation": "sha1", "Tag": [ { "name": "a17rrr1.oss-cn-hongkong-aliyuncs-com", "colour": "#7ECBCB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755270, "uuid": "a88074f3-ec1b-4d25-a782-612f2b17051a", "comment": "Malware payload", "value": "c29706752f85b1dc712a4e307c658dc3baa105321380097b6b218348db467440fadd7d0ce6ea668b89ba57d66eb8524e", "object_relation": "sha3-384", "Tag": [ { "name": "a17rrr1.oss-cn-hongkong-aliyuncs-com", "colour": "#7ECBCB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755270, "uuid": "d1780cda-4257-493a-9425-b4ebdebed79b", "value": "T170F3E07A87DABF9BCC0553B4B5D346D63075E10B8B13850F68CC22335D533E19E9269A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755270, "uuid": "527b6d95-56ce-46fd-96d7-9db7fd7a3324", "value": "cb81180ca83a5c87b472233f54f8a46b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755270, "uuid": "d019f268-73d2-4213-baab-36b5492c4f50", "value": "3072:gnOKumBD7EDSAPQ7iV6UmlczD6ABoTGeztIHkObg8q+UnVT/l7+S+yJW:/KumBEDbQ7iV6Umi3jSx6bQlPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748755270, "uuid": "69c0c5cd-4f6c-4c12-9771-0e9d08351636", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748755270, "uuid": "b3b77f5a-c619-4a41-8832-3ec6b4e4a0dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755270, "uuid": "119a80ca-78d1-4883-9512-bddb42246e73", "value": "k360.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85ffe81-3ebe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748765038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765038, "uuid": "59759a9a-b7b5-4543-b2a0-529dbb728192", "comment": "Malware payload (LummaStealer)", "value": "432a6e0f35f812d5c808192fea466b4e", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765038, "uuid": "352080e9-fd5d-4746-b1a9-2a1c17af0e2e", "comment": "Malware payload (LummaStealer)", "value": "849288791072a40d933ebc102f60d79145e7c2d5abfb0171f02d2ce9fbe7ea17", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765038, "uuid": "c43b57ca-2cdf-4172-8dc5-c6d6407df990", "comment": "Malware payload (LummaStealer)", "value": "a7959586d62e3f21dcb6df7f8e2bf9b28ccf8e56", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765038, "uuid": "63542f50-393d-490e-baaf-868d7cd4770e", "comment": "Malware payload (LummaStealer)", "value": "845980d0463eba457be17a2501c7bdfd0a9154ed0b0688d0b0fb22029130defee2837fb3a624a283b150a110b57be29a", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765038, "uuid": "0e5842e3-7989-495e-8668-36fb5c6df0f1", "value": "T11E65333C29A9774A24E61D0AD0998CC4B13F4549F23BC6E3DDA10C6BBB85686C6673C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765038, "uuid": "7b0ef987-a876-4b2a-b435-7015d5ba5ee3", "value": "24576:li8/u7dQRwBLPGVyzs1U2LgOnzss3sDXSw4PfFTnFdmCrdvO0qIRm93twZ5uU:08/uZRGkiHLlos2SjPdaCrVO3XmZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765038, "uuid": "f5bef470-ac42-406b-ad80-c6308466d935", "value": 1438698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765038, "uuid": "331704e0-09a4-432f-93a7-5055462ca0e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765038, "uuid": "6ec174ab-ebab-4cbc-afab-cbed79995ad1", "value": "mal1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0207f2b9-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759470, "uuid": "e9f4b8dd-2839-4dad-983b-5ca0ffea4fbd", "comment": "Malware payload (Mirai)", "value": "d6e3185cd341f847778a9b8f49375ab8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759470, "uuid": "e88db606-231f-4dba-aeef-8cd2d0f829c9", "comment": "Malware payload (Mirai)", "value": "8499efbb1e96daf410643660ac27f0c27555c313f0c2057df963cd874d1f1723", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759470, "uuid": "540ffeb9-dad0-446a-b910-611c22fd79b8", "comment": "Malware payload (Mirai)", "value": "3b95c4af91b95752b3b449f4d772a855f79a8e8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759470, "uuid": "9ba165e1-0035-4f43-bd35-620095e71daf", "comment": "Malware payload (Mirai)", "value": "349f9cb61d9528b01c0a44ae110aef999f806e7ab8040ac56b55a1011ac198da14fec0f32ccabf57fbd01432e1e1b21b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759470, "uuid": "dfa45281-a572-4b38-babd-23bcb407bc5d", "value": "T1C2E2F153FBFA2C4ED416807652A978563C338B215D3F6BF03F6D0AE26D811F42578861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759470, "uuid": "0260f91d-7c7d-4d59-ac65-8deac38c1a14", "value": "768:EbOTxuMSZBKiY541DDeTBOUv5i3Wplqupsk+GW6:zH5ODyT84iQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759470, "uuid": "09792e3a-e974-4c34-8ae9-54644dd95fc6", "value": 32988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759470, "uuid": "321eb183-acfd-41b7-8d0c-863e592f0824", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759470, "uuid": "cc003798-7da6-42e0-a0d3-cc5f116b2742", "value": "neon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b274a8-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786510, "uuid": "53eccbf6-a466-4727-836f-a9ca54d06ab8", "comment": "Malware payload (Mirai)", "value": "4037da27a01b87d9569c747d1259c7e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786510, "uuid": "2955bd4c-7d41-45d9-93e4-b9b3db79f8ca", "comment": "Malware payload (Mirai)", "value": "84bae18a3bd5965fa400b81d5b387de2e6a9b74130c3b567b446139795e99be1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786510, "uuid": "0c2494e4-e349-4b61-8324-1bbe6a04c22b", "comment": "Malware payload (Mirai)", "value": "68d1aebb961ed71e7a0af59864f1358ec5dd2868", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786510, "uuid": "0acb9770-7bdf-4048-a7a6-099d9ea1ee3f", "comment": "Malware payload (Mirai)", "value": "b06f683aff6b99ea27b4f051f8e9ef4350fe0bb2e57d6950a5dcf8abe14844d4eb40473c108dfe8fa8ec733f340861d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786510, "uuid": "4d644429-c4b4-4ff7-b863-d7b8cc41ef82", "value": "T19392D170546B7570AAF00EF4EE3D888637694FB8C57D743C6178A2285C9640DD53EA8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786510, "uuid": "243c0f35-629d-4785-ab06-3d98acd6d8c7", "value": "384:Kl2prMH7uVUIvBk2pjBM4HzuS4LLY0qBHAb1dXCcSSdk2YG51/hymdGUop5hWw:KlKrMH7uWI+2ZGmzuDdqJKdSTSdNbLsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786510, "uuid": "21842976-dc34-412d-ad8d-b525857e81e8", "value": 19652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786510, "uuid": "3215df03-1c06-4449-8c9e-4ea06595493c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786510, "uuid": "d730c866-22bb-47ff-8e1d-029bde79c577", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc803cfc-3eb9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Latrodectus)", "timestamp": 1748762897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748762897, "uuid": "cca7bbfd-54d5-4015-b872-0f91ad2ab160", "comment": "Malware payload (Latrodectus)", "value": "330871792be237fb02d23114ae9be52e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748762897, "uuid": "0d9ef7bb-3206-454c-81ee-a2664828baa8", "comment": "Malware payload (Latrodectus)", "value": "85f8ccf69bed672d92b40c45f9571378a7d00c80b86004a76018d9e120eeaa01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748762897, "uuid": "f081423d-d855-4080-a155-3eaedd89d9ac", "comment": "Malware payload (Latrodectus)", "value": "7dc09a0716af7b39917ac0e772cf943888b8927b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748762897, "uuid": "a0417944-8aa6-447a-8ad4-6e454e1f4caa", "comment": "Malware payload (Latrodectus)", "value": "a912a4e2d66e83a10128a644a950667999e9590ab7e9dc984e0f691410f8f85e6ca0fccdcc630380ff036b8df9ae93c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748762897, "uuid": "4cd7f8b1-06ba-4d9e-9ab8-c542b8402f96", "value": "T1D586AEAAA6BC00D9D46BC1BCC69A6217E775B41513B057CF1AA486FA1F23BD11F7E300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748762897, "uuid": "13258dd9-e7ea-4140-b996-54deff78f3a2", "value": "9f4f6bebc128afddef95b3428263f352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748762897, "uuid": "359bf6d2-b292-47e9-9db3-85aa3f549296", "value": "98304:tQ5Nt5st7KZzD6NAWPIn2+z6/BiBDdAfoD+0AD:iNYt7KZD6NAmkTzeaDIoDiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748762897, "uuid": "be8a7578-0ec0-4295-894b-9df28b8f9773", "value": 7957504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748762897, "uuid": "a89fd827-a69b-43d0-a3b4-2b961b27f9bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748762897, "uuid": "c5449c33-7ec0-4d46-97ab-f5240fedce9c", "value": "330871792be237fb02d23114ae9be52e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d6e237-3ecc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Akira)", "timestamp": 1748770635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770635, "uuid": "c7c32eee-17ff-41db-94e8-fb228d9f47f7", "comment": "Malware payload (Akira)", "value": "e6580cfd266ee1f3a4835add61eed47e", "object_relation": "md5", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770635, "uuid": "5212d1cf-ed10-4b6a-a2a5-f515ed7fcc8f", "comment": "Malware payload (Akira)", "value": "865930cd680f5196672ec552ee19693a9e2868709b0cdb71674ded1f04c85922", "object_relation": "sha256", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770635, "uuid": "31d3e2ab-6b96-48b0-a45d-b7d1b000ce3c", "comment": "Malware payload (Akira)", "value": "36e0bfb49142e4dbd081b3ab198804c41d167ec5", "object_relation": "sha1", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770635, "uuid": "664356e1-f3c8-4e38-96af-1ad3ab029ecb", "comment": "Malware payload (Akira)", "value": "3d6eee13f596855ca7f4bc159589285e165c462ef1411745ba97a9791ffed690e92f74f26ce1e2ee7ed801ced32c9dd2", "object_relation": "sha3-384", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770635, "uuid": "aedb3cb8-6697-425d-9b7c-c3c4e47356a7", "value": "T1CA24130EEA28F4ACE03A543B8392D3DD69B53D510210167E1BC5BA8DC73A7606FD5362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770635, "uuid": "407b8b02-e359-4e83-82dd-680870b4ea57", "value": "67c9d6c07216ca5fe310108a7aa79f16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770635, "uuid": "5b6b52a0-e131-4fe6-a6f9-83544249e22a", "value": "6144:4VTORriIAgIJ5r9H3hy1VEjmG4EMfTyr0esrcI:QCRYgIJJ9Xhy84EIUsr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748770635, "uuid": "f63a161c-33fc-414a-a1c0-c4fec0ad364c", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748770635, "uuid": "d69ceb62-45cd-4dfc-accc-9622947ed9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770635, "uuid": "bf3a1349-b928-459b-9f0c-85b0b6f411cb", "value": "865930cd680f5196672ec552ee19693a9e2868709b0cdb71674ded1f04c85922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33020e98-3e83-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748739366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739366, "uuid": "899ef8a2-395b-4570-80a4-afc6dae2d90c", "comment": "Malware payload", "value": "1ba189c40da8dcc4188b3bce6059ed04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739366, "uuid": "bb29e92b-b777-4d38-870b-634c656686f9", "comment": "Malware payload", "value": "86b65da6efcd0590fff6e5597306b36e9ad762f5dd9414415f730ac82f393e43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739366, "uuid": "d6a44503-9720-482a-98e5-21192d089f3f", "comment": "Malware payload", "value": "edbdc4130f1a61f09ab1634c29b18ddd204932e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739366, "uuid": "79c55333-0a61-40d0-a141-ddcb80b4049b", "comment": "Malware payload", "value": "3e71601276a06b55a945f7aeb859e2641e2548b115cd0a34a06c74b37c051ed0347aa3371654e13523731f9b347ab1f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748739366, "uuid": "fd858941-95d3-4833-a259-fdb47bdf66ed", "value": "T196A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748739366, "uuid": "734b9795-b81b-4661-96ab-391a8bb349ed", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748739366, "uuid": "8d8915b7-4e5e-4914-a92d-5bae009c76e7", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748739366, "uuid": "737d6cbc-169f-4f5c-aa48-8483e98d9110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748739366, "uuid": "d9c31381-7128-4146-aa3e-def00dba1b11", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5642d22b-3f1b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748804709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748804709, "uuid": "51cf4889-caed-41ba-8e66-30f51e5e55bc", "comment": "Malware payload", "value": "8dbe010ce43734a1212afcba3e652391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748804709, "uuid": "e301e82a-0469-4d1f-8037-d297dffc7fe0", "comment": "Malware payload", "value": "872f2cc3920667631544379ccf461fc15e363f6a00058418acdd9f5dab11dd01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748804709, "uuid": "43f9b0d6-d262-49c6-b3c2-11d9de339346", "comment": "Malware payload", "value": "94655a9f4b0b65512828aec845b0b5b3b8798c2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748804709, "uuid": "9aa3eb8b-5902-40e1-ae7b-302d8c86d062", "comment": "Malware payload", "value": "30cf63f2b506a31b996a393ea1b538f6b1a252db739300cc5d08fdb5a0d1af167ab8ae6841f87204e3a2dfb963749df6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748804709, "uuid": "5cd7372a-7651-4643-a8d3-e84c621c1f46", "value": "T190A6335062940AE2F9FB9639C8D1C239F5F17823438BC5C797FC46533E13AA6583AB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748804709, "uuid": "7f5f5e83-2f19-4a93-90e0-e332ea6ecfe5", "value": "33742414196e45b8b306a928e178f844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748804709, "uuid": "3f7911c6-8d35-4899-88b0-cd1409a070ae", "value": "196608:f2Lb2F72VmDfyGgcwBdnpkYRMdUuvilrJBgdrNwgB:4LVmDfDgcc6dU5rJgdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748804709, "uuid": "32bd0b9b-3d51-4bf9-b3b1-2ea01e6cf583", "value": 9539497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748804709, "uuid": "c31f8df7-b940-4cf8-897a-0e65b1d93c3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748804709, "uuid": "d3e1a84a-0aed-4332-83dc-5131172f3dd8", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad6bb14-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748800180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800180, "uuid": "07f4629b-a010-4cc1-9b37-9f1179e509f4", "comment": "Malware payload (LummaStealer)", "value": "2d532267da3d472bbdc663ac1594512a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800180, "uuid": "60a25ba0-127e-4b46-b30b-4792bf779dd3", "comment": "Malware payload (LummaStealer)", "value": "876f89e39583dd386ee1b27dd83bc2351902ca39f2c4aae641cc456993515d32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800180, "uuid": "bd847609-f23e-4ff9-89e8-f3033f81ea39", "comment": "Malware payload (LummaStealer)", "value": "edb84fa18ab117a4e49d07596856499c8527e290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800180, "uuid": "5df93fa4-d6fc-41b1-9b12-4af6a16bf3c0", "comment": "Malware payload (LummaStealer)", "value": "39e987150ae389b1a3ae742bb9541111c941cac1f5d158121df5e8ab6e680f46fc666566bd26a84ac52fbe547e74f79f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800180, "uuid": "73de80a8-64a6-4431-a236-b768e9131e6d", "value": "T18275BF389151A1DAFC6600BA49B1A1957822B333C63D2FFF8290E3736E076C55F6935D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800180, "uuid": "c23ae500-6c43-4ec9-9b96-8591a2407764", "value": "bb36df4412e03dad091fc4f040871a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800180, "uuid": "a0284af1-8503-4c8f-905e-c8a3166f5ffe", "value": "24576:tS2f+i6umQ5MM0FeLVePFjvOQ5uCCXJnA2UGM7JeJIIfzgJPAZU4RdIfzgJPAZUD:l6umpEVeF7tqaJe8WffWfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800180, "uuid": "bbd6b059-3dc7-4b9a-a918-f3ce1289b05c", "value": 1653760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800180, "uuid": "4070f9dc-4720-4b43-93b9-03c492f24917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800180, "uuid": "018d7a97-2bcc-41c9-a63f-e653d14be54d", "value": "oeBkI30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d0ea86-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748798797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798797, "uuid": "b8e9258a-6c6e-40b1-bae4-787dec7bef17", "comment": "Malware payload (AsyncRAT)", "value": "06fedb7c36372b060aa32cc8f3fe6571", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798797, "uuid": "dba6f232-98ff-4204-b549-5fe208bc5607", "comment": "Malware payload (AsyncRAT)", "value": "878f501381d80c0578e66c3bbf2385ee202c2a305fbf6d17c59e2efb2ba07072", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798797, "uuid": "62602d0c-ee54-474f-adcb-58e1cc654639", "comment": "Malware payload (AsyncRAT)", "value": "218c641dcd88e9ec3c6e42e9d4f9a3efd9017f84", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798797, "uuid": "df1ff2ce-00df-4333-b57a-525b8b8ad82a", "comment": "Malware payload (AsyncRAT)", "value": "3d64a8e28b076f8db5a507434e243ecbe9a427d6a382455ae888ab3b1324a1378874031f430f4b137f7fbe02bbc8d986", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798797, "uuid": "196ded93-f6e4-48d1-96de-24d488fdc740", "value": "T10C357C299192A1D6FD2640BA45B172987423B333C62C2FFF4290E333AE07AC55F6975D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798797, "uuid": "3eb0a572-8903-405c-bd70-4565f7764120", "value": "bb36df4412e03dad091fc4f040871a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798797, "uuid": "d7926fb4-6154-437d-a8ef-b6a669689e71", "value": "24576:OS+WKRZXnrzljjjr05TrVIydQCkIcHsaUyXZNKlGVoTXkTjXdldM:AjAbIy9lcHsaU8VTjXfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798797, "uuid": "66a52139-ecf2-4b2e-95cb-a263ce0935af", "value": 1074688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798797, "uuid": "566c5a7b-d653-46b2-bb03-b4dc06de98f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798797, "uuid": "fb1a62f2-aa49-4fa4-bf46-8048b125b9d1", "value": "06fedb7c36372b060aa32cc8f3fe6571.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1dbd688-3ec0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748765805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765805, "uuid": "19a8cf4b-94d6-4bb0-b5f4-10425a22a979", "comment": "Malware payload", "value": "2c8f6e06dc22f00abdee164581fa553d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r1-nubex-ru", "colour": "#2F249C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765805, "uuid": "603e7fdf-a224-44b4-8dfc-f4808187d8fa", "comment": "Malware payload", "value": "879361ce369ace56a83cd94c526a34fbf7e9a701a03dec8e57ada6164d538843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r1-nubex-ru", "colour": "#2F249C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765805, "uuid": "c0ca2d89-8195-4444-b0b9-47d209d3c3e2", "comment": "Malware payload", "value": "171fe7391d040bdff32133d3445954a35fe1168e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r1-nubex-ru", "colour": "#2F249C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765805, "uuid": "6227977a-5954-451f-b89f-975d0d3b56ab", "comment": "Malware payload", "value": "160467d062f0674ff72788496ed84d4c5d210f7127f28277bb00128cd6d7c1a85fd4da428fceae877be430d15fc6b499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "r1-nubex-ru", "colour": "#2F249C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765805, "uuid": "c753991f-92f7-41d9-a007-4e3e74bf0e9a", "value": "T16B755AD2F181C4B6E81301B18D3E9F20255ABE79576465DB628E772E4AB32C32477E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765805, "uuid": "147044fb-95d5-4356-aa88-e1389a4b7bb9", "value": "e9a18295b3fe00449f587b8a33bc0e3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765805, "uuid": "cfd03df3-fff4-4c94-9572-55bbda685152", "value": "24576:LLILY8Xu/3y8UsG2BgYLicwnkNCHdebUKyZURQ1TgjTH:8YrC8UsGuTw0CHdeQKyZURQ1EjTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765805, "uuid": "7ba72187-10d9-461c-ae22-b39bec8eb128", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765805, "uuid": "57410940-1ee1-4390-9926-46f84f78094f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765805, "uuid": "6409994f-24b8-490a-8188-861338569223", "value": "17. \u00d0\u02dc\u00d0\u00b3\u00d1\u20ac\u00d1\u2039 \u00d0\u00b4\u00d0\u00bb\u00d1\ufffd \u00d0\u00b4\u00d0\u00be\u00d0\u00bc\u00d0\u00b0 \u00d0\u00b4\u00d0\u00bb\u00d1\ufffd \u00d1\ufffd\u00d0\u00b0\u00d0\u00bc\u00d1\u2039\u00d1\u2026 \u00d0\u00bc\u00d0\u00b0\u00d0\u00bb\u00d0\u00b5\u00d0\u00bd\u00d1\u0152\u00d0\u00ba\u00d0\u00b8\u00d1\u2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e508c2-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759770, "uuid": "035aa423-a19a-4c6e-9b90-fbab434a76e7", "comment": "Malware payload (Mirai)", "value": "db172c79d7eb25c3e58c42fcb48558fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759770, "uuid": "4723b641-74e8-4eaf-be72-7d8297832f28", "comment": "Malware payload (Mirai)", "value": "87aac359af14e33310c584403a56805d47cf85b8f42983f5ac5871f4cf24990c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759770, "uuid": "a1ae1537-e558-4047-9018-5d80600090e0", "comment": "Malware payload (Mirai)", "value": "75dd26c71aec2bfd06f36e150bab6dea72ee62ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759770, "uuid": "668a034f-a7df-4455-91f9-bfcd2d7c34e0", "comment": "Malware payload (Mirai)", "value": "2dee9aa52cb12f35892ffb6191671f1e0cd75cf4ca1fca448badc2c308d865ed6fcb89fe80d90ef74a13da41ebdb4f96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759770, "uuid": "d0fa3337-c501-4a60-a367-0d0b1e88f69e", "value": "T1F44302357900FD32D210AD77DB880ADBB71527F9A1FD1C3568402A60DAE9E47CFE0A66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759770, "uuid": "83f06230-76c3-480d-8fa5-319580b9290c", "value": "1536:zUp7zSzcDYiD9dkvqbRLXceof1QpOMXaVb4k:wld8GRLMe01QpOMXaZ4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759770, "uuid": "a4a9affe-dde5-4732-9822-a0e38f355333", "value": 58984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759770, "uuid": "0a509181-ed1c-43f0-ba86-24236b2e5ca7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759770, "uuid": "09f99675-c090-45a0-a701-c064f70d31b1", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17856bb9-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786565, "uuid": "6f12cfa7-ba54-4a5f-a304-20fc404901d8", "comment": "Malware payload (Mirai)", "value": "5725e96d3435142f610559f411ddaad6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786565, "uuid": "515ec9c2-80fc-4e7a-82b2-eac547f23bea", "comment": "Malware payload (Mirai)", "value": "87be161399137291b7993c9d2b57f1aa6f14cd3c4becc6c8d0e5fbf6e7f55e61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786565, "uuid": "16ba35ec-4d59-497e-80fe-ee14ef599e65", "comment": "Malware payload (Mirai)", "value": "26901728813ccd0b483b6ed6a6fe615d02f4ddb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786565, "uuid": "12bd7aad-577e-4a82-9a00-22a737337cbe", "comment": "Malware payload (Mirai)", "value": "a8bd86e491e1fae1ac6b9518f4410a3adff741ec41bebaeeb26b1aa699bcd78c375e2c67332fb2da93295ed500fe3d83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786565, "uuid": "0400c712-9f02-4625-9265-3731c72b9a69", "value": "T1F713F991F8C25B2BC2E013BAA66E618D3361A3E8D2CF7327D8125F417B8951F4D67B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786565, "uuid": "d5731522-4460-4ba1-a913-1f5e6b79062b", "value": "768:LIpa6AlXGOgJMq4Q+H6CTM2b7GpAh891aS0dg5yf5wAnMUOwwIK:uavXQJMlQS7GnXEkyf5wAXwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786565, "uuid": "e842db88-fc3b-4f03-a9c2-2b9869ab2b8c", "value": 42504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786565, "uuid": "4c395322-7f25-4fbf-8ba7-2077f2594fed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786565, "uuid": "4356ee1f-98cd-4af1-b8c6-dce43f975f7c", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccaab73-3efb-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748791191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748791191, "uuid": "5d121b7f-43de-4032-adb5-f01bb4acca28", "comment": "Malware payload", "value": "e2a4ef725e367312b1675f5f07cf0118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ljj4-1ls3ehba-com", "colour": "#AFE003", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748791191, "uuid": "f106bd93-c406-43b4-8c0d-42fffd55d148", "comment": "Malware payload", "value": "885b1052ee37f3e5873058e48818d0be79b628ec5f6f2062df24298a51fa8a74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ljj4-1ls3ehba-com", "colour": "#AFE003", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748791191, "uuid": "9878cd2c-bcfa-4a33-b346-657175d83387", "comment": "Malware payload", "value": "a3f5b19e8d9dfcc5505f20d5c6c92f032c4dde9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ljj4-1ls3ehba-com", "colour": "#AFE003", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748791191, "uuid": "200f0c20-02d1-4c4d-96ba-12cc78b5c562", "comment": "Malware payload", "value": "532fbddb116d0c2b100da9102d06d4201c639842f8d49df0e54586c8fa9ccd06a2d3dace11470e9b6dcc8d8fd40bd41b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ljj4-1ls3ehba-com", "colour": "#AFE003", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748791191, "uuid": "0a30807d-4618-46c2-b67e-cf54ff53d7c3", "value": "T105272227FA94603ED567C23585A78359E2F2F692EB168D4F07D085099F23AE01E3F724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748791191, "uuid": "e0ca5e6e-2b4e-412d-aa24-89f997ea7d81", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748791191, "uuid": "2e12e223-3f98-4f83-888c-c037f0fcfa8d", "value": "393216:jlSqVbqCjUsSmQyMT6iAzjWELql2iYiLn5JMHl097RrCgM2:8q0CjY/eNvWELiJMHx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748791191, "uuid": "a8fdc5c5-20ed-4bd7-8276-e5ac2130af01", "value": 20710749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748791191, "uuid": "058d2880-bb07-4bb7-8d9b-95ac9fbe5e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748791191, "uuid": "97c8b4b9-c673-4e64-833f-61fe7663b8b0", "value": "[System Process]5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c41de0-3eb7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748761678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761678, "uuid": "0a637249-e3b6-424f-b878-2a4ecd5354db", "comment": "Malware payload", "value": "48239ba014c0c5c42d33455e68d4c72b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761678, "uuid": "cf8d52fe-3cf8-4288-8f86-2e8addaa9154", "comment": "Malware payload", "value": "88e8bc846e342c15ed576dee7cb00a1a8ca4601784f3bef8b89eb003a80a5123", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761678, "uuid": "923fd3c6-75ca-462b-8694-e2a2e3d0cad8", "comment": "Malware payload", "value": "5c7f49e017682149c931406e0d1d83609ab39418", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761678, "uuid": "c8c9a790-120e-4eed-8759-82eb59a522c5", "comment": "Malware payload", "value": "c07cd45e9fbb44edc6d10eeb99a5a037c768bbda6e4c63d6b93d455ac10a7a5ab0f46ad670bda7a32dce1ffcd68c6cd2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761678, "uuid": "08ffed65-5e63-42e0-a465-0536d17d8e0d", "value": "T1E26533545E3EE210B66A80F5EAE176EDB40DC2363C2B7063E85F8AD89B477C4D148D92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761678, "uuid": "f4d42add-2472-4597-9240-89db4678efc2", "value": "24576:ysya9VgvXH8cw9VZ15Ln2hV4k6opqca3Cgk2xGXP3DCzBrJt2ee4X4qMr0tv:dyYyMJ2H49CqcWlTxk3DWBrJt7e4IquS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748761678, "uuid": "8e2aebce-71bc-4a0a-adb8-eed4678244c2", "value": 1535613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748761678, "uuid": "d4763934-a74c-487f-97b8-0116202f3721", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761678, "uuid": "4c0c7753-62dd-42dc-a5e8-7a2f98168dee", "value": "WnAssociation.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d49fed-3f08-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1748796608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796608, "uuid": "ff1b0167-4e7d-471d-b394-ca3160d311ab", "comment": "Malware payload (QuasarRAT)", "value": "2b2105bd22b4aafb6d168ac3e1b0019f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796608, "uuid": "211385fd-e0e2-46f4-b8c8-0a76fa4d0431", "comment": "Malware payload (QuasarRAT)", "value": "89a59fdc6d7e292adecc9602af1544e9d6c7fdb1f99f654a918d007422a93d14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796608, "uuid": "33354077-f4be-4314-b4a8-d3a5e78f3360", "comment": "Malware payload (QuasarRAT)", "value": "5f9e4d34cb343f3d67001f4d5bb29112958067d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748796608, "uuid": "e52483f6-5ae1-41e6-8e03-e8c7909adb9b", "comment": "Malware payload (QuasarRAT)", "value": "1e845748f117a7b5a494ab6df3d8801d65cd78541610e68fb2946feaa3dde73f247bed0d4912b5d0b4e56bc3bd4e74e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796608, "uuid": "655eacae-02fd-494f-aa89-b0a5c2685c0c", "value": "T1D7B5E042360CC911D06D5637DBEF45044FFCA9087A22DB1ABD8E7358E8A53AA1D4E1EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796608, "uuid": "92d286b0-f630-42a6-8101-c993c911990c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796608, "uuid": "a0431f9f-66a4-4e69-b1d5-e0c0435fafb4", "value": "24576:wqrojdJEkJ/7RePhzFxFdY5zYMRxdRR7mVTRTpkpHgWUA9xMoAXPWMtVImFOJQCn:Wd9mj7+xEVTjkplZxlitAmFWhIi4wH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748796608, "uuid": "c8a17b46-a50d-45d1-b6a2-7989cbd88d49", "value": 2269184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748796608, "uuid": "88612ed1-64d6-4df4-9975-9d579a473dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748796608, "uuid": "374d7c13-e498-42d5-a543-e41364af91c2", "value": "2b2105bd22b4aafb6d168ac3e1b0019f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bba0a62-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786572, "uuid": "8f2aaf5e-ba40-4185-b408-85f4756a8611", "comment": "Malware payload (Mirai)", "value": "cd2e1ea0b56766d695b9f92f0c9341d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786572, "uuid": "14949134-20ab-4ba0-8bfb-6c14bb0a2a1e", "comment": "Malware payload (Mirai)", "value": "8a446820f6d4bfc21e8e4c14606b40c37c108a58d78bf04f47227dc65c83719a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786572, "uuid": "767e2cf7-6bf1-4e1d-b1ae-b6b6501c204d", "comment": "Malware payload (Mirai)", "value": "99fc38902d84f5678ddb7c5f0e44018d1ddab79e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786572, "uuid": "f324af8f-62a7-49ec-a33a-c9e17bbae5c1", "comment": "Malware payload (Mirai)", "value": "e7e6e11e0b835eeb291dff411dc73484cc1212fcd8b854a296e33f408a29ad213b872cb39b7c582fd0bfd581b9c744d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786572, "uuid": "9556e9c1-0e32-4f23-bf27-afda7e458463", "value": "T18D73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786572, "uuid": "23e36b80-51b9-4186-a8d2-3367949d0e8d", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerESt4:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786572, "uuid": "124aad6b-042e-41e3-a559-c38f59008c86", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786572, "uuid": "2bc6b1b5-34e6-43ab-83cf-2bbb1dfcbf85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786572, "uuid": "7e3d9243-bca7-42fd-a1e1-1268d163f078", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac123ed-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748798730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798730, "uuid": "d0dc29f8-6650-485d-be51-97b368ac5503", "comment": "Malware payload", "value": "552ead9265b3db05556e848c4b2ac55d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798730, "uuid": "0424c054-7a44-41f7-a99c-7bc170938aaa", "comment": "Malware payload", "value": "8bca70d25084f54e14106592db879420806b3a5a7bc0fee29ff76946c78a4d8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798730, "uuid": "0fc3649d-1631-4a22-938e-275f73e63da2", "comment": "Malware payload", "value": "184b028ad8e091646354ccf2547b87851bfd7a35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798730, "uuid": "fa6ca526-2c72-4865-b892-02ffc2ae9eb6", "comment": "Malware payload", "value": "831e0d2bb040369f2fdea5ae74c425a35f013d3217b780d21fb02db0d313d340b8c96a423e05a679c8f13e8dfd230991", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798730, "uuid": "fae1c1f4-9614-4f48-bd7a-0620b4262125", "value": "T16C747C2AEA9405FDE5BBA17CC8471D01E739784607E189CF139049B23E572E0AF3E7A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798730, "uuid": "80029180-0685-414e-b8b8-df7bdaf6a0c0", "value": "78617252a0c794cc327fd10ae083402e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798730, "uuid": "f50fb727-e784-4711-950d-fcbf7e48fa4e", "value": "6144:qm+QOla8LG8cd5OsDKOAGIaoXcj90rvinHYvj3Cxam0:qm+Q0arKiosGrvkijiL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798730, "uuid": "a8231242-68df-4f10-8da3-2ab0ea9c78c5", "value": 361016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798730, "uuid": "0ed3112a-05de-45f8-bda7-8645878a6335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798730, "uuid": "489ec591-ccd3-4c43-8b64-9fdf593fed7b", "value": "552ead9265b3db05556e848c4b2ac55d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a89c3f-3eee-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748785597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748785597, "uuid": "d2c7e3a8-d019-4320-9b53-1f5ac7b9faec", "comment": "Malware payload (LummaStealer)", "value": "6af014e2f193eb8a69619a602b152738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748785597, "uuid": "4a068092-53cc-4d38-9047-7f4d9a916e4a", "comment": "Malware payload (LummaStealer)", "value": "8bfcf1bb72c70dc358fc6d947430c8efdf4da4763e8262ad460369c43cdac6fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748785597, "uuid": "811cd7f6-7128-4362-872a-5485e80039a0", "comment": "Malware payload (LummaStealer)", "value": "51b7ffa04313be2e1615e5c7d8188593f8c47884", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748785597, "uuid": "977d4fed-f148-4a1e-9ca5-acfd341b60c6", "comment": "Malware payload (LummaStealer)", "value": "dcc18111a7885c5972901ae867893f7d4a89092e14b76a891e037eabee26c91a97732081964eeb352e6a877a7d872451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748785597, "uuid": "9e73d83f-0427-4bb4-8465-0e306ff78ec3", "value": "T1DFF7E835AB1043F1DB4359AD4E87E7E6EE289500631215DF61AF168BDA438EC4333E6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748785597, "uuid": "cf2816df-91bf-4614-834d-ee242ac72f9b", "value": "f62b90e31eca404f228fcf7068b00f31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748785597, "uuid": "65883d8e-2765-46c9-8d46-d8f03beec076", "value": "24576:YnbbPImgK4brDi4IxduRqzwqNb+Yz73P2EMZbG0JEtfqx9Bf3cy3DfUU3z2fRIz3:uHeKh46qqzF3PYdStqTZsSMRcDJIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748785597, "uuid": "67cc1fd0-02bb-42cd-9bc7-9e2ca2b19f97", "value": 72659954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748785597, "uuid": "978ce161-0311-4c01-95dc-e30fd1c63f07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748785597, "uuid": "24fdc3dc-3655-4479-b88f-f5a55a51a23d", "value": "\ud835\udc12\ud835\udc1e\ud835\udc2d\ud835\udc2e\ud835\udc29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f94871-3eb5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760973, "uuid": "c61076cd-5933-4e88-8f8f-fd6ca99fdf99", "comment": "Malware payload (Mirai)", "value": "7f242aa721adfc7e461acaa17e8c15b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760973, "uuid": "8a46b45a-2498-4958-a482-79c088128a9b", "comment": "Malware payload (Mirai)", "value": "8c8a1fdad203949a02617c65b04a3f397167e5c9a164d9887a9c648f9ec25552", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760973, "uuid": "a04f9533-7a07-462c-a7dc-7addd94ffab0", "comment": "Malware payload (Mirai)", "value": "a6bfe8659f91d8ae663405d31fe8f3c33b97c4f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760973, "uuid": "50ebbbc7-6f44-41e6-84db-26507ab338ee", "comment": "Malware payload (Mirai)", "value": "00726aaff42858197026e1e7d8c911227e1aa6e876bc053a7bb47ca52aec48492e72b96157c13d877bd25cff9639488d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760973, "uuid": "66c98966-78cc-4555-9b61-e588144cccd9", "value": "T1ACF2E0B8D45EC9E2CE647936F8B46E8D79AC67FCB271317B0822606D1CB25856478283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760973, "uuid": "12ddf2fb-5896-4f07-a4e6-8c73e5258d9b", "value": "768:fHvWhVs7/PESGuFcfZQ5GfbxvfraGxBwIisQCL9q3UELwI:vvWhVsTPOfZQQFvmGxJqLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760973, "uuid": "2fb79e6d-2379-4336-a6c8-27b368f3bcea", "value": 37364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760973, "uuid": "2b7b91a2-78b5-4f37-be51-0fe473e952b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760973, "uuid": "62aba678-8de0-46a8-8953-d502a10e7199", "value": "neon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479f590c-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748765170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765170, "uuid": "5104cc96-babb-4104-9d19-d368bdc2e0b5", "comment": "Malware payload", "value": "79e178ec9711173b5355085194549735", "object_relation": "md5", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765170, "uuid": "152df175-2767-49a6-973f-fe604126407d", "comment": "Malware payload", "value": "8d69894304832fb938e14c897271dc1900978a3ec6b896b8b5daaec70c239fbc", "object_relation": "sha256", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765170, "uuid": "f294078f-20da-4022-8982-e79f1e371704", "comment": "Malware payload", "value": "8f07d4799a83ed8e432ad38ea1cc89ec57e6b10e", "object_relation": "sha1", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765170, "uuid": "9449b184-fac2-405e-852d-9b9d752b52c4", "comment": "Malware payload", "value": "27a4b28a17ad3761f806202c51a7fcadd88c96033fb9c5ecf7448fe2f41c19154963beb97ee3282efb232fe5b25ca6a0", "object_relation": "sha3-384", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765170, "uuid": "a60b131b-89dc-4308-8ec8-082e3b5bfc84", "value": "T10521D24A8C1560688B13AE95CA50FE57532EA8474B0C241A733C4BD96F84E39A6D5FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765170, "uuid": "347d7f6d-1879-4d71-853b-1650fab29668", "value": "24:VqtPmaYjCXGUENqQxXjrBQH+5HxCMvW9QNKkMvWyFZL/bG+pDN+KJfub/fbNj:VqtPrgmGxNqQxXpQH+ZxC+wkO/bp1NhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765170, "uuid": "df2c340b-e127-47cf-acc0-bf8deede5bc2", "value": 1390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765170, "uuid": "63a99629-8593-43ba-a26c-a3dd36b8600c", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765170, "uuid": "223544f9-ff34-496e-9a2a-1928a6b9983b", "value": "server.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc33256-3ead-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748757614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757614, "uuid": "74026ef4-cdd6-47b1-a855-e564ad0e682c", "comment": "Malware payload", "value": "7e5f576ef042e53a6b3ef715a51f451b", "object_relation": "md5", "Tag": [ { "name": "dfsdferxc-com", "colour": "#951638", "exportable": true, "hide_tag": false }, { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757614, "uuid": "0b676efa-e5e6-4aa2-90ed-636e8fbbab6d", "comment": "Malware payload", "value": "8e4df095fc9347e39b971dab44152cd6bde88e176fa34cff5250ce1e28381d44", "object_relation": "sha256", "Tag": [ { "name": "dfsdferxc-com", "colour": "#951638", "exportable": true, "hide_tag": false }, { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757614, "uuid": "2e3ad208-bdb9-40db-9a50-6fc19efa7c15", "comment": "Malware payload", "value": "1ada6449b20fa8ca66f7dc0043eac06ab12c049a", "object_relation": "sha1", "Tag": [ { "name": "dfsdferxc-com", "colour": "#951638", "exportable": true, "hide_tag": false }, { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757614, "uuid": "e985ed9a-6fbc-4093-afe2-ef6bac5ef7bf", "comment": "Malware payload", "value": "eedc2a0331728bc3175542a26d89003f19d833a49dff4edc61ce266e210d25897dd981b83eb77cc20aeca46c7afb21c4", "object_relation": "sha3-384", "Tag": [ { "name": "dfsdferxc-com", "colour": "#951638", "exportable": true, "hide_tag": false }, { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757614, "uuid": "28e9997f-12c0-4d90-8c80-f23435b88e55", "value": "T1D15114169331E66C4ED0833AFD58148CB51287EAD809A7B9117EAA921C793FC4BF5389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757614, "uuid": "e4fbfb37-ee0a-4248-b6db-29f2b23507bb", "value": "48:Jh4DVNOdnBcii9AEG/PB5adXGS1qipIfnERyu5tG2RT2Ot+Em5QvPW2OtXLrZxnV:nNG90Udb1BgERyuK22m+15QXzOtXJY1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748757614, "uuid": "298fc06a-7260-479b-b65c-c9c371b86bc5", "value": 2462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748757614, "uuid": "4eaf0b9c-62d6-40c3-90f5-c45ef6aa029e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757614, "uuid": "c89bcb5b-edcc-439e-8989-673534093937", "value": "1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c8fa15-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786595, "uuid": "8a97f129-7b9b-41f7-b81e-596671649027", "comment": "Malware payload (Mirai)", "value": "a23b70098502ca09086e9f8d7d25dbf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786595, "uuid": "7d73ebd7-6156-462e-9450-733f8d16586a", "comment": "Malware payload (Mirai)", "value": "8e5dd56b61d1dc9c84d6b6fc60d1575a413f55d8db9d62f1605d6813b3fe3c08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786595, "uuid": "2091c2d4-8f9f-4a0a-b978-9c7560081327", "comment": "Malware payload (Mirai)", "value": "9fc03d76a31e548e27a5cb3f214e36401a273f35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786595, "uuid": "06f28d78-698a-4203-bf27-b72061f10bb4", "comment": "Malware payload (Mirai)", "value": "c6fa7faba343e49a3f9c10bb5ced9b4007e45e1566cbef29cc980c94fee1fda34783101882ea8e114fb2c86525de42c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786595, "uuid": "11de0ecf-ed87-48ab-a070-ea1d646f3eb0", "value": "T13BA3D60ABB510FF7DC6FCD3706AA070525CC651A22F87B3A7634DD18B64B24B5AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786595, "uuid": "5faca638-a62d-446c-a786-70480469fac4", "value": "1536:4loyv5u5SUBP/qqjANnkGPhhg0lthvMsI8SiIZXS68Utr/mKgtNhw80:yPheSUBa7gQnvbI9peNhN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786595, "uuid": "3911c97d-961b-4a62-97bd-e589b03ecf20", "value": 101556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786595, "uuid": "60deca48-2274-4c84-bc43-f30e1a64bca2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786595, "uuid": "60bc9fdd-413e-465a-a26d-869b5c591087", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66aa154d-3eb3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760069, "uuid": "a5a2b330-8402-4161-9c64-dc099d7aefe1", "comment": "Malware payload (Mirai)", "value": "f7dcc0aa96eb07f0d1d5e11d4ce27dae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760069, "uuid": "68d0c7dd-37e4-42cb-9131-dc9a79b55922", "comment": "Malware payload (Mirai)", "value": "8e6cc7b320dd49005e284d5d66b98d4e20f6381158daa56bec75d83395686c73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760069, "uuid": "bd8324c5-9665-4aad-b20b-0173bb46f050", "comment": "Malware payload (Mirai)", "value": "872f7c914f1eda7b379e56f647b52f7b98060659", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760069, "uuid": "380a6fbb-391d-40ae-962f-948ca4e652a8", "comment": "Malware payload (Mirai)", "value": "b10fdf7574459b3ac5122c93c5024ac4b856a5ccbed9caa8c00dea6e5788a725ca4809033bb09261efda142ed699cb44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760069, "uuid": "74825350-7582-4f8f-b1c9-7d3954e924fd", "value": "T1830428C7F800DEBDF40AE3374853090AB130B7A615925B377257797BED3A1A5092BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760069, "uuid": "afa407a9-c2dd-4bc6-8216-2611713ad3f7", "value": "3072:1v750K3sToeBQCgOxaBTi4cfK7iUmAPubEFhbEmVOjbivLgR04ydz+c:190K3sTpZg+fK7iNAx/bE2LgzydSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760069, "uuid": "263d9081-fcb2-4350-a7a6-85bcd67fe4f1", "value": 175776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760069, "uuid": "7cd3d3ce-5b31-4e7c-9026-2f99d1359c72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760069, "uuid": "00088836-9565-40d3-99ed-163ba95b0b88", "value": "neon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b81be3-3ea9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748755925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755925, "uuid": "7cf9e64a-5625-4b6e-b29c-c38a6af09f58", "comment": "Malware payload (CoinMiner)", "value": "f0080eab5f9904792196bd717063f93c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755925, "uuid": "1a885d42-0dcc-4300-960b-b4276b0414e5", "comment": "Malware payload (CoinMiner)", "value": "8ef7a7ceac1b5eb96b5005f0b47de0b273cb524fa7f87dfee1f524544a4defd1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755925, "uuid": "dfe66592-e5fb-4005-9fd7-9c053030b13e", "comment": "Malware payload (CoinMiner)", "value": "fa57d54162e870932fce60658ee8753e3fc962b1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755925, "uuid": "c61cde1e-40ff-471d-b6f0-35701bc62d26", "comment": "Malware payload (CoinMiner)", "value": "e136a55e716d34e300758ada46198458e296e6c2d9faae3a6c89ce7c7b5119ce3d057344045e5a6f5f3f344c5a9de09d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755925, "uuid": "24bdbc87-76c2-445b-895c-9acf37708747", "value": "T1C9B5B717EBB611D4E0BAC138D553222BFC7134A6833897DBA6C59E4A1B61BE4ED3D340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755925, "uuid": "fd82e090-97ef-4f5f-9cfb-48a31496fb50", "value": "86373b33412830d721c8c700d3413f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755925, "uuid": "cffeb08b-0a30-4f2e-a131-54143ef405ca", "value": "12288:rvc0uWCYZgHJrn13/ssR9/3m6/GLZ1BJQOTFyARB4qxcl3XuLiXhNFQsKoHCO3e/:jhCYZ4rn1vsc9/3hK4qcl3+YFQ+iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748755925, "uuid": "5b0550a5-1c52-4f52-80fe-f7d70e774396", "value": 2423296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748755925, "uuid": "5d421fe0-880b-4952-a76a-b25f4fa79ba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755925, "uuid": "4f69edcd-e88b-4646-9ea3-d3ab3b3705b4", "value": "Voody.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0335082b-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759472, "uuid": "8d500677-911e-4587-b429-3ff8f7c9aec3", "comment": "Malware payload (Mirai)", "value": "11e1bd09811ca19e9e78f562160c0013", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759472, "uuid": "74d9fe5d-c5e1-4298-ae2a-62b88b723fee", "comment": "Malware payload (Mirai)", "value": "8f35b0a5126e26c9f88317cc2ada26bca61e7e007b2de077b9c9a1183ce4a2da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759472, "uuid": "b48f1e2b-2719-4010-845d-419f7ec5e5d1", "comment": "Malware payload (Mirai)", "value": "a0a020d02a273dbf28d9b8a91d492ddd94f0e468", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759472, "uuid": "4089c405-af6b-4516-8681-ae34c8d37899", "comment": "Malware payload (Mirai)", "value": "9addfcb7beff952666cbf396bf90eaba95ac49632aa295326db497ad7149d8268c1c6f77591e21492c41f1c5c16695e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759472, "uuid": "5854b904-41d7-4f1a-a07c-37bdfb2ada26", "value": "T1A25302DC1715041BE62ED3F235D80FB44E2C2BA66643DD421881EBC2EA66B90FB13EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759472, "uuid": "801c77c0-b934-4a4d-837d-18914dd19080", "value": "1536:PvP/tYEykkNrMG4LGvVv55YKFEVzk0dpPvMmSpyhd3LbADVJuR:XP1NXkNYG4LGtv5uK+VPzPvMmTdmVQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759472, "uuid": "b396b4f6-0ddf-4854-b5dd-a8f1073c911f", "value": 62200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759472, "uuid": "89c965d9-8404-440f-b868-83e1fee5c214", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759472, "uuid": "31bb1f65-2e50-4cc5-a917-6f696009c4b5", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2f9c5d-3ebd-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748764584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748764584, "uuid": "6f47b779-9bda-452a-bbe9-3eaa15b14315", "comment": "Malware payload (RemcosRAT)", "value": "8c26f47ba03e8ae966c8175a022b6b18", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748764584, "uuid": "339d0f88-4a4b-4723-81ef-e7e66238e5f9", "comment": "Malware payload (RemcosRAT)", "value": "8f66ac47c0fd7182140247746b0f85994320ea9538448f03a9dd2925d513180d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748764584, "uuid": "238a0c9c-f398-4877-ba46-ccd5f53b2400", "comment": "Malware payload (RemcosRAT)", "value": "9e95821756a6dfeb53383fc4bc4babb65356065a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748764584, "uuid": "42a633d9-d6e6-4f0a-8fae-09add3358739", "comment": "Malware payload (RemcosRAT)", "value": "6332c224908834f5be075146bed5f1648979ee9bc436ba324e3f63f43ec3f6d43eb28fb1728ed6cc2265d6fb628b6113", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748764584, "uuid": "055ad07d-b64d-4359-bc27-3f271607ab21", "value": "T19963D42EE74F0915DF56977B035B4E4A09FCB33DB28140A039AC97743BAD82E466297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748764584, "uuid": "1280bc37-cbf8-4b43-92fd-e18a7cddc366", "value": "1536:TnOsm+3RLbziRuAdEDyFWw/q1PU/UVfvA4qHuHbAsPOo99db5fykARWGFAwJGm4z:TOsRzaxEGFDagUVXA4qUbAsGo9wkARXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748764584, "uuid": "706a402f-5fcb-4e1f-917d-a074883fb758", "value": 67925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748764584, "uuid": "5392013e-ae1b-4aa1-b9c1-5fd2a3553e96", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748764584, "uuid": "f229b7d5-1c6b-4f1f-85b0-80295bc1767a", "value": "wegetbasesupportingfeatureswithnicewegetbasesupporting_______wegetbasesupportingfeatureswithnicewegetbase_______wegetbasesupportingfeatureswithnicewegetbasesupporti.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef2da94-3eff-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748792617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792617, "uuid": "d68b3647-9e2a-4c49-8776-504e07b72b3a", "comment": "Malware payload", "value": "c2d1de76e150c42579d5bcebefbffcaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792617, "uuid": "1ddc4223-96e5-4401-b05f-a59ff7fd5eb5", "comment": "Malware payload", "value": "8fb46565117ec93b42524f106d9433e9e059278cf3cab3c41a98a1976d7ef7e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792617, "uuid": "cf972149-11d9-4308-95cc-838c0273200c", "comment": "Malware payload", "value": "da8ebe3d3145b61253ffc5373250a8ed95ef8789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792617, "uuid": "cd1199ce-efd1-4103-8a05-d5c75df412c9", "comment": "Malware payload", "value": "d01c7f09903026d9af8923a440a0c55d491e2b4b872ec9bc96bf74e20a4c0a7605955be21c61abb4014a285b771f8de3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792617, "uuid": "488586aa-ff97-439d-adfa-ffc3490ad441", "value": "T13647291076DCBCA9E2B60678DBB666DC432DFE331701D5CF21A039491A376C2B9A1763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792617, "uuid": "51666ddb-e598-477d-b276-3e359bd43939", "value": "30f542e8f9906031536d2015594abc7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792617, "uuid": "e8b45a20-c1ca-4ffe-aae5-8a4fa7d4941f", "value": "196608:KEMm54wIi7Q1pIDaM7pISzVIVKOgHE5kbGhB/Sogs4mhzqanYH23/UZfz:r48+SaNGo4IYH23/UZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748792617, "uuid": "989a7b9b-ae1e-4a1f-b3f1-8722ee829b5b", "value": 24592994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748792617, "uuid": "ce2fa335-fa57-4453-ab6c-8bc43da6265a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792617, "uuid": "0d0edfe5-db80-489a-9950-5b5cc73aa746", "value": "FreeRobux.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9401c1-3ebb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748763377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763377, "uuid": "20916869-d49f-4467-be49-a3d93b014a34", "comment": "Malware payload (Prometei)", "value": "16aa4a8be4283239ab2e199cf09639ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763377, "uuid": "a6cb8ae2-9e7f-44a4-8bcb-a12b4ce1ed3b", "comment": "Malware payload (Prometei)", "value": "9221034b5154847e2a4f0c2e0b9f523f7f50a024f35c7b3976b76eefe7c44151", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763377, "uuid": "c0bef0de-2927-45ce-b453-eab3e613eee8", "comment": "Malware payload (Prometei)", "value": "32e4be91d696b553d17aa9672d62196b373238ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763377, "uuid": "1084fd95-b472-473c-867b-bc3f76bf8239", "comment": "Malware payload (Prometei)", "value": "9b99fe9b2c566df82c41f45e4b96acb3e767926264bc0b1de5d13ca6573c51ffbe6be02641477bf9d3a9d8d2c7710c50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763377, "uuid": "634350f0-15cb-4e1d-a440-9f2aec288904", "value": "T17C9423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763377, "uuid": "850748d0-5dd6-4176-80af-b2d80fe256f9", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgS:25WOSACZSV6eKRH5EPiamb4DsDwwcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748763377, "uuid": "b53ac6ed-4528-473f-88a3-ef797da1fc12", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748763377, "uuid": "0d2452fd-a47e-4e1c-8bee-a687d8ba6079", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763377, "uuid": "ac8111b6-a86d-4ee8-bfaa-b64d6c81d6ce", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854b1bb3-3eb5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748760979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760979, "uuid": "5d909d5d-6d89-481c-a3d0-ff68d6379d62", "comment": "Malware payload", "value": "cc3108841fd96d98b308850295dd4888", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760979, "uuid": "f7011078-b3b6-4dc3-86e0-d4f1391a860c", "comment": "Malware payload", "value": "92cf726a25e57e7005f745e2fdaf3a51ae98672906c81be7cd718b2eb709eafa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760979, "uuid": "6d7469be-917c-480c-a47c-cbd7fec50dcb", "comment": "Malware payload", "value": "736a7cee24330da1b2eefb4a5efd0012196b059e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760979, "uuid": "b9fdc0d1-1d38-4708-a98b-92e201d473f4", "comment": "Malware payload", "value": "60b43b504f9c89942e445fefcd89b741adac992b21685b0fc3f9818ccbbcd7bbe575a7c62a7057a8e832e64d982549c9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760979, "uuid": "d3e97d5f-8a02-465f-b4e6-ead6a6d175c0", "value": "T166E0129612623737E18BA92A35E7C74F51A9909614120660FD989075D888DA8EC86E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760979, "uuid": "c4a8c685-40f7-4e58-b4db-740541c147fa", "value": "6:UrmDoSuFXJMbtOmDoSuFXqjI4OmDoSuFXkCD6FzoXD1v48m48SQ66FmoXD1vZ8me:UrmMSlMmMS9umMS9oXO8f8wE/yViED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760979, "uuid": "f9e95218-c110-4ed9-97cd-f612b111d968", "value": 370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760979, "uuid": "af5cad19-1485-4257-a394-b4caa490c554", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760979, "uuid": "6974d8f0-bacf-48ed-9e9f-5103e0e0b204", "value": "g.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbd7655-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748765208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765208, "uuid": "7a4b5391-57e2-453b-848e-e03f35187038", "comment": "Malware payload (Prometei)", "value": "3bbdfece2798c572805ea32b18d7729c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765208, "uuid": "322c8a7e-c85c-4c6d-9046-d5e21b40e5c4", "comment": "Malware payload (Prometei)", "value": "94014ee710d0b99a5ee6f3ba7bf4350777463ea4fdd15a9dae9ad9c5f4556833", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765208, "uuid": "1dadb825-73f0-4c76-8b87-12d5567a2872", "comment": "Malware payload (Prometei)", "value": "dc6b5674ca2990e9d9051dd383383281bbd10c56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765208, "uuid": "2aa66baa-61f9-401c-80cf-374a91a1463e", "comment": "Malware payload (Prometei)", "value": "e16ab0687f2e413f0eb6cd4377aa8ceb2c18a883e86d00114edc2c81ed4f0d4f30f577ae0f804da0c45be7ec28355a42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765208, "uuid": "db1e5c7e-2ac3-4e4b-9089-6cdfb76e3a19", "value": "T1CE155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765208, "uuid": "86a8061f-3b3e-4a23-808e-78e52fdf5a5d", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplR:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765208, "uuid": "fb23a097-7afb-4372-a78d-68392853de4c", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765208, "uuid": "0081c371-63f1-4517-a23a-6ae558b7cd35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765208, "uuid": "67b465b0-6c3b-4314-9156-fefb71424672", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05287898-3e92-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1748745732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745732, "uuid": "565cdb5e-e73a-4d29-8f04-2ca5e69e18e7", "comment": "Malware payload (XWorm)", "value": "00ac4fc04acd73785d73bb36b817fb27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745732, "uuid": "0c7023f5-3099-4ca8-b545-ecee95ba10e4", "comment": "Malware payload (XWorm)", "value": "9448e34026c764d35fbc1cdd093a26a33c70769674fb719561bc187f653f324d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745732, "uuid": "2895d187-4b60-4eb8-885d-c88e855fbecb", "comment": "Malware payload (XWorm)", "value": "196fa4ee2aba804ea9f1a17f46114278af1d61e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745732, "uuid": "82358647-572b-412f-82b9-50963a4a8308", "comment": "Malware payload (XWorm)", "value": "271c6db2562ed52ba13c192fc469cd17b15b6778c26f870206e469cfc34bc0b41073d2800e96a55f418b917bf507a4e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745732, "uuid": "c667b03e-7658-48ce-bbf9-c5c15080818c", "value": "T164D52A607B4A99AEC05AC074C2478BB26A7170CB0B34BAFF45D496783E79AF51F3C254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745732, "uuid": "f8b3cd48-e0a3-4078-92b8-163b972325ed", "value": "a61eb86f8e8e525a7944a6b08ea6bb3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745732, "uuid": "20e26e77-6cc7-448a-96bf-c263c8428eac", "value": "49152:z0Zaz9DbWclcvNOZkYASmt+OaG3QWwHCU8opw8PBS:PtpVpwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745732, "uuid": "f2742349-158b-4c57-adac-4db857f398c1", "value": 2956800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745732, "uuid": "df152a90-e2fc-4b0d-9546-d28467e3d3a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745732, "uuid": "41c754db-461f-4dc8-9930-8510e34bcbdb", "value": "win32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6903212e-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748786272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786272, "uuid": "a1e31df1-b5ed-42ec-8baa-d0b69419798f", "comment": "Malware payload (LummaStealer)", "value": "405ed411ccadbdd9389f68fc4ed5fd63", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786272, "uuid": "6359a3af-e901-4b57-b03b-46829f445555", "comment": "Malware payload (LummaStealer)", "value": "959dc95103bb9ecbfb221303399eef1771e0435a389598efb4845b3c94b383fe", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786272, "uuid": "af240808-c20f-4736-9452-92d42c1e130d", "comment": "Malware payload (LummaStealer)", "value": "4a1dcd30c173e9969feb7264e05dfe6053c753c1", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786272, "uuid": "00d4f928-8714-48f5-adc6-1f6f89e51627", "comment": "Malware payload (LummaStealer)", "value": "800fa66dcb5de8cb77a1ce906495095d4dcc2c859fd5c8e547944a00b3cae29a4e4d647d6b6953b530e109a1662739e3", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786272, "uuid": "a5210cdf-b812-41b3-9101-c9652a1cdaf5", "value": "T1DB8696037368559E4AC793C692431A227779038CAC34BA24FB84C17F76F5BBC065EE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786272, "uuid": "9229ec81-b7e4-4f0c-989c-a32b90372753", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786272, "uuid": "2a22878c-af9b-4c7d-a9a0-1311814f374f", "value": "49152:/3dvriTa6cX9hk//1AEmi71dTEsKYi1YWtas:/Nj+hQW/SGhrKYi1Ygas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786272, "uuid": "9f1c0bc6-9226-4909-88fd-633cb62d0a28", "value": 8151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786272, "uuid": "66a8d4e0-aeea-4362-9487-abeeaa1be20a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786272, "uuid": "7e63b7f3-eb05-4135-ba1d-7edcb16c712b", "value": "lnstaller_x86_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a54e379-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806944, "uuid": "14faf5d5-cd9d-4295-81b3-6c4ede82a1e4", "comment": "Malware payload (Mirai)", "value": "3e1f4c6d942d2d4d7487d6d08c459359", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806944, "uuid": "9f12dc4d-dc52-4e24-bed8-957eee772829", "comment": "Malware payload (Mirai)", "value": "95bac7d6886fbe9b6bd450241aa57a207b7620f6dfef85e1b8dfd9d1d5d2cb41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806944, "uuid": "1d1c67a8-26ed-4789-9e90-f43cc3a31429", "comment": "Malware payload (Mirai)", "value": "c710bea93d30a98be2b4552c3f8daf4eee0d5455", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806944, "uuid": "0d5c6831-299e-4eb7-b7c8-82a4b98f1000", "comment": "Malware payload (Mirai)", "value": "b3d3d475396bc65e1c9dd54a112e44ae7f3979614a01165be56095dcd974f540fb3e4c130940f58dfd2662af1bfd48b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806944, "uuid": "999efc28-aefa-484c-9533-516268eee9fd", "value": "T172431891BC819A23C5D4137AF56E56CD372033E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806944, "uuid": "a28f72bb-af53-4e32-a0e4-2229372694e3", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806944, "uuid": "fb5cd252-ac7d-4306-9a66-aca51e40fb1a", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806944, "uuid": "3256f760-3241-48f7-8a74-cb45014f95df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806944, "uuid": "0747eafa-8540-457a-886f-ff4664cdfdf4", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032015cb-3ee5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748781376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781376, "uuid": "046f6e81-5781-4f9a-9f37-9caa58fa82ab", "comment": "Malware payload (Mirai)", "value": "7ad84dea9ab6f589c5d3845811c803a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781376, "uuid": "1cab965e-cce1-4fdc-bcde-886b9c1fd905", "comment": "Malware payload (Mirai)", "value": "95c02c290a3d37d3e81b46f6ed65e20af3ffbfbbff88b039d4798f9158cc8674", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781376, "uuid": "206d6070-d69d-4960-a234-198c1e2c9c04", "comment": "Malware payload (Mirai)", "value": "aa7cef2d3047baa6751fa510817ef2f1f39c49d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781376, "uuid": "71785ec8-a9b3-4fb2-97b1-3d8b02108c57", "comment": "Malware payload (Mirai)", "value": "64f0ddc2d908ff555c9eeb48e726e4c071fb250f85a952e30f4ea9e2f74bb7c3a24ee739688100e72cf9578f00229afe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781376, "uuid": "ec5a1af4-f1e3-416f-b8af-044ce5a718ce", "value": "T1E514A71E6E228F7EF669873547B78E21976C33C627E1D645D2ACC1105E2038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781376, "uuid": "4edefcd7-ca42-46e4-b0e2-81c4a590d7ab", "value": "3072:cGB+lGBlBSuXr1qozNxOyLCyOqc627ELCmgL3waSP5G3dL:cGB+lGBlBFb1qofOy2/fLmMw/UdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781376, "uuid": "22019a7f-2581-4e75-8914-7f8f67631b67", "value": 195276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781376, "uuid": "b50ea7a1-f6e7-443c-93b1-91bf8957b8b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781376, "uuid": "af409cac-8ef5-41f0-a34f-b1641de87379", "value": "navo.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1334718f-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786557, "uuid": "b6ab8766-13df-43a4-a58e-eaa8b38609b9", "comment": "Malware payload (Mirai)", "value": "66425559ff83e00d9c5a8c4d42bc3ac4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786557, "uuid": "90297133-401c-4ae3-9150-cf4038d4eb57", "comment": "Malware payload (Mirai)", "value": "9784c386074ff23d86a8e2475b5c74c7fc2b54f9ec25e97375fdf6b567c4973f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786557, "uuid": "aab1d7fc-5531-40b0-8170-075692c762cb", "comment": "Malware payload (Mirai)", "value": "f6bb655fe89c83aeef2fc630bab9dd6858d6c8c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786557, "uuid": "b2b1a8f7-fe47-4cdc-9ca5-79f5be9ab9e6", "comment": "Malware payload (Mirai)", "value": "53aee5e30919e7d3c6cf6c5f530ef458c6e558bc9e9e65f1c8a6f8e505e2cbc73b1a588d450ef2b7e83c56873c363d9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786557, "uuid": "aa5614a0-550b-497a-8377-182029f959fb", "value": "T137431881B8819A23C5D4137AF56E56CD3B2523E8E2CF7217DE214F613AC681F0C6BE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786557, "uuid": "70ba522d-6c09-4d97-afd9-9265cd4564be", "value": "768:bi1YhM9243TLSqRTIrL8Bvjhp9H0LrZQIyoWjaocLVDWtuQ/Cj1mA2EDEy0eYjWO:fM9d/mL81lp90FYoW2BYuv4ZbQSlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786557, "uuid": "6726583d-9e55-4b66-a84f-a2819ee917e8", "value": 56156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786557, "uuid": "5c5b46a2-64fb-4285-b84a-07f4aac77499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786557, "uuid": "2586412f-a700-4074-8a6d-01c37aa12eb6", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fbc86a-3ea2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CobaltStrike)", "timestamp": 1748752818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748752818, "uuid": "2ec4153f-ab57-420c-bf5c-629a0f1f8dff", "comment": "Malware payload (CobaltStrike)", "value": "5a1a8ffe89cec521988d712d5fc25974", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748752818, "uuid": "cb0a5d3d-c948-4243-8e7a-83426afd043d", "comment": "Malware payload (CobaltStrike)", "value": "97a7c4579443d2c5908195427cc5cd4b5347fd5deb768f8a1532bb7a8bea5bda", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748752818, "uuid": "cdad6d68-a042-4626-81d8-14869185a63a", "comment": "Malware payload (CobaltStrike)", "value": "1bf07f80895188a362590f18c27bae0e992fe66e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748752818, "uuid": "8c04d6d7-5978-4cc5-a872-e5af2b94ffd0", "comment": "Malware payload (CobaltStrike)", "value": "ed347513c31b05504ff1caa70465aa83283aed1c158ef0d0bd9b8dccc82138bbdf7eff1e9c3e1273b6a155422de5b7d7", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748752818, "uuid": "5b5ecf14-e5af-4588-916d-4df51782baf8", "value": "T10F64BEC583F6AFB9D5184F3AA482321F7FC9B4E832470D1C9A9D7871478850EDC87A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748752818, "uuid": "8dbf66a9-71e4-446f-a91b-e015b341ec5c", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748752818, "uuid": "5ebbdf4b-4ddd-4193-bf17-9fc040d35adb", "value": "6144:O28B2RpiqX/bCkcxX+oiB9cSYcaZ4AHZjM78gBblELjyEC3q+j0usCU9R:+B2RkPjxniYS06ABM7meZDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748752818, "uuid": "94b0cac7-aa03-4fb6-87f2-d3e0c901f1b9", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748752818, "uuid": "4fe546a7-228a-4fb4-a19b-3e9c397f18b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748752818, "uuid": "17876188-f5f9-4e4b-9c11-1e4fd4165ef0", "value": "5a1a8ffe89cec521988d712d5fc25974.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ae4080-3efe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748792192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792192, "uuid": "cc7986ff-7023-4d2c-b8e9-63307d16aa88", "comment": "Malware payload (Mirai)", "value": "85f35cb98c09a3936b2780803655729d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792192, "uuid": "405814b6-04d1-40b8-99f5-f4b3bba84354", "comment": "Malware payload (Mirai)", "value": "990d51b54182424e50235f100979f3030b018d92f05c509b44e0a8b5148bf1dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792192, "uuid": "ceace0e3-449e-403a-89e3-392b9c208d19", "comment": "Malware payload (Mirai)", "value": "3bec99ef4fd6b631738b318e37bfb161e45b99a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792192, "uuid": "5b8212ea-89c8-4870-95fa-1c2492ea7e73", "comment": "Malware payload (Mirai)", "value": "2f1f68064d4d60b4ba89dd0b523112b1a8936882921dde5c316c4de09b0a097e3759ef42ec2c7cc5ee9073757bad62af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792192, "uuid": "b2ba925d-0701-4b1c-89da-b5859c87ed08", "value": "T1A53319DAB400AD7CF94FEBBE80174A0AF6313750509327276767FD936D321A48A23E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792192, "uuid": "86118273-d928-4210-ab50-bc408a34d0ab", "value": "768:6Xkebixsc+J+//cHqeztT/+1OzT5u5WejLpwsjJTj9+6Bu8rd6:6UWiScX//c3ztLRzT45ppwsjJd+6I8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748792192, "uuid": "be254ce4-e7bb-4f66-8e83-c868aa5d7fcc", "value": 50264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748792192, "uuid": "8a82fd26-ca4c-43de-b271-645079d320e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792192, "uuid": "c85849ca-c197-4e99-82e9-0efa9ec03f51", "value": "hoho.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed275922-3f41-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748821283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748821283, "uuid": "1d7f05e2-5f3d-467b-a1b6-682146c323c6", "comment": "Malware payload (Prometei)", "value": "28d91de75f8114c4e8136a518850499e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748821283, "uuid": "a6d95b78-18e7-448b-9f2f-efb509bc18f2", "comment": "Malware payload (Prometei)", "value": "999499a5bf18b964f54af111de7721d340d8cfd978edd74bdbf31438daff62da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748821283, "uuid": "3b20a2c6-2c82-4399-b490-195691a0dd83", "comment": "Malware payload (Prometei)", "value": "92c839011ead62979215317aa51c04a48914b299", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748821283, "uuid": "332abc48-21ca-4a09-af72-d372866db819", "comment": "Malware payload (Prometei)", "value": "0cca6943beb6417d439810ebeeb8204a4fdccb5a4838a3d89c5fc28aac8cfeb1c4a62ad760fe7ea288e9762d62d9bc53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748821283, "uuid": "fbf3752e-626f-4f38-aea8-f8573e1a5120", "value": "T16B155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748821283, "uuid": "7dbc37c3-2baf-435e-a3e9-0440def18da3", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplr:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748821283, "uuid": "ce3be0ed-9bab-4b77-870a-3c4d693bb745", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748821283, "uuid": "a86ae4b4-8b72-4aa9-885f-d639a0c50bb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748821283, "uuid": "5fd42b8a-fa7b-465f-ab81-75a698b94bff", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9ff7eb-3eb5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748761047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761047, "uuid": "604f051d-5e96-4824-ac2b-1d5fa4226763", "comment": "Malware payload (Mirai)", "value": "1fd60d4623751d02fbca115b4260474d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761047, "uuid": "c1506351-610b-4fb3-ac3f-e75defc5029b", "comment": "Malware payload (Mirai)", "value": "9a40bba0efd5e8a1469e961a1414333bba388669c93266e7a8971a7fb7ac694e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761047, "uuid": "60d9b5d7-104f-4342-b8a9-3845b38bf87c", "comment": "Malware payload (Mirai)", "value": "328b4d07c944230d8669b2bbb2584b1290cc9b9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761047, "uuid": "963d076b-2a08-483e-8a15-780dda6f7835", "comment": "Malware payload (Mirai)", "value": "b95b60e116ddb7334ec623691b0c496b3b4fad9527551cf0ebb0c342fb99d8f3dbdbe89479904ae561e067315be61ed7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761047, "uuid": "ce1736ec-41c9-4b5f-a07e-57ee19af5935", "value": "T136333C95F8C2CA6AC2C11379B76E6A4E3321A3D4D3CF3307AD6C9B642BC510B6D66D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761047, "uuid": "712b1e99-f5b3-4c39-a2e0-acb84e3c6ba7", "value": "1536:XaFoCH5WZ/xnEz9uprpXBy7hhDHqbhOqUTy5w:IdEZZnTy7/DHqEqoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748761047, "uuid": "96004f51-746d-4ea6-bb07-603474c08dbe", "value": 51612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748761047, "uuid": "cfa8042e-5fad-4eae-b4b8-e9163d5beb4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761047, "uuid": "03b4ff71-7859-4f3d-8074-5d783943a3f2", "value": "neon.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d63b156-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748798788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798788, "uuid": "c4b0b5c0-a153-4f75-8024-a4a67479bb47", "comment": "Malware payload", "value": "baa4847b47a09d7939e15b7ba21de6e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798788, "uuid": "730d336a-b2af-48bb-8950-92d8c3af4889", "comment": "Malware payload", "value": "9aa4e2f63b572e1289c49bbcc66bce00f10c946387fcc596bccde7a85d705dac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798788, "uuid": "e44097fe-254a-4c5b-84c4-3d9cae68f842", "comment": "Malware payload", "value": "0720dbce35fc0c57ac2e9eacd2b0e59d019c7f38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798788, "uuid": "ed1c698a-928e-42a9-b5b2-85b75775ae06", "comment": "Malware payload", "value": "5505d4747acfee8a794cc0c4f828ef48e96913061b8d4c55b5becc740b0d001f00b1cb661094e7b3b327064c5d8d66b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798788, "uuid": "f9b54edb-2950-449f-8d38-199952a25488", "value": "T15C2633A72D136CC7CF0841F5A4C44A91FDABF70C08BA7D52B16E05E6394726312BA7B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798788, "uuid": "8890df9f-583a-49b0-a0fa-5c36de7b19df", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798788, "uuid": "28c2a5ec-30ab-40c6-9591-ac2a595f90f8", "value": "98304:YydvGCFmkAI9ANfdKUxC1am8Gct108gZ7fy:F5TfAIIKU41Hrq10TQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798788, "uuid": "d799f720-8435-42ec-a551-0d7e7ec515bd", "value": 4771328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798788, "uuid": "66428e72-bac9-42c7-849b-e2bd3e00fb3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798788, "uuid": "03525d7d-fbbf-4772-8d70-2b71e269268c", "value": "baa4847b47a09d7939e15b7ba21de6e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c426960-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806893, "uuid": "9a83177c-6252-4890-9790-35f70207a9f6", "comment": "Malware payload (Mirai)", "value": "dba80a0b6e88f4a1e0de12fc9cd2d5ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806893, "uuid": "6721e4af-f131-4566-92e0-480a99051600", "comment": "Malware payload (Mirai)", "value": "9abbaf235536442bedd5b6e0502ec32ef68a347c00265d3937423a1b5b6b68db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806893, "uuid": "11063f67-a0d4-4593-8ad5-85c531116976", "comment": "Malware payload (Mirai)", "value": "923618fe5e21ba6080be67c1b04eca928f6c5bd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806893, "uuid": "83ff8c59-18e2-44f9-aa0d-c713aad90fec", "comment": "Malware payload (Mirai)", "value": "74cf7f7fa478b582ac04628070da756534406cf9a5a9b1fd7dd4b870c34c6228796ba778267099f808bd60108b69ba2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806893, "uuid": "cc9ef1e2-a18b-4335-ba2b-0aa7c64a2892", "value": "T166B2CFBD44430098FA2190F945F817932FBC1AB7A182DC64295EF1EBCCD1862B663BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806893, "uuid": "c3623f3e-6818-4663-9ccd-971a6142f4bc", "value": "384:SnogOJXzGZJr4iPbRnKJYdxlGwAH6CN9oGRLLy8t5jhAuJgGlzDpH7uNj1Jor:Sn8JXs1V1nddPGwAH6I6Gs8tHAuJgGl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806893, "uuid": "3d29c9a5-77a5-43d0-b2d6-85db5cdceecf", "value": 23736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806893, "uuid": "cd76e3f5-e718-4200-96e4-dd710276eb79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806893, "uuid": "def6419b-2971-42ed-aa9c-848fd621c91f", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7a3647-3f16-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748802521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802521, "uuid": "95ad09f8-ce37-4352-af98-1cfcb4ea9066", "comment": "Malware payload", "value": "c1a662352f33762913f7d5f8737d4739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802521, "uuid": "ff210ef2-626a-40ec-8ef0-d333399b73a2", "comment": "Malware payload", "value": "9ac95e0ccd2856c9c570cd9897e540ee8728ea0c1d30585c73120f1c6527fcc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802521, "uuid": "2d71c491-248d-4b90-9252-dd05e7202342", "comment": "Malware payload", "value": "ce60bb9f98e31085671b52e67e4a661baf5059b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802521, "uuid": "7e1fd113-3dbf-4f55-a4bc-1af3e29e63c2", "comment": "Malware payload", "value": "010129cb0154c831853eda8403274408b372f5992b5e660ed11377d01b998e0a37db9e19706ce8c12372bd953a04ccf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802521, "uuid": "43c9a7d4-4ae8-4d6c-b5fd-2b05460f8abf", "value": "T16AC483D06FABC7D6CDA3CF3234190F7015FA987985FF7430C9A70A88C4216A17AE6695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802521, "uuid": "8c6ee6b7-007b-4eb2-ba57-bae303e86099", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802521, "uuid": "c7a3311f-45af-4126-af36-a1daa9bf2dca", "value": "6144:Rctoess6ukPbVZBoDLf+ksPtA6BjTbFt7QJdO6oQ:RQoess6LbzB6Lf+ksPtA6ZNSfO6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748802521, "uuid": "0b85be48-7aa2-4565-a5e7-add4b5273ced", "value": 569232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748802521, "uuid": "d028a527-c981-4026-ac37-627f28e87b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802521, "uuid": "391e4fbc-eceb-4377-8c7a-2e31685c9b74", "value": "SecuriteInfo.com.Variant.Lazy.682365.29968.28089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf6aa59-3eb5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748761044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761044, "uuid": "a49fb074-dc79-4788-b36f-770061a89af2", "comment": "Malware payload (Mirai)", "value": "eb54a5df9471c6cabaa69c7f12a25c7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761044, "uuid": "42f1b685-1084-45e9-b788-b165b16ddc71", "comment": "Malware payload (Mirai)", "value": "9ad97ae2dcd3f792d8b11a04f86fd203c7887326d749abe7589970aeda0539bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761044, "uuid": "bbb30c78-05af-45ad-9ba8-3fb501ea0e5b", "comment": "Malware payload (Mirai)", "value": "ad214befd14bd5851940cf8f779c95ad78e4695c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761044, "uuid": "3392bafa-66bc-4480-86e9-13e0aa1b6162", "comment": "Malware payload (Mirai)", "value": "91533fa684740f7d30e12885b77129df25cd279a873bdfbeb3331c216aa18100e68edb0f13913288413416d9e64d5e63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761044, "uuid": "35fe98b7-c09f-438b-8af7-d557799347ea", "value": "T15D73195AF8819B21D5D202BEFA1E128E331317E8E3DE72129E249F31678756B0D7BC15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761044, "uuid": "ed025f51-18e7-488c-a8dd-664ed7327919", "value": "1536:OUnpN5R7zSGSPb8i4XjIsukKNauLZLQjMOiVZT7AEp7eE5oYz:ZzlErkKNauxZT7AEpSEOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748761044, "uuid": "6d7f4d24-7d16-4ad5-8b28-651915304e59", "value": 79192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748761044, "uuid": "2c12fdd4-dc61-4e53-a09a-e5f97d47a778", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761044, "uuid": "79724c08-3fc6-44c2-a018-e067abf5534a", "value": "neon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2522b4b-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748807494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807494, "uuid": "3a79cf9b-f840-437a-aca9-e135e82bfbd4", "comment": "Malware payload", "value": "936d7e8aeff5b2ac831fa6e881f8ab47", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807494, "uuid": "1face467-4a26-47c3-87b6-79df91f01a9c", "comment": "Malware payload", "value": "9c5b43fa30e0f3e6b45496cab0a94fa6f4b45130c265a88f783978c923ad5b07", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807494, "uuid": "951cc6e8-ab07-4901-bbd0-e579c8522c7e", "comment": "Malware payload", "value": "1335ee2ce2cd583ef2fa41e05ad84e13646370e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807494, "uuid": "6c9c5f1b-efb5-49fe-b5e6-02c6384e612f", "comment": "Malware payload", "value": "3c119eefeabd9e545eb9926f54c2cf576d255dade84ca30fa7b17fb685f661e4a976d915c98db22598f7dcf73f6ebb9f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807494, "uuid": "992faf02-d80e-4832-8d6a-de49f79e06d3", "value": "T1B686BF12B384F13AE46B0A3B4867E658993F7E712A12CC5B1BF4198C4F39B40677E617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807494, "uuid": "21f520c2-16a3-4577-87b3-ebc35ee2cf9d", "value": "c3a87e769594c3cb4d8333b33cff1412", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807494, "uuid": "7165742f-9cb6-4c36-b251-5cc52aa49e12", "value": "98304:kOOwDKXFv3IdbUg+pnv2wUJ+9byfoRiFXGAdlm8OOd2yiAc6TTUw:9DKXFi+9bLRi1dEnyiANT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807494, "uuid": "3845ae92-70f8-4d0d-b58e-adfba4a2247c", "value": 8146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807494, "uuid": "c0b86286-f9b7-4e2c-9a39-1ec48852360c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807494, "uuid": "c61f4f1a-0c05-4f8f-b28a-c0e72cba7f61", "value": "Comn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20ffc16-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744760, "uuid": "a0055898-92ac-4253-9a0f-2477c27e0440", "comment": "Malware payload (Mirai)", "value": "0e99c6b3c061fe49c65cd9654382ced7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744760, "uuid": "06186f56-a69c-46cd-9efc-76276dfb1855", "comment": "Malware payload (Mirai)", "value": "9c779509ad66330a9fb111622485b0ee0fb464e39b9e6eb026dd4432566a0727", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744760, "uuid": "359f5e5c-dc4f-40aa-bee4-99d6fdeff77a", "comment": "Malware payload (Mirai)", "value": "c7f8daf02d0e57d708c921f9891430ebbbc88d5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744760, "uuid": "9ed10798-1311-4d02-abf4-fa837547bdde", "comment": "Malware payload (Mirai)", "value": "9931552afe011830564cf96b960960daa4237db9d5e424a41fc885798f9670ad175859124be3dd76ac1e34f202e40524", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744760, "uuid": "3e0e56f1-8ccd-4373-af7d-7a6dc3388f3f", "value": "T15BB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744760, "uuid": "f3202d81-db04-4905-b097-da21d2a7ce8c", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1V/LWy:c9sSyzz36YaWWgg1Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744760, "uuid": "817bde93-89f3-494f-92bb-5d780b165576", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744760, "uuid": "1180a12e-1b9d-4a22-9582-292df29143dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744760, "uuid": "20c5fcc5-81cb-4783-bfb1-84ea4bf7eaf6", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f05e5d0-3ecc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Akira)", "timestamp": 1748770659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770659, "uuid": "891fe208-d389-4036-9281-92e44e657a86", "comment": "Malware payload (Akira)", "value": "e148dee0132f5d20c01fbb4a3fc87b47", "object_relation": "md5", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770659, "uuid": "115787c1-38e2-46d7-ac91-1de0c0fdea76", "comment": "Malware payload (Akira)", "value": "9ca333b2e88ab35f608e447b0e3b821a6e04c4b0c76545177890fb16adcab163", "object_relation": "sha256", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770659, "uuid": "5bd2aae0-bdd7-4ad8-8ee6-84ee24f60496", "comment": "Malware payload (Akira)", "value": "b70b0784e43404f66a282231c65723aa66c63891", "object_relation": "sha1", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748770659, "uuid": "3fb63dd1-16af-402c-b1d1-56c950139af4", "comment": "Malware payload (Akira)", "value": "c01091a6c0ede4a43bc4a385fdae27955ac1bf9b56cbd08d14e648bab007cfa043c979f9d0d0a3fe13081826f2c164b7", "object_relation": "sha3-384", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770659, "uuid": "fe22f601-6d6c-4f5f-8d0d-6eaf72527f7b", "value": "T166C47C19B6AC47F4D0A7C238C9228506EAB7784A13718BEF039446772F176E15F3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770659, "uuid": "2cc0d179-6f9f-4b02-a3c0-be3b746a582f", "value": "f2621faa63cc44d421c7ae38a2c37765", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770659, "uuid": "6ef7aab4-507f-4efb-aff4-ae264d135eab", "value": "12288:BV0qnXKTH2P6rxTcQpXDHgswvodgBAdA:BV0EMm6rxTcQjos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748770659, "uuid": "3545874d-7fd4-4bc3-b53f-84c63499b286", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748770659, "uuid": "a172e53f-bcd7-405c-96c6-c2becef038e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748770659, "uuid": "5669721b-3bbf-414c-8ab2-646ebeb87cf6", "value": "9ca333b2e88ab35f608e447b0e3b821a6e04c4b0c76545177890fb16adcab163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cf4867-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786505, "uuid": "5bba8ff3-37c1-4949-9c0f-366b2d7e7e02", "comment": "Malware payload (Mirai)", "value": "e9d6a779c580c87f784f9e8ef79d1cbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786505, "uuid": "5530523f-6452-4232-946b-a1fd1ac952c2", "comment": "Malware payload (Mirai)", "value": "9cb629dea0cb5932381aa57e4f00b6f39cf8401d22528e82ad9c4edae9b7b940", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786505, "uuid": "49f42dab-c326-4b0f-bf7b-903bcad6ca0d", "comment": "Malware payload (Mirai)", "value": "974537dc197502d0ee404b3664fe626635962648", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786505, "uuid": "c4d3eeb8-07dc-4cd7-aac6-92f5b36b20d4", "comment": "Malware payload (Mirai)", "value": "aafec8b0ca60f20374057b38cdba95412c8c91fee45b8463d6b739791d70b053847cc3c32ff6c377c0b4343ef7b4ebd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786505, "uuid": "df0edbb7-4d5e-4ae5-95a0-7696491990c3", "value": "T14B82C07A72D96422C970543FCF3CCB8223D345FDA2FA7736611506F4A75248E427EA82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786505, "uuid": "e7b9247d-e9c4-483c-a9ae-76df3cc6df43", "value": "384:MEMJcxMwYgsO0WyBXLZAJgn1ax6Z1+VLAqvHEBLlxXiWtJshymdGUop5h56:YcRYjO0WyuJgkx6cVIVHjms3Uozn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786505, "uuid": "93f60363-250b-462a-88b2-02753b6d851e", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786505, "uuid": "9930c268-4ef5-497f-afef-67f23b2d77cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786505, "uuid": "3e0225e9-cb3b-4504-bd01-16dd447acc7b", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad1f74d-3eb6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748761284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761284, "uuid": "7a373038-da4f-4c81-afa2-3e2e8a014d6c", "comment": "Malware payload (Mirai)", "value": "a3914beb649c42e8bee979ab7298ba1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761284, "uuid": "94d3924b-42b2-4e82-a476-8895041499b6", "comment": "Malware payload (Mirai)", "value": "9d15584fb8336e3d4b2bd0764defdcbc0a8bf60e80d6e9848ed836756edce58d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761284, "uuid": "226272d6-fd93-4286-a427-fb0e335c6bf3", "comment": "Malware payload (Mirai)", "value": "bf8a375fda1f086a7bd300f250a35e66038ea6dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761284, "uuid": "5495f609-be09-45a1-8522-21faf98d736b", "comment": "Malware payload (Mirai)", "value": "79ddbee513ba12adf6343efaceb2828a9564a5e776fe88c7d93e5a66d74657c52f1f9c957cae40cdb2e78aa9f95ee252", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761284, "uuid": "74225373-16d2-42c7-9dbc-dd2e5847ada5", "value": "T147A3C70E2E219FBEF759C23947B74A21975833C622F0D6C5D26CEA015F6038E645FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761284, "uuid": "d4622cfd-72b5-41da-936f-1a860ebad2b3", "value": "1536:0+wN+FPVtwiTftvF7VjFp2ip2hk2WX9qC/pySI81kg7e0jwpn/ie:bwN0thftvFpjHfpy/Okgcpn/ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748761284, "uuid": "d6b1e070-7208-41a8-90b2-24bb547deb84", "value": 101540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748761284, "uuid": "12744323-18f4-44bb-8b37-10ddbb7f94ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761284, "uuid": "7121b990-9b73-45fd-a38f-413669839e83", "value": "gmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fcabe7-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748798754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798754, "uuid": "97eff669-149b-4b17-a5de-596773df9b51", "comment": "Malware payload (LummaStealer)", "value": "2ad0b75a28c4804443cd22b6520dad16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798754, "uuid": "45bcc0af-0590-4195-a0eb-ff65e5f4970f", "comment": "Malware payload (LummaStealer)", "value": "9d6906e6f46c0d83c33681f1c3a944cea6b27f376a80bbb5c80658a9054b01d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798754, "uuid": "b4ec1d1f-53e9-4603-8394-4780d945d9ed", "comment": "Malware payload (LummaStealer)", "value": "1c48523f6af67707cf898742cb45d1e69486ec0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798754, "uuid": "e62f287c-60b7-4a8c-84dd-7847c4504eb1", "comment": "Malware payload (LummaStealer)", "value": "0885a06dbec465814a19dbbebe0dafafe633dbdef0a009ed1a0d190757aebf616a6e6b5dfd6f16ec8d5110d016b8da87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798754, "uuid": "92241f79-0c3b-489b-9a64-12db3806878a", "value": "T1969533C608C23856D4849EF9631B471DA0B9E212D2F60D7EB581622447FBF32F67BB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798754, "uuid": "7cf75aa8-2d41-4dfb-9b69-cd816d0f6617", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798754, "uuid": "d14f379b-a27d-4796-b496-defee1762b44", "value": "49152:UqN/oKX/W7Oj6IDTHg0aDgHLgmib3nSdq:UqWKXu7gdER4gmib3Sdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798754, "uuid": "859f7fda-a4e1-4ebb-a6e2-10f445ec38de", "value": 1881600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798754, "uuid": "031a0040-824d-4c35-8f74-922b4e31f60d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798754, "uuid": "60b7f400-eb04-4d3f-bccf-4dd8b7519187", "value": "2ad0b75a28c4804443cd22b6520dad16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b30280-3f15-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748802210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802210, "uuid": "c67779e6-3c99-4603-8792-11247c613b54", "comment": "Malware payload", "value": "29bb83bd5e7b85ca4d31a8afd15e96bc", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802210, "uuid": "c9ba1d9c-d5ab-409d-a806-941622c88a09", "comment": "Malware payload", "value": "9e7f2a66046fbc9935bb29ed053c3c4a6f9a3a5096985cf6232f197d266ec792", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802210, "uuid": "aa73e2f7-4150-4efb-be4b-b213098999f7", "comment": "Malware payload", "value": "8d2a8a72643ca4723fca51381c6c3bb0d560b625", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802210, "uuid": "87d290b6-b849-473e-a5a7-db1384b6c4f6", "comment": "Malware payload", "value": "dd16b18939d59f864beaba758c62551a69b78e8fd25eab136a216b1def9319b30979f879417417b51922e1a422e4337b", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802210, "uuid": "7d3fa92e-27eb-4299-93fe-503334f6bc34", "value": "T15C2633A51CD6CFEF81E3374511A09051E4A929246B744633B73FC2452AFB12FBA89FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802210, "uuid": "5e071758-afc5-4977-8059-f4a221942361", "value": "98304:e98XFmZYZ2BHvUXR/awAtQ4+jV52c8KvQyKBS9xcLw0ZfU0Ri3:oQYZ82BHsR/LAoXbdNKBTw01UT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748802210, "uuid": "c31a5ddc-8bf9-4ea8-8f77-9e2d4f8b1533", "value": 4605109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748802210, "uuid": "add66fcf-43a9-432d-97cf-dadc8cdc2153", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802210, "uuid": "81fca754-09bc-4d7d-b7bb-98f4875a4a99", "value": "FalconDriver.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e946188a-3e83-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748739672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739672, "uuid": "fc787e63-3db4-4e0d-bef5-4b876b1b41fb", "comment": "Malware payload (Prometei)", "value": "d1611e0f8fdd73d45c37d4c9979f72a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739672, "uuid": "22990c3a-78bf-4362-b7b0-3fbd70fd37a9", "comment": "Malware payload (Prometei)", "value": "9f01d95b77249b913d88793ae174365bf76fa64af95301e14ae6090cb92c9fd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739672, "uuid": "d22f47cb-54e3-46f8-802e-c360cc0b8b02", "comment": "Malware payload (Prometei)", "value": "08e4f069409152bd1a9dff589be0bd7d3b0a5ee8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748739672, "uuid": "4ec41164-b8d9-466d-b18d-9d804aed2f96", "comment": "Malware payload (Prometei)", "value": "1a155db951ad1c8fd4abc757606900dd9f058f6d1b4c973e1d596fd6a01a389f0320b1033a43787105b6af4142bd8123", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748739672, "uuid": "a1596f19-15d9-40d5-a5c0-87f78b7e6021", "value": "T1FE9423F8C87D2E30D8169F3CBB1A8268F0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748739672, "uuid": "462e837c-fee6-445b-a454-648cd0da6759", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgO:25WOSACZSV6eKRH5EPiamb4DsDwwce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748739672, "uuid": "ee339990-7026-43d0-8cb1-49e8742da78c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748739672, "uuid": "365b4dbe-b73b-4fa4-97d4-6cd8b3c55328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748739672, "uuid": "b9b493d8-6cf6-4643-932f-573eb208c886", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a01e2d-3f0d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748798886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798886, "uuid": "613bd263-0969-42bf-81e3-df066ab5fef5", "comment": "Malware payload", "value": "50bd878d8b054a52fc56d3e20a4e0d52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798886, "uuid": "70a71b25-fd61-4228-a96f-c6314e0ffd71", "comment": "Malware payload", "value": "a0142083dd20c4bc620cd3897b43190434cfaae79b7f607874afa0c24501fdb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798886, "uuid": "250a1688-6636-4f90-b54f-0bebf3676694", "comment": "Malware payload", "value": "41e86cb35f49e465711a902e4c982f2ec6ba32d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748798886, "uuid": "a3efc9af-fcbb-406a-a211-8f1254bd3b3f", "comment": "Malware payload", "value": "b386370e7a430d9b93eb06a163886d882ccbd18330d8e8398e807872cb881fbd7347b32d10696709bb67b67597a2c366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798886, "uuid": "318e4cb2-96b1-4959-afc3-63a4b92c035a", "value": "T144A52301BAC698B3E56728734E34A7216A7EBC305F71CEEFA390155FE6215C1DA317A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798886, "uuid": "fceb9a19-dd71-446d-a753-2c68f75bbbc9", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798886, "uuid": "43a04d20-28b5-4611-ab76-21d5e43ca7c4", "value": "49152:IBJITpc8iYMIFOtDbvUbTSWfWo08hxIjFls:y+TFMIF+DbvedWJz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748798886, "uuid": "30e76d9e-3ba5-41cd-916f-b35d60d7127a", "value": 2228109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748798886, "uuid": "f6ba7834-c2b3-4518-a59b-199ab880c0f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748798886, "uuid": "87d837d0-03b2-4024-bff3-6acc555149c9", "value": "50bd878d8b054a52fc56d3e20a4e0d52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9edd10-3eb1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759169, "uuid": "5dfd029c-6c59-4667-a435-099d023a1989", "comment": "Malware payload (Mirai)", "value": "bf65d6db07de4a36b5cda2951cfe7ad9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759169, "uuid": "fd6dda87-10f3-4295-8848-8e4b58d89b81", "comment": "Malware payload (Mirai)", "value": "a020cda1f4aeebc140fabd1ed94cc9d9786fbda8a8ec98c2bd24d48d75f1296c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759169, "uuid": "84fc556a-0c72-4e2d-ac8d-63f3d642d276", "comment": "Malware payload (Mirai)", "value": "5f92ef85f3b5c8176fcb72d2a260f8cdd3e42773", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759169, "uuid": "5101f1ce-12df-49dc-9acd-c114cb15ec21", "comment": "Malware payload (Mirai)", "value": "e19a43dd52e1be5eefbb3d6ab6cf7039d50d12c0af3f68ca50e18adcd9952ebca5fe154af1f7613477d422eeaffe9a34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759169, "uuid": "9ea99628-72c9-4673-acc0-d8e17ba75f1c", "value": "T106734A32B9360937C4D5647661F74B32F6F643C621A88A1E3EB10E9DBF216403643EB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759169, "uuid": "1ffcc04e-8cb6-4606-8bf7-d7b659f4dd04", "value": "1536:06JaUtxekvOU1WkcCTCtk6tdY65p5Wh4MmyCt0cTv:LE7bYKp55tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759169, "uuid": "fcaa831e-bb1c-49d8-9dc6-f3413093173e", "value": 75120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759169, "uuid": "ce3451ad-395d-41d7-889c-99b7fe88b178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759169, "uuid": "f05b0d6a-00a1-43e4-91d1-70f43abc5df4", "value": "neon.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0dc1068-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748800244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800244, "uuid": "4c512c6f-3446-4d38-a2cd-4c96387abd74", "comment": "Malware payload (CoinMiner)", "value": "f3a6f208d154b8153005e962a0500b84", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800244, "uuid": "7d9b25a3-12e0-4b45-9ce6-94a61161ab36", "comment": "Malware payload (CoinMiner)", "value": "a0758893d41bc2eda28bf62c96c31fa800e4deef2b24fcf9e2924762a4205064", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800244, "uuid": "10aff7f4-76a5-427f-a60a-930a7e6405af", "comment": "Malware payload (CoinMiner)", "value": "eb073706acad0074606eeb8638e49706b1782929", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800244, "uuid": "47ecf468-255d-4620-9cff-fb62c01161a8", "comment": "Malware payload (CoinMiner)", "value": "928ebbbbc4f0c0054aaf599ed4dc005934d87b8a5517e6f41c68b8a87f5bb8aeaf1f6e3ec383561629eddfa843190c36", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800244, "uuid": "4faf9d35-4cb5-41ba-81e1-08e1c923c065", "value": "T158D53304E488B583F85688F5F761ABC42123F97096FF3C6177B1BA49146AF6C0C3E926", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800244, "uuid": "ae2a5f6a-a52c-4c0a-8835-423702695bda", "value": "ab61a86d61674c029fcda48f416754b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800244, "uuid": "cecad559-0150-42d3-bd9d-c5ef73585b8f", "value": "49152:NvCANJO4xsix9yqcyAWbSxoB4TE7Auo1TRPQpix4g+eB5EoZwN+cQHrmCT1j269:9CAhmix1cp+UOqE7AuMPQpia+B5Eo25u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800244, "uuid": "bf90325a-daac-4795-b9af-9475c8bc9aae", "value": 2857984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800244, "uuid": "f01b6b2f-6d5d-4e9a-b27a-7c77f0480931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800244, "uuid": "83ada30e-da71-4a8b-b349-b959a9080dc4", "value": "addon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9111e763-3e80-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1748738235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738235, "uuid": "c63e3144-87aa-4ad6-b8c4-66dc480a1196", "comment": "Malware payload (SnakeKeylogger)", "value": "77f07eb3e72d7afa7154d5cb2e8e7fa6", "object_relation": "md5", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jhxkgroup-online", "colour": "#A64122", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738235, "uuid": "a7e8ff61-c1e4-48a0-ae67-e7de2e62cd1a", "comment": "Malware payload (SnakeKeylogger)", "value": "a13b9bc562f318a3ab780668459841e85cb3f3f7e39f93a423c216375c8b9658", "object_relation": "sha256", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jhxkgroup-online", "colour": "#A64122", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738235, "uuid": "26447088-4871-465b-8769-c9649e0c2c63", "comment": "Malware payload (SnakeKeylogger)", "value": "216f5e50a6ad7ff367eb490cac18cd1800f394a0", "object_relation": "sha1", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jhxkgroup-online", "colour": "#A64122", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738235, "uuid": "3d846c63-1ae7-488c-826f-8dc2351d5898", "comment": "Malware payload (SnakeKeylogger)", "value": "ba9d5e745bd7c3ba541f447cc73b27168deb8f2e30cb38a42638c69c53120c5b84c360c03af81d0f72325d013cd3f6c2", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jhxkgroup-online", "colour": "#A64122", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738235, "uuid": "b54afded-8d04-4f51-8249-4043ee0acdd0", "value": "T10635BF1373DE8361C7725273BA65BB416EBF782506B1F46B2FD8093DA920122521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738235, "uuid": "c3d0e3ac-d287-46a1-b27b-5143cc2da16f", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738235, "uuid": "e55c656c-131e-40c3-b4e0-af1921dc5e5c", "value": "12288:dtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSga47MMvtSoqainNv6A:dtb20pkaCqT5TBWgNQ7a4M4IoXAv6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748738235, "uuid": "c0f80cc7-604a-4bef-9dc3-0c8c0c182c9c", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748738235, "uuid": "016a5ad4-4564-47c9-8b57-be518570259d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738235, "uuid": "11658845-d975-4a46-93b4-473395486b35", "value": "ObIfIle68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18008dfd-3eff-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748792578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792578, "uuid": "36ea6428-50e4-42bd-8707-47605212c66c", "comment": "Malware payload (Mirai)", "value": "3ad9f046cca05ed732165802ba764e10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792578, "uuid": "c31509d0-fb32-4a6d-b326-6a07b4b1da9a", "comment": "Malware payload (Mirai)", "value": "a183850b532ef725010984e478d12e629f5c41aaa71a5eb1f930b2d634815bf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792578, "uuid": "4c84a500-2b52-41bf-b0f4-75ef0a42cf13", "comment": "Malware payload (Mirai)", "value": "8b812bdff40564917516058ba73e6caa76a7a94b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792578, "uuid": "2eb1822c-2b84-46c3-8361-ded56366ba60", "comment": "Malware payload (Mirai)", "value": "f694fb2f7a5ba26e17851bed4abf60ae7e831779ecf03222d4d7eea5e511ad87b60c5d2340de4112beeb70002a32b3f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792578, "uuid": "f6ab1f65-9a6f-4944-a67c-20f2f7dafd85", "value": "T15F234C42322C0A47D1A25EB0393F0BE093BFE99124F4F6886A5F9B468575F371586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792578, "uuid": "7aff64bf-c8bc-40aa-8751-9de69f7eac7a", "value": "768:wlc4P8KIxt1d+BtcN0GvRek7bfexarCvLSBrjNSVLgZZoXpxu3:gnIxt1d+ByiAGceymXjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748792578, "uuid": "85ec7875-6230-4588-aa5b-570ab8bae642", "value": 47636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748792578, "uuid": "90841254-e60a-4924-9cd0-ffed4afbe244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792578, "uuid": "62a596c3-1603-4e74-9bf3-bfe66b773ade", "value": "hoho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71911818-3ea0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748751926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748751926, "uuid": "6a73a23f-bbfd-473e-9650-74cfcc1bb8ea", "comment": "Malware payload (AsyncRAT)", "value": "40a14a231dcffcd4b0cdf5585506c1af", "object_relation": "md5", "Tag": [ { "name": "180-ip-ply-gg", "colour": "#72EF43", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upcdn-io", "colour": "#1B08FF", "exportable": true, "hide_tag": false }, { "name": "upload-ee", "colour": "#05047F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748751926, "uuid": "e1ffbccf-3418-448f-b429-c63ac6b3c740", "comment": "Malware payload (AsyncRAT)", "value": "a28162c77d0870515048ee3b3f8b33acbd589a666fb6f8192d43bef36d8087f9", "object_relation": "sha256", "Tag": [ { "name": "180-ip-ply-gg", "colour": "#72EF43", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upcdn-io", "colour": "#1B08FF", "exportable": true, "hide_tag": false }, { "name": "upload-ee", "colour": "#05047F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748751926, "uuid": "17f8eb46-728d-47a1-8c48-5157c6e69e07", "comment": "Malware payload (AsyncRAT)", "value": "aae3249a03566abfeae3850746a5472fb7aeeb40", "object_relation": "sha1", "Tag": [ { "name": "180-ip-ply-gg", "colour": "#72EF43", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upcdn-io", "colour": "#1B08FF", "exportable": true, "hide_tag": false }, { "name": "upload-ee", "colour": "#05047F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748751926, "uuid": "9207af01-03dd-4856-9c89-272e9d6c2418", "comment": "Malware payload (AsyncRAT)", "value": "3d3feb9856074d4fadb7896d3f1376cd9d5690aed1adf378f277ad33eae6b8469d25004428b32c239de9908bf448e7be", "object_relation": "sha3-384", "Tag": [ { "name": "180-ip-ply-gg", "colour": "#72EF43", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upcdn-io", "colour": "#1B08FF", "exportable": true, "hide_tag": false }, { "name": "upload-ee", "colour": "#05047F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748751926, "uuid": "ccb2d4e9-9e06-475e-b5b6-e527bacf6dc9", "value": "T17A1482B971D4F29EC416C17DC9543CF5AA242CEADE0A410BED133D99B93C9F68E350A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748751926, "uuid": "9cdb9467-a542-4127-b3f6-4d6964a35c90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748751926, "uuid": "c0f23f2c-c055-4f78-9aad-71f5f41b2fcd", "value": "6144:tpVZIUpIR6XGH9c0xikhXH1vrGhAriF+P:tpVzmIELx/XxrGhAriF+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748751926, "uuid": "e3993697-5bcc-46cb-8753-4369a87e82c3", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748751926, "uuid": "b6a5bb10-e363-4e36-b35c-4dd95bdfccb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748751926, "uuid": "07cc9f4e-e9e7-4c3c-999c-6082ffd073cf", "value": "SWAN", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202afaf6-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748807195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807195, "uuid": "5c6ed0ae-332d-4295-87d9-d96dedc9285b", "comment": "Malware payload (Mirai)", "value": "2737b48826df312b44f4e24de05b75d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807195, "uuid": "6db70035-c343-40a7-bb30-7f2857aee484", "comment": "Malware payload (Mirai)", "value": "a2b4a631f707e42601cebc935887158f52a25a9e3136c67fc803c2bc7ce7c1af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807195, "uuid": "6110bebf-cb72-4025-a793-89d054f055b5", "comment": "Malware payload (Mirai)", "value": "1e582491aa0301ad55ee0e67a5c24009fcc24495", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807195, "uuid": "7ecf1883-a41a-4b2f-9c7d-951e6c4713ae", "comment": "Malware payload (Mirai)", "value": "f9e6871307a96a668dd08e53135cbd53d6e990dc9c67368bea1222e43b2649338f5428c756bae16433d00c62804d86cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807195, "uuid": "61b76bb1-9448-4555-8536-0302b070f13f", "value": "T1BD432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807195, "uuid": "67f78fc9-016d-41f2-bcbd-c937e8e32488", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwo:RqtmZPuutfbltZFBSJsBcfDSTFI+BEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807195, "uuid": "9997719b-06f0-4f4e-a6e5-348228f80bb2", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807195, "uuid": "8e00a9dd-9838-42d9-81f6-fc266b1f24cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807195, "uuid": "d392178a-7120-4260-b335-5444336bd1f9", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e1c387-3f09-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1748797187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797187, "uuid": "3e52ef07-bea6-41a5-ab84-e9d85e0b1451", "comment": "Malware payload (QuasarRAT)", "value": "63f8ea70990ee4337f1d4b5e4950df22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797187, "uuid": "7b564fe7-d1d0-4509-ad82-e848495eae0d", "comment": "Malware payload (QuasarRAT)", "value": "a31a0a3bd6ffbbb763e0125b1ff5a31f9c136d334cfbd376a3772a63e439e4a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797187, "uuid": "5a237435-3d7c-4f63-9122-2b1dca2ed8cb", "comment": "Malware payload (QuasarRAT)", "value": "39077e427d2b215e25c09eb2fd2f93f68076cdb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797187, "uuid": "2becc938-5601-4162-9b07-5bb001d7e336", "comment": "Malware payload (QuasarRAT)", "value": "385439a9ced863664701950ea149f64b2fd8a77e4e2cf100985f189c40ce9a5daaaea7dacaebc6c36216e3521e0bd3e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797187, "uuid": "8ef23e46-2bfc-44ca-a6e3-747e308f9cb2", "value": "T10275F121B7F9810AE1BF5B78A47301590777B903DA3ADB4F098C60AD1EE33509E917A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797187, "uuid": "50ae5ed4-fac8-4c7a-b288-af4539480c15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797187, "uuid": "eb27c2d0-bcdd-4963-af18-ff5b1e6812dd", "value": "24576:pzTZh9sqS2eWBRwRR16zhHIPbcNK0KKm77yviUSQaZaOwI55l2S62r97UQtV:1TZh9s87wR2EgKKm77LrwCB6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748797187, "uuid": "2ac5b335-2479-42df-a5ca-7958c9867e5b", "value": 1637888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748797187, "uuid": "50c11293-9a59-4290-b761-c36dd974ab39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797187, "uuid": "7cedf445-9978-45ea-ab1f-ecf5a7e38e36", "value": "63f8ea70990ee4337f1d4b5e4950df22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bc5500-3eb7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748761944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761944, "uuid": "3d6f58c4-e06a-444b-a901-097644eb6b8a", "comment": "Malware payload (Mirai)", "value": "84a346c7d000610f657d848642188d35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761944, "uuid": "6fb9cb74-bc5e-4bf2-a5a5-c72cc0a7c26e", "comment": "Malware payload (Mirai)", "value": "a3293470acadb47622f53a79a0d4643eaf486a327405f030cb0f9be121c0acb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761944, "uuid": "59497207-46c5-4ec6-aee7-a66a07e72004", "comment": "Malware payload (Mirai)", "value": "acafa2a3df40d5987ff0cd70686b5b5d1af4cc63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761944, "uuid": "b9dab186-ee74-45b4-87ed-f19e83076852", "comment": "Malware payload (Mirai)", "value": "0a0adbba3e26bd8685ecd359d15bdcc894d0ea5810cea7f6faaae260358b4f67c9f280e867522db51f4a98e56de9ec72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761944, "uuid": "3dd7ad36-79b6-4867-b814-1b81f60a14bf", "value": "T1DFE32A45F8918F23C6C622BBFB5D428D3B2A17A8D2EE71039D256F60378785B0E3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761944, "uuid": "5cc176a0-dd80-4116-a186-5d7bb08e9d65", "value": "1536:u4Esi5yhG6QNc0a+aEdbuZV/t5M/d+2UsY64VM8m7dHMZWmTOoARStlaHwywTVD9:yvQhGNccaEdb0twd+Q4Fm5HehjUKT86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748761944, "uuid": "42eb2543-7683-41bd-9103-96a8e8059d5b", "value": 154240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748761944, "uuid": "2040e2cf-2f6d-47fc-a91c-af86614acfb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761944, "uuid": "e5be1ae4-4420-4529-b63e-63b8023c22be", "value": "neon.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc0dc17-3ec0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Akira)", "timestamp": 1748765823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765823, "uuid": "2fdc7caf-a564-415c-88b5-8d230812dbb8", "comment": "Malware payload (Akira)", "value": "96fbb98b1f722ae5f49ab63da0f74cf2", "object_relation": "md5", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765823, "uuid": "288d528e-62f6-4638-bcdb-9ae0189e84de", "comment": "Malware payload (Akira)", "value": "a3410e5e4003361ccd1f4417ab7b36e1faed98abd248f85a21f4f74007c8ba0e", "object_relation": "sha256", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765823, "uuid": "eddb5ddb-2357-4e27-821c-2413e759e50c", "comment": "Malware payload (Akira)", "value": "d917008db31eefeac52c72813d7668e4e05e853e", "object_relation": "sha1", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765823, "uuid": "9a7c55a5-e463-446d-87df-3af7a25ce491", "comment": "Malware payload (Akira)", "value": "8e5f6f6eb8f2dd0f78d18ccda4c71088ba90f7e57386b6a48c1a7172ca9f350e85648c36c126f4a8a22727db111b2037", "object_relation": "sha3-384", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765823, "uuid": "14b1b670-99dd-40f0-96c2-5877d37f0246", "value": "T1D2351841A4164AF6F6528ABD4922C12FEEF736050B10EAE75581B23E2F070ED2F7C759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765823, "uuid": "779277b9-381b-46a2-b948-1aa2ec8c4dff", "value": "9b9e1545a27f74c7e825990e6d713212", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765823, "uuid": "84af97b0-3b78-4f84-8033-c96df3e00031", "value": "12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTdUf:Vpp+Q+u5bUI8pij1NkshdMf99etb5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765823, "uuid": "886197c6-2402-4538-a32c-86f8fecb5b4c", "value": 1074688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765823, "uuid": "72a7e967-99f0-40a6-9069-5f8f5965fba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765823, "uuid": "90d8e9f9-8bf5-49e6-b787-4730d8e3fe1c", "value": "a3410e5e4003361ccd1f4417ab7b36e1faed98abd248f85a21f4f74007c8ba0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191bc4c0-3eff-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748792580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792580, "uuid": "ffdecf9b-5d34-47b1-8d3a-66adf6bca586", "comment": "Malware payload (Mirai)", "value": "bd4e52ba3741436715ce9abb589f704b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792580, "uuid": "9c19d4a2-7d1e-46a8-9aca-ad49139f89ad", "comment": "Malware payload (Mirai)", "value": "a553f40a48b8e2b51d47ec1648633e4366f987870b93c9352642de491e880006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792580, "uuid": "958017f7-9273-4f05-b929-813ace10d12b", "comment": "Malware payload (Mirai)", "value": "6403c1fc6237835024be6efa4e1be1505ccc3b61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792580, "uuid": "facdaaee-6663-47eb-8f67-0980efe8a0f5", "comment": "Malware payload (Mirai)", "value": "75b34c9ff3378d6e799a23059aaaabef7c1fa3969d5f6a701dbd104a42702192a0fe621cc338ab1215c834b2b28442e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792580, "uuid": "3655348a-8961-42e6-aaeb-a397fb522e8e", "value": "T1F0137EA6C46AAED4C21446B4F8358F782B93F5008B576FF65E4985A28053EBCF6093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792580, "uuid": "df48376e-288e-436f-88f3-2fbc961b674b", "value": "768:waT+Wwt0jfBqSptZeVYuTgrSHj5t/qRC7oHklC2:waCWwt0jnrSHj//qRPElC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748792580, "uuid": "03965092-1db2-4558-98c6-6899748e43e4", "value": 44732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748792580, "uuid": "09ddeac2-097d-4560-b103-c6fe1f1e9a75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792580, "uuid": "1fb782b4-aa2c-4b14-bee7-3ab555b9e2a8", "value": "hoho.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf13014e-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759787, "uuid": "6e05a5e2-de90-4dc0-97fa-9f9b890d88d5", "comment": "Malware payload (Mirai)", "value": "9996c5ff11b8ca4b1968bd1344b9caef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759787, "uuid": "fd5104b9-913c-46de-8a9a-e7ce8282a7bd", "comment": "Malware payload (Mirai)", "value": "a566ee6c2e1ac5afd5bb036c5e8334d16adda2d3cbcba3511366a7d4be64320d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759787, "uuid": "bb60479e-c21d-4bc6-b434-0c099b0acc7e", "comment": "Malware payload (Mirai)", "value": "605473b433e66e5d7759b3ee0a8ce1e632ace4dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759787, "uuid": "ff864f51-234b-4d60-8570-c7d373b9a963", "comment": "Malware payload (Mirai)", "value": "e3cacaf7b87b591120376a437dcac9c4f52eb7c93a59f677f3b0f516595b41e17e28f70050fbf3d095c4ca2bd35bb4fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759787, "uuid": "998277f2-4ff5-40ab-80ce-5c67513bee75", "value": "T117E33B56EB818A13C0D21779FADF42463323979493EB73069928BFF43F8275A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759787, "uuid": "921051c5-9925-4ab0-9381-897286516342", "value": "3072:SzNfeGzRwVGajnlE/bDszrKmBXOQ4p5LCeNiTGgM/9CW7/l:mNmGzRCGajnlE/bDar5+vp5CeNiSgM/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759787, "uuid": "aa43a024-d5d7-454a-87a3-35660f26cced", "value": 153149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759787, "uuid": "d8869976-2ae7-4876-9a0a-3438be2e4516", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759787, "uuid": "e5f18386-d94b-47d7-977f-2a01b02c6836", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f244c70a-3e91-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748745700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745700, "uuid": "9aaeb0bb-df0a-4b59-8b76-d2ee15bc7090", "comment": "Malware payload (Formbook)", "value": "4f8814f2a26c2321ed0f271c7e270fa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745700, "uuid": "a3fafcd6-74ed-48c5-844b-004382b1a93a", "comment": "Malware payload (Formbook)", "value": "a56c7a0de30ae48df23a0d144084069aa790723b143dbe714baf6e4268a2ff7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745700, "uuid": "dd949bb9-95d3-45bb-9738-89d2fe4991fe", "comment": "Malware payload (Formbook)", "value": "41cf1e588b2f26ba3dc7720f59af8e08aaaedfb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745700, "uuid": "112ca612-5501-479e-9a3a-bff68d732c17", "comment": "Malware payload (Formbook)", "value": "de78840209162e1a467a3daa081ec0bf206567735fca75cf818691eb5bd4d75f26fa47c639d7cf8d9aafbe7859ce50d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745700, "uuid": "3e0c6f59-81c5-4b88-b240-386b505e4f94", "value": "T1D9737D2C77E60569F1FFAFB55DF13256CB39B7235903994F24C5028A0623E88CE816E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745700, "uuid": "c6ffcf60-4054-4614-b128-0169da3e89ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745700, "uuid": "d639cda1-1a23-4b52-b0a3-430abb7a88f5", "value": "1536:jwYL9oaA0w22A3K2/QBEjMclnUwbQdb5NesgU52XS6vDtaXfBO1nnUFKf:0YJAr22AIUMFwbQJaUoXTUO1nnJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745700, "uuid": "f1d67813-8845-4d94-9cf2-803ce3828560", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745700, "uuid": "cdd43328-52a3-49e8-b67c-58e6228872ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745700, "uuid": "99ae9c36-c6f0-4f9f-ad43-a97239b4e7bf", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6e7185-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Metasploit)", "timestamp": 1748765122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765122, "uuid": "f981bbdc-8dbd-4eae-99bd-7cd59dcb445c", "comment": "Malware payload (Metasploit)", "value": "81d9aacb18cf34cae9723e44703ebf07", "object_relation": "md5", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765122, "uuid": "99f2a40b-d137-4def-b5da-cd536004dd28", "comment": "Malware payload (Metasploit)", "value": "a6294f2c0e9aa518100a789066a0e250d6431abb95e8358cd9c198374e1a86f2", "object_relation": "sha256", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765122, "uuid": "3552f45b-af9b-4eb6-b835-fc7a42a13324", "comment": "Malware payload (Metasploit)", "value": "d0918c570c5aa68f8d1469cf8a71f071520a9780", "object_relation": "sha1", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765122, "uuid": "376dd4b3-0b7b-43a4-b065-cd0a6d333c47", "comment": "Malware payload (Metasploit)", "value": "775a72af66b5c06e02dc794bc8b8c535f6c72c66e701c3bc2d7a3bd73484fe0ac160061d337de84966c68dc046feb976", "object_relation": "sha3-384", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765122, "uuid": "2a294012-0cb8-47a2-b0e3-3cb5a8df0013", "value": "T13C445B85BBC5ADEBC6054636889F43693738F6D01B839B270D3872351E27AD0BE87646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765122, "uuid": "b1464251-9364-4dd8-a711-97ee4818f33d", "value": "85ad63f2b21cd5ff8168751b95d24b3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765122, "uuid": "b62a44bf-5859-44cb-b410-f62514003bdb", "value": "3072:nIh+9sr3aMGkW134/gbNd0ls+q6JkfUy418PWZ8m1XguQXPu1tE4IeRPhBH:u+6L564KMls+q6Q0XBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765122, "uuid": "3b2525db-1ae2-4c97-b91a-0722f96b360c", "value": 254193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765122, "uuid": "27e4570b-7f66-44de-844c-584eb125508f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765122, "uuid": "bb294f26-45d8-4b35-b731-cd38b1f03c99", "value": "esp32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaa6a56-3e91-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748745694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745694, "uuid": "a19a59f7-a663-466d-b46b-99bcf33332a0", "comment": "Malware payload", "value": "f8fb44a0bef7422de79c35c4ae4f6015", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745694, "uuid": "b15dd261-c3f8-4d46-aaf7-ed7be717fe0d", "comment": "Malware payload", "value": "a6afdda996164fa93cb722ba59c5e7d3fb2b29cd43361fd43f330cab2c4662f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745694, "uuid": "78419da3-dd1a-4c75-9703-b8e718ef938b", "comment": "Malware payload", "value": "55403416a15a90bdb8cd7cbb44978d6d493eca28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745694, "uuid": "3b8adae2-73de-48ab-965b-8070da22678a", "comment": "Malware payload", "value": "d36db5e3294416c93bacf3ed2a51af0848a1a99685c284039e12dccf5a7cc02cf89bbfa53d3a283755be00ebc912300b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745694, "uuid": "3fb2a509-82a1-459e-bc07-f6382392b953", "value": "T155E32803B2E911FDD1B7A3788AA21901F3B6B819477197DF1360853A1F67BD09E7A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745694, "uuid": "96207b8f-0881-499e-b66e-9f204664daa9", "value": "16ea232736a39f84e9f62be00fdddbb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745694, "uuid": "f1e47f36-ea66-467c-b2be-835d4749aabe", "value": "3072:68t/5ZzDd5CQ4LBDaygsP4O5Q1gL3W5KBjNN3hVp+UEx:68t/DzDjCQ4LBB9JNbVpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745694, "uuid": "5ec3aa0a-4984-40eb-9a42-71a3465194cf", "value": 153585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745694, "uuid": "76a908ab-9300-4499-a9ec-8e4c9525d4dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745694, "uuid": "eb270696-af8a-444d-9f11-cc4f7ad99c79", "value": "Deneme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe58320-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748765184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765184, "uuid": "188167bf-cbe3-439d-98f0-ec0bfd1bb984", "comment": "Malware payload (Gafgyt)", "value": "6577f15634083da9bc869c0f519506be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765184, "uuid": "f991a46f-93b3-4435-aa7f-149b51acbfc8", "comment": "Malware payload (Gafgyt)", "value": "a6e7ddb2f33b4949cde7147af4bc621939e8b6d124fac2672d5cc2f978ff3422", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765184, "uuid": "9cce3794-8ac0-406b-a343-e18ff55462e4", "comment": "Malware payload (Gafgyt)", "value": "c502da2bb5c364e20c8bf6833e25c284bce1197b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765184, "uuid": "6f77b2f0-0886-4625-948f-726ee878e664", "comment": "Malware payload (Gafgyt)", "value": "d20eab0176350767ae7486bc720cb8c266a39bd37ec9c505a19dfeeb1fe489c7a4134a699c66d9e7cf5626bda8e6d768", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765184, "uuid": "5636d897-27f0-4f9f-a031-a7bf40187c35", "value": "T1EEA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765184, "uuid": "36ea3754-4700-4728-b3d4-2b5b6d764924", "value": "3072:VSx+i6mqaObhNDnPNKV+qKmZuqQ4DPwXXtse:y6mRObnDnP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765184, "uuid": "26056165-eaed-49db-9983-31e45389b87b", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765184, "uuid": "0e7ce29c-64b3-498c-a27e-e59856aeac8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765184, "uuid": "0d8980b7-55dd-4391-a102-c7422eb7f395", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f088f405-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786499, "uuid": "d2361b03-95f4-4cd8-a7a8-f5c9d514c629", "comment": "Malware payload (Mirai)", "value": "c454a40cd494a099d7f76e20b4af73a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786499, "uuid": "51715cce-4587-43b4-a29e-4ff04493fe6a", "comment": "Malware payload (Mirai)", "value": "a88a1b0b6458361d28021c0838137a1ada4e78103dbfd152be412bde06dac1e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786499, "uuid": "f846c6bc-d54d-4819-89d9-6a57b8d0edb4", "comment": "Malware payload (Mirai)", "value": "ed95bb6255f6571efbfb07b8741e4caccef2a5be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786499, "uuid": "b4c709d8-757f-47aa-9040-193728aa6ecb", "comment": "Malware payload (Mirai)", "value": "c70ec93eadd3551fe40429a3e975d91733ba8dad82dd501ecf985d5aef1a1c8672288adb3732463d1bfa0fb0409a81a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786499, "uuid": "8854d172-b27e-4d51-8da9-1907949f629e", "value": "T154A2D0B8B6B97C30C2B19671DDBC1C05B2175A7826F671311420CBB5AED320A37B89DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786499, "uuid": "0212b2e3-67b2-42ad-bfd0-19e97a3ec740", "value": "384:Tfmu7YtXl3lZ4G6pIsCx5QQ3dqDYBMyLWNtV7dZWaMwhymdGUop5hE:Tf17YJl1ZrcSdqsewWNzJw/ws3Uozu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786499, "uuid": "e3e9926f-f3c1-47d5-8f1c-7020610b2e42", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786499, "uuid": "5c543a73-b6d9-48e5-b84e-2d6b2594a3ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786499, "uuid": "564f18f7-ad0a-492b-9d9b-74207f0b74e0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e926240d-3e91-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1748745685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745685, "uuid": "6f094b7d-3b05-4bc5-9d94-f1b02247416d", "comment": "Malware payload (XWorm)", "value": "38cc5c9381468b95ec1b51efe5318d35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745685, "uuid": "927a95c3-1c4a-4892-8f47-7664c4849c69", "comment": "Malware payload (XWorm)", "value": "a8e441645bcf8c92192b0ea4a0ba936763d94ecb501a1a6436f1a33b95f998a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745685, "uuid": "61bb5bd6-92c1-4600-8863-827f22d47aed", "comment": "Malware payload (XWorm)", "value": "ebe14d0852e11660114697611a9b83ca65935762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745685, "uuid": "c41349df-f2aa-484e-a373-f5eb129bba29", "comment": "Malware payload (XWorm)", "value": "64babd2c35967d886a3222eb6d4a4a8287dacef1f7de5af586b760ed7758257e9cd3a23c4a450b03961b3f0f630f4fcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745685, "uuid": "c6c60ba2-1bf4-4b10-989c-a92eeab8d88e", "value": "T115C633288D9090BFC49CDEB3E831A4C4FB572665B74DBA6570220F7DC97CAC63D64682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745685, "uuid": "3d8aa0f9-40f7-4647-b9b7-5867df6afe79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745685, "uuid": "c0955756-9a13-48bf-bbd4-e813f99e2412", "value": "196608:Q0sBO+87oYyM/eKfDHVzmE12ogXxX444zJ8pVWLYMhW6xxPVowcrjX/:QNeoYyM/eKfZQogXxXSvYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745685, "uuid": "ec9856b3-5c2b-46d1-8eb0-dca7e0c7ae6e", "value": 12003328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745685, "uuid": "45cdd458-3811-4338-90ee-539cee26da3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745685, "uuid": "69456cd3-01ac-4b40-81ca-6050ed425910", "value": "Cracked By MR3B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4620afc6-3edb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748777194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777194, "uuid": "707ffa09-54a4-4d9b-a76d-8d15a7433314", "comment": "Malware payload (Formbook)", "value": "6dc0eb3d9faf66a41b1bf36886c81278", "object_relation": "md5", "Tag": [ { "name": "208-89-63-13", "colour": "#6E9F2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777194, "uuid": "41a43023-9a82-431e-9d9e-99a1c50bf154", "comment": "Malware payload (Formbook)", "value": "aa09d38ea66f08ab6306c26b2c3f736450be10e997d0ce8c9c51da056949e6bc", "object_relation": "sha256", "Tag": [ { "name": "208-89-63-13", "colour": "#6E9F2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777194, "uuid": "b36d6830-737d-4e3b-ab08-5b0f06495b0b", "comment": "Malware payload (Formbook)", "value": "2e1b5094c3618f403b3d5f177057c886f1665ac1", "object_relation": "sha1", "Tag": [ { "name": "208-89-63-13", "colour": "#6E9F2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777194, "uuid": "adaf51ef-ec13-401e-9fbb-3a87295e6fc1", "comment": "Malware payload (Formbook)", "value": "7b7695e9998a95a94d26f1fa5d8ae675f890fd17e8db19241d157472efdc574354c671b14870c5100eff1252571f2fd0", "object_relation": "sha3-384", "Tag": [ { "name": "208-89-63-13", "colour": "#6E9F2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777194, "uuid": "83cc9afb-15d4-4d5d-94d0-2bc2dc8e28f6", "value": "T182E5F605B3EE0E5AE4BB4779A479101446F7FC166B33D74F2548A1AA1EB3B80CD523A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777194, "uuid": "9d9d3f12-31ac-4bd4-99b7-0d07d82a5683", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777194, "uuid": "d7e4d289-4746-4302-926f-1606eef0a819", "value": "24576:Y+3JJmqlMky1OVC64CZfftlMDXXZ4bwgEaJiY93bVfZo0VxHccM81rNq0Rxg/pOP:YI1C6htl8X1gnJHRfL5q0Rxg/pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748777194, "uuid": "1e441829-47f4-4021-ae29-e7fa699d78d2", "value": 3024384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748777194, "uuid": "a363a425-dc25-4b68-9d72-09019afeb7d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777194, "uuid": "70c4cae9-4148-4a98-bd2e-67044f7d6708", "value": "TiWorker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89fde31-3f17-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748803209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803209, "uuid": "7cc56faa-55ba-4a9b-bf96-040800ed9b34", "comment": "Malware payload", "value": "1235ba381cae28b9b6cae3a623d7667d", "object_relation": "md5", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803209, "uuid": "663dd9fe-6e2d-47c3-afb2-9b9246a80864", "comment": "Malware payload", "value": "aa0cd2ab38d4bd1f0fa49450f1543a889e4fcc4a6cfc9872699f17b27c9772ff", "object_relation": "sha256", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803209, "uuid": "976e278b-7a54-43d0-bcbe-d20b09c3ad5c", "comment": "Malware payload", "value": "01cb426a8d5ee5c5f5e8422460daf57fdd9bb2dd", "object_relation": "sha1", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803209, "uuid": "1ecaa8b7-ff36-41e5-8f53-caba72a76124", "comment": "Malware payload", "value": "5a675675839c59c3177ad77fe35033f9f7f10ab3ce6b33330c88f0068ebdcc58a9c16a88a505e547ddf0f7f004ebb3d9", "object_relation": "sha3-384", "Tag": [ { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748803209, "uuid": "56bed2f4-c97b-4c74-b448-5af94668b469", "value": "T1B4B5DEE1EDC4394ACCB908B28A9B1FE0C356E535F2258D635AB4224D6CCF79ED967340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748803209, "uuid": "6a508d50-4c9b-4ca7-ba6a-26e4e87be065", "value": "24576:19QMRbJ+y+ruFssC/4PG3BVyKxrafQgbH81Aw9br7A+rWD8vSVQ5KHbMc:42Iy6u+N/8G7ymrpXAe3A+rWD8aVQVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748803209, "uuid": "9bb0fe4e-ea5c-4514-bf9f-7ccd6184bf78", "value": 2461213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748803209, "uuid": "f7986b0f-810e-406c-81d5-2e335c85694f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748803209, "uuid": "9a24ee74-29d1-4b3e-8425-ad7d98b70352", "value": "OpenAI_Install.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96c2d17-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748799748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799748, "uuid": "6bf489c9-f8f7-4153-8359-ee799926b500", "comment": "Malware payload", "value": "8158c9dec73e3ca93dcd4320b45b3e6b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799748, "uuid": "3533612c-d1a6-4291-868a-3ae0f655adbe", "comment": "Malware payload", "value": "aa2bb0b54003366049c97d39ec53172e320ffba1b23671fe06aeabb4c99712a7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799748, "uuid": "b9d8dbf6-5bc7-4616-b559-26c8533bec7e", "comment": "Malware payload", "value": "06cc9f70ca634668ca859c91d40f746b121ba008", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799748, "uuid": "870af834-15fd-4956-9203-bbaafb51296c", "comment": "Malware payload", "value": "74829d480ebfb5cb28afd6a50b4910b0d4d544f70431fe60fa28a694da3bd8a822012468dc81a3c9cc32859a788d17ab", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799748, "uuid": "e24c4dcf-7ef6-4305-8ac5-2bc1d5e61776", "value": "T1A531F72409E212EAF677C779ABF8B3B38811F782DD754BBD018163411721150F8A3E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799748, "uuid": "2c5712c5-780d-4740-8341-f6aabea11677", "value": "24:8y/BHYVKVWO+/CWOwCO08aNYPq5a7vnqZsrsysh6FtmuBarab/BiT:8+5aiwCTn+SQ7fDQVh6FtmA4abBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799748, "uuid": "b070cfc3-795d-4f7f-80ce-bba67694666b", "value": 1638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799748, "uuid": "e7306cc6-0154-4436-a389-f76b8604ceb4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799748, "uuid": "48abeed8-45a9-4926-ab93-60cd94d08289", "value": "UltraViewer_setup_6.6.114_en.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c65e489-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748807269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807269, "uuid": "afc60cf9-987c-4309-af12-df606b12e8ff", "comment": "Malware payload (Mirai)", "value": "a8e668c3c47ed4ff8d7b0956967b127c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807269, "uuid": "19a3dcb2-94f4-4fbf-932e-3921991722c3", "comment": "Malware payload (Mirai)", "value": "aa9c82c9dcaba9cfdf9538a69c702986c9e38d90b0c07d7218cf0f9cb9c9949c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807269, "uuid": "b3a4a988-724f-4900-8ede-89a937702d03", "comment": "Malware payload (Mirai)", "value": "47e16a13fb0193b7ba0de6a1485420573e120b94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807269, "uuid": "22bade8e-0391-4d76-86a4-e367a28fd207", "comment": "Malware payload (Mirai)", "value": "0edc00b86a0474e399016a396738b1cae1558bbbf55e671a1b292e9b906a2374779e0bc7d4a2604157c0263972cd7b9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807269, "uuid": "688252ca-6d0a-4e73-ab46-8e9a2a7ac9a6", "value": "T1C763951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807269, "uuid": "186a8945-9188-4894-802c-dc2a082f34ea", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAQ:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzzL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807269, "uuid": "84165e59-1148-47a3-95e3-85495cc3d801", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807269, "uuid": "d47c168b-a97c-4a11-80da-24c7bcff8a74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807269, "uuid": "d29376cf-a03e-4493-b897-39d231e7b3b2", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0454e292-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759474, "uuid": "031b9c03-f60f-4344-aa57-56684fb838a2", "comment": "Malware payload (Mirai)", "value": "21ab269fafb36128bf275e1f2b291351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759474, "uuid": "b2e6573e-a189-4e54-85d2-57169d1c1569", "comment": "Malware payload (Mirai)", "value": "abab6a3e5f6bf4a851ec1af6692759ba65413e07d804d839e1cf677ed276bd61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759474, "uuid": "8f677024-421b-4a84-ac36-ac3c72c21059", "comment": "Malware payload (Mirai)", "value": "76c74c93e87cb52553db8d59755b7cabfdd4281d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759474, "uuid": "1216298e-c1c6-4f22-9213-a43aff554eba", "comment": "Malware payload (Mirai)", "value": "00b4b3800536f3805b0c9c1343ff0ebddc1d9fa0cfda103ecbfca9c51db5cdc915877d2a23f2f6e04a20516138927ec7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759474, "uuid": "828ecd87-563e-4d07-abd3-648aacc99dce", "value": "T112F2E125114019E1E864DB7B8AA813652FA8DB73B0539C415C98E7E4DE1F4FB60A3EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759474, "uuid": "8f87872b-53f5-4b73-bc2d-0220b5e26cb1", "value": "768:fFCqkWE3Z+hjLRlY8woMb8m7qoEGDl4I3CjaeySJgGlzDpbuR1Jx:eDZ+hjLgnoMb8qqjS4zjaeTVJu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759474, "uuid": "86720e06-1c40-471a-868d-0353776a0bda", "value": 35828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759474, "uuid": "98b0c872-653a-49f6-8d29-8f1cf256c86e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759474, "uuid": "c103971a-c1f5-4890-9eb4-1ef2e170a747", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad2eb21-3eab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748756505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756505, "uuid": "5dfddfa6-3146-4254-bcd7-fea1f56b896c", "comment": "Malware payload", "value": "2bbd1765c061ce8a1ea5ae86e048dffe", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756505, "uuid": "2dd70238-ca06-436f-99c0-12f3e0c321f2", "comment": "Malware payload", "value": "ac020fa0fbc3a966a8041e57be46f3783e49616ce12171f996341bd0d2c2ebd5", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756505, "uuid": "3506b01a-a27d-44fb-9c2d-71be86fa8d4a", "comment": "Malware payload", "value": "ffa335abd000593308555ebe6241301f876588fa", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756505, "uuid": "93e82480-327c-4308-9a11-4952d62af6c4", "comment": "Malware payload", "value": "7f2be13cbbcf42608fe2ad7dfe35019eef7686e51be0fd6c1cfaec467483ae94fc08124f615a4dc00bcb4b89091a3703", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756505, "uuid": "83e32871-429f-42a4-9ca0-503497005eff", "value": "T178073362947C1E89C12370B1DA62FA875BEA2300539ED0CE7EC65C2DF4472D177EE16A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756505, "uuid": "4b66817c-b766-41eb-99fc-faa210b03aca", "value": "393216:ddWFekjdEgur5Ux3Q8SD1oCjpaApxI/d3BLVq:ddmZJVx/MpXx+d3B8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748756505, "uuid": "c89a62fd-4c11-41bd-890f-1fd196352bf3", "value": 17497293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748756505, "uuid": "b06b0e86-1dd3-4203-9c41-4d7221ac746f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756505, "uuid": "2f73ac54-4a1d-470b-82da-29f991a9d62a", "value": "cam.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb8926d-3efb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748790895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790895, "uuid": "82bfef29-1a69-4caa-81f7-99adf264ae9b", "comment": "Malware payload (LummaStealer)", "value": "7df00f1e61c500ebc152c34adb2dd666", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790895, "uuid": "7a9dd455-ff5e-4d75-8ecf-fe22707fc461", "comment": "Malware payload (LummaStealer)", "value": "ac7f47d774da682d5e7f471fcc2bfad394cc17ce593b7c716c6069f254af6efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790895, "uuid": "213c4654-f6e3-4097-9b55-224093582081", "comment": "Malware payload (LummaStealer)", "value": "2eb583d18b7a3c72fdb75ec2a1baf16be9770c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790895, "uuid": "d0eedb06-7a65-4f0e-8d32-8ee05da37c15", "comment": "Malware payload (LummaStealer)", "value": "4b38a1fad4638f41781e796165f442bfdaec4094bd156db3eb0dc903ff0a1606bae22b5caf201c02c4e5b2ca07f88430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790895, "uuid": "73d03b91-15d2-4b15-819d-57f75fd58628", "value": "T129F72301FE8B54F5F943193441ABB22F63346D098F38CBD7EB44BB6AE8776911836246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790895, "uuid": "eb061781-bdda-4a94-96f4-3d74b3eff370", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790895, "uuid": "743cd694-f1da-49d7-adab-acf4fe4b12af", "value": "1572864:e7LRp0dvG0MWnV1XLp2Wt6pOtTgK8AHMiLcUiV:+Hk1f1XLHgOgK8AHRLcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748790895, "uuid": "a05153e7-47b4-42b3-be82-b1479339eb83", "value": 74038784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748790895, "uuid": "8456c407-8074-4789-96f1-56c61dec1d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790895, "uuid": "49f7fa3c-1072-4dc2-9d8e-c5211b45bd0b", "value": "Vcwinx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15603250-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786561, "uuid": "a002ca93-8a33-4377-ae93-6d18ab1eb1a9", "comment": "Malware payload (Mirai)", "value": "c0841413a35b0380a18f71afc48644d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786561, "uuid": "c3911713-f7cb-4bf8-9991-d8bfa8171ec2", "comment": "Malware payload (Mirai)", "value": "ad63c673c04dfbfbe39edb40f993259dec3038e7a7fad48ff2c6239b00df826d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786561, "uuid": "dfe66000-bf67-4792-91d1-dc4fdfdaf35f", "comment": "Malware payload (Mirai)", "value": "8a06d92f9d9283710abb1006df0cffcf0b3e8755", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786561, "uuid": "15a5bf19-6179-426c-aeef-e0ee01aea2a1", "comment": "Malware payload (Mirai)", "value": "edd1eaf5dfca4fe68243c3227c7d5d2b9fbab84acf2e22b96e8e6f660c23ee1a9b1f7216ad3d8fa89bf9ec12f5d423cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786561, "uuid": "182b8d68-7410-4aa3-81c0-7c6e13142ca1", "value": "T162230891BC829A27C2D41379F5BE998D3360B3E8D2CB7227CD604B107AC552F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786561, "uuid": "0e624c63-4432-4951-8e24-453c734ec35b", "value": "768:Z7bqxmKTeSIz9ygAGxAQ2k8g6ZQM8PHAmCuv/RWF0/MmUZ1mA2EDEy0eYjW9THvl:ZGmKNGxak8gq8HAmCuHAGncWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786561, "uuid": "298d06ac-ae3e-420b-8c93-6b501f7e2d4a", "value": 47092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786561, "uuid": "531a3efc-8ffd-4d7f-8cff-d306817345ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786561, "uuid": "988fda31-4cae-4906-81a1-6256e79ac2cb", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0bc1fa4-3f09-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748797130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797130, "uuid": "9ece0f51-0e42-49e0-933e-f3f7abb51b97", "comment": "Malware payload", "value": "00d99e9bc3e6c6cab17375251bfa6fc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797130, "uuid": "c8fd55be-55dd-4796-a454-f0329af7e306", "comment": "Malware payload", "value": "ad68c2be7a089ff64730c287ca38c183d5a9da45a90b08ddea267060cd4f32fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797130, "uuid": "d0ae4cf4-4b23-4f89-a420-d349718240eb", "comment": "Malware payload", "value": "cfbf6c3de2609202b0b1c50d16d2188ed5fb3ee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797130, "uuid": "13c8db4e-d3a1-4007-a13d-457ea0dfdd1b", "comment": "Malware payload", "value": "8e8c93ee14cb58972a4c92170abd2aebf99e9cc63910306098df2fde31d293395954c3b56037986e52d00d061c0fd8e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797130, "uuid": "18503a0a-e04c-48df-8026-777f16d6838f", "value": "T12E0733F2E7968594E9477FB4F82A8B6BD1631258D3DAA205C0F3547F4C83B48E5723A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797130, "uuid": "1054f4a5-2719-4454-8c55-d21cc544740d", "value": "c9e2c0799ebce6cda557aac68266b4b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797130, "uuid": "89712470-97c6-44f8-8a10-c2cbe7532842", "value": "393216:+bWwFjY/LH8TNrO9DmF0SMPzWEVNMb0NUz67SyaoCrr:+6IjQcT49DUxMqIubcUhxrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748797130, "uuid": "faa33af6-c6a5-4f15-91f7-bf3c22cb10c4", "value": 17637568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748797130, "uuid": "7fd01e9b-9ab3-4ce0-85fb-b7f237592302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797130, "uuid": "bbe7fc6a-bb85-456c-ae13-6abd3ec9a62c", "value": "00d99e9bc3e6c6cab17375251bfa6fc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce543abd-3f27-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748810064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748810064, "uuid": "786cabc1-461c-49f2-ae5e-c01d907fd693", "comment": "Malware payload", "value": "f8eaee5935092ff7d9a368729b979aaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748810064, "uuid": "75ee2f7f-4d20-49cb-a49d-5fc07775b904", "comment": "Malware payload", "value": "af04e63911b25722e9f350729a27d9c6c9b47250d2c74ed9f26999d9c00df06b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748810064, "uuid": "242923e7-2d1f-4dcd-951a-34665741df64", "comment": "Malware payload", "value": "667a8d532d0c32bd468c7641a586bcd54fba5e04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748810064, "uuid": "84f6e588-ada8-4557-b1b4-408f8b7c7efc", "comment": "Malware payload", "value": "67b89e4279e8e4b000982fa6946af614d1f6dd0099916e60c20d14ff653fba74ece13e112edb526a2f6f156ef6bce21b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748810064, "uuid": "7f0d0f1e-bd9a-4cc1-b075-e655947de0ad", "value": "T1826360D57AD55CC6EA74637C22D6D231263CFAE08A538B0BE52017321A63FD13ED92C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748810064, "uuid": "793986f0-dc14-4dc8-a39e-38d08ad4085d", "value": "faaa307c12cd73a1955640eee9df0874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748810064, "uuid": "18086c40-d61f-4053-b4b6-f07f6c4ad16d", "value": "768:V1USWroEsTAtVuMaJQiVZAxATYA275NCqQzHacWl:bsNsTAEQiVqKXEPCqQzHCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748810064, "uuid": "9379c5de-ea57-478e-8de9-deaf981ee77d", "value": 68686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748810064, "uuid": "361ed408-684e-4cb5-8bee-cedd7edceee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748810064, "uuid": "f746cba8-e5a8-4d00-8d3e-ce8f032f6a4b", "value": "artalmatlan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a04e3d-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748765194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765194, "uuid": "1fe072e8-9ab8-4c42-8de3-fcae0e336b0a", "comment": "Malware payload (Gafgyt)", "value": "6e7bd80171503a8e483d556d2e8ddc4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765194, "uuid": "aa66c8d7-6f26-44f0-967a-31eb284d7185", "comment": "Malware payload (Gafgyt)", "value": "af4c198fd4ffc9275be8a13482c20cc85643604ad026bf103bc183a167c65732", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765194, "uuid": "e317f418-eea5-46af-b3da-977f61baf109", "comment": "Malware payload (Gafgyt)", "value": "8a2682afaac4f69b4db024107090f5223fbe8a43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765194, "uuid": "cb302edc-c54f-45f6-a1df-14d605bb22a1", "comment": "Malware payload (Gafgyt)", "value": "e43fd655375b7fe4c6b8ee9b3d50d643df8cb57d95c854a59fa868efeff437bad2955ec224ad962b89bad0b30006add5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765194, "uuid": "86fec9a5-f329-4c3a-9ddb-f113b94c601d", "value": "T1B7C39417BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765194, "uuid": "0e612270-0037-4b05-9bea-8d7355e95516", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epf+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Ed+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765194, "uuid": "3bca33ce-c595-46c5-8362-db9c0019b9f9", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765194, "uuid": "253acda0-15ad-45e0-a35f-f98710d832be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765194, "uuid": "76cc4811-1dc7-4182-bc42-3221c6ce067e", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a8fcb4-3f09-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748797004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797004, "uuid": "5e2d365e-0c48-4d73-bf90-c3a5acfc8eef", "comment": "Malware payload", "value": "12789812d4ffd9f2ac63f6fec1ab80d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797004, "uuid": "ef9abc43-7a14-4f15-904a-ff99848c05b9", "comment": "Malware payload", "value": "afc031beaf139a1dfbe1034dbde421e77eda89596e90278d1c2979b4418cb392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797004, "uuid": "ad920cbd-45d3-4aee-bfef-fec8760a148a", "comment": "Malware payload", "value": "e4790f3424260955083378a2d084446a105bb554", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748797004, "uuid": "5a4e446d-5098-47bc-ab31-b4747a30df3b", "comment": "Malware payload", "value": "1e28b430eb474d904818f072bf5dee9ac39960f0130098c5e9dc353b1701b49b1970d44af2d5075c8223c085093d51dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797004, "uuid": "38711252-9ab2-4d8a-8891-7e4b5d85543b", "value": "T1D785BF23F3CBE43EE05D1B3305B2A05894F76A616923BE568AECB4ACCF751501D3E646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797004, "uuid": "2cef45b1-ee05-4060-b0aa-02ada41df1bf", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797004, "uuid": "317a518d-385e-4047-992a-f40742a4193f", "value": "24576:gawwKusHwEwS2RGqKAzO6I6h6gEGe/NIsWvMyCShxeV:wwREDN1Shv2NuMseV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748797004, "uuid": "11b74460-b223-42ef-be4a-1699bd7b9069", "value": 1726771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748797004, "uuid": "2cbf3a3e-b4e7-4aac-a678-cc068e9a46e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748797004, "uuid": "2fcddca7-088e-499f-a858-b889332eba10", "value": "12789812d4ffd9f2ac63f6fec1ab80d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2864ae-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748807482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807482, "uuid": "bb1685ac-61f7-4c45-94b0-15b02260cbbd", "comment": "Malware payload", "value": "c18d0b80612c9f9633239fa4eda679a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807482, "uuid": "4195fa87-fd1e-4be6-b45d-e0376535694a", "comment": "Malware payload", "value": "b0f2003dff0999481abcc6718936821883f4326e117ee0ae67ad1972365c96ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807482, "uuid": "addd21eb-715e-4d06-9e26-81a8fdac65b9", "comment": "Malware payload", "value": "25967542dd90a5e0cae3569a88acc3ee0c6a5099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807482, "uuid": "5c84d467-62fa-4970-98bb-7f2450574081", "comment": "Malware payload", "value": "ac2617c0e33da7e4aef5395ec81eeb455f76bb2f4069d15ece8043f77a7e5d9a96235000fbee802fc1325a4466ab507f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807482, "uuid": "ebc187cc-2f66-4cbd-b958-b745acefa581", "value": "T1CAE26B473E242802DFC68EB4B1C58E7B6C7162B22FA414C375B1859DDE957E23B2906F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807482, "uuid": "b14e80d5-e98f-4c1c-a5e8-30cec29aba1d", "value": "a4704a88d528d450f37e088e3382542c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807482, "uuid": "375fbdfc-a6ef-4bd8-9469-01f182e11119", "value": "384:pYO2scqoEJkiTtMTJZSmMLpwKNsGOT+VZ1/wfT3ir2WSx7bLfOkpwKNsGOTn31/Y:W7sQyk0YGi3iPmbLWGL3iPmbL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807482, "uuid": "f2f7f5bc-849a-4e22-b13f-5329078ecdc4", "value": 31984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807482, "uuid": "e6614075-048c-4378-8363-4b4aabb3a7f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807482, "uuid": "f2a9204c-feed-490e-8790-fe9e6e8b0802", "value": "Abspawnhlp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f227e0a8-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786502, "uuid": "82a2cee3-a72e-486f-b93f-53202812d084", "comment": "Malware payload (Mirai)", "value": "55188d218cdc9913fe5c76b2dc78ade0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786502, "uuid": "0f90d44c-8cc9-417b-945f-33b7d89635fd", "comment": "Malware payload (Mirai)", "value": "b110a5afba2f3c8cb8c78af188870318e788dcf417107fcc09c7782f307687bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786502, "uuid": "dd9b75ec-82ae-4703-8b84-2cddc7192997", "comment": "Malware payload (Mirai)", "value": "e82a401ef83b4473ebcf17d75d7584971d991233", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786502, "uuid": "43472fcb-7a31-4ce8-96fd-c1cfd8d18dd4", "comment": "Malware payload (Mirai)", "value": "b1f1f56860cc59fd3aa6c092da871bef407661a2a13d11ff706e9cbc3e97a7652f4fedc6341608d06ea28dd7fcfaeffe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786502, "uuid": "7437d83e-f8f1-4215-ac17-b08ea1f33a70", "value": "T103A2E059BF1C858BCD36293442E9E9C622D1EC61B3ACDD5A0E90C0ABF5A33A57434F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786502, "uuid": "694df036-ee58-418c-8a02-52f3305c39dd", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaz1Hb+502F2vwA9B1fKVVXIhSys:k98o08kxofBE+ZkXaVbp2F2n8VVXes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786502, "uuid": "fc8e34f2-d07f-4b7d-a9c7-7ba997834ce6", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786502, "uuid": "d8ac700d-38f6-445e-a685-31eb2924d8f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786502, "uuid": "b4dfc0d8-5d13-45df-a7f3-1093fa280e2e", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd8d9e4-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748807188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807188, "uuid": "5d806814-904c-4907-9f9e-d3a8cbca8974", "comment": "Malware payload (Mirai)", "value": "4075d1c4594b5f4971d6fc00b133c770", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807188, "uuid": "e6473543-f293-4efb-9c5e-34f9dbc01fd1", "comment": "Malware payload (Mirai)", "value": "b11501bc5dcaaf2cf2c65284a07a8b6a32ba4d6a83fba514bd3954f1b28f4219", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807188, "uuid": "0e91d3d3-b2b9-4b60-8317-9976a7eae010", "comment": "Malware payload (Mirai)", "value": "f737073975cbfa7b6c00f61630ce197ee2755c7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807188, "uuid": "f86b76e3-f691-4516-94c4-72faef93d177", "comment": "Malware payload (Mirai)", "value": "b5e96745286b209e840aed0a3d689569cef8b19af1219c263483f5e647ed3d135556fced192d3e76dfd6a2c4f14f2359", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807188, "uuid": "7af91e5d-6aeb-4887-aedb-37c716895ff2", "value": "T1B082CF3061AB74E5DBF14431FAAE8ECA971A0BF8D1FC369227596F78894510611F82CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807188, "uuid": "d3193746-02b3-4236-9835-fd19df42c644", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaPiihymdGUop5h5lc:6GV0P6+kom0tVAoNvm+to1Piis3UoznC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807188, "uuid": "a25994cf-ef02-4c26-a960-a22c2e99e6f4", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807188, "uuid": "0f80cfb0-f907-4315-813d-a83cac22ad1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807188, "uuid": "5e79edea-3642-4ba8-aad1-afa0fae275e9", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02413636-3ed8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748775792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748775792, "uuid": "80727db0-746c-43d5-abdc-36ae0d1cdb54", "comment": "Malware payload", "value": "be5db409b2cb2925401c418f73767100", "object_relation": "md5", "Tag": [ { "name": "107-172-132-32", "colour": "#1C82F3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748775792, "uuid": "ca4883c0-909f-44bd-ac89-294943ed3e22", "comment": "Malware payload", "value": "b1869591e55d980ffaf43e8fa70cefec8877b56a6a76dbf1d536ad96f420d25b", "object_relation": "sha256", "Tag": [ { "name": "107-172-132-32", "colour": "#1C82F3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748775792, "uuid": "92e70280-1c77-44cf-afbe-918c507b1065", "comment": "Malware payload", "value": "79b02baa685c9acc66f880bb416580d735f7bc17", "object_relation": "sha1", "Tag": [ { "name": "107-172-132-32", "colour": "#1C82F3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748775792, "uuid": "1f443ac6-07ca-40f1-bc95-633399deeb52", "comment": "Malware payload", "value": "4d175952f9207a7964cf71ca63f009f04d2b364eb853db3c53edd4664dec2d47a1c68cf75ebf4945f3463fa1c25d0412", "object_relation": "sha3-384", "Tag": [ { "name": "107-172-132-32", "colour": "#1C82F3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748775792, "uuid": "e4ee70da-af39-4bdb-954c-4d3a00297d1b", "value": "T13B148ED20A3447A574A15F75CC37D3D6A32075A1ABC76201D7EFDA604B4F2E06CB8EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748775792, "uuid": "8664cf21-ad01-47b4-acd9-8bbc8f37eb7a", "value": "768:N9i5H/CZof5RUt4VXqHgux17j6cTasa/x5prjhDMz7Z8U:N9i5H/CZoyA67Z8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748775792, "uuid": "1c253136-76a4-4dc2-a4cf-c39e7f692643", "value": 195046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748775792, "uuid": "ef9ad991-37d0-4755-b095-9eb4fbd1636b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748775792, "uuid": "6e2a4966-4a6d-4d03-99fb-c0cb2a79ecec", "value": "seethebestthingswithnicepersongivengoodthingsforhim.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5703b792-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748765196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765196, "uuid": "f03d942c-0498-442a-8712-73cf68b60f4c", "comment": "Malware payload (Gafgyt)", "value": "ac8515b5e5715df26e05ff72c0e5d3c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765196, "uuid": "9f6fb052-6707-458f-8cf2-57ec3732a5ca", "comment": "Malware payload (Gafgyt)", "value": "b19843eccdf6d0b8486bef1aab1b7dd89a6abf9b7dff75e4fbe7d2a3cd0f9035", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765196, "uuid": "08e0b1df-85d6-4a66-9025-f87a001abb2c", "comment": "Malware payload (Gafgyt)", "value": "629f705474a654fd4e16bf5a7205c032223e69a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765196, "uuid": "621dbea5-550e-49d3-8a86-900e82747ce9", "comment": "Malware payload (Gafgyt)", "value": "86702d3a4402fbcf179cbb01803665160cb8a956292937857be07ab750f3f50dbbf51b76cfc3706db6d4dc7e31710fd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765196, "uuid": "31849ce5-adac-4686-b8a0-d6173ec1ae25", "value": "T1B2B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765196, "uuid": "bf59bb75-962b-4b76-bc00-52d0f2111415", "value": "3072:MSY+46m1qOzssyFPPKNy+AmkZrQAhPDCXFke:06mgOzJyFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765196, "uuid": "ad9c1286-25af-4b7a-a191-bd0e931a34b5", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765196, "uuid": "c159f78e-645e-4e10-bd26-4af6cd50bcd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765196, "uuid": "231a8cfc-5b7e-44d2-8fba-60de412e356a", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67ef39b-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744767, "uuid": "b546fd15-395b-4b13-a3d7-a94f99321282", "comment": "Malware payload (Mirai)", "value": "08b7ba9cdea9427bab2526a345f9d81f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744767, "uuid": "7a63ea17-85f5-49c3-92e2-2b8ac67394a1", "comment": "Malware payload (Mirai)", "value": "b1ff8ef051583548801404a65d16d914be096d8a2305fd9f88a49cd2cbfcae52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744767, "uuid": "259ab78e-d264-45f1-86ca-408d1e543b7a", "comment": "Malware payload (Mirai)", "value": "062349987c6c693421266422ad59265abe28de87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744767, "uuid": "360e993b-de90-4d9b-a6ff-5baf0be52998", "comment": "Malware payload (Mirai)", "value": "062d61ae0b693a5d3b3adfdecdf1f9bd3ab5db987a78f4e0eb667a763e3429c72c787a5e6b259e67f89d4694cec84025", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744767, "uuid": "c32e5ca2-2b01-45af-84b7-dbb62bd89c07", "value": "T12BA2E01572A32E56F3EC1C3DC96A835BB9671BFC90F5327679416620C90D24A3E38A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744767, "uuid": "c6553eeb-d89e-49ee-b51b-c036057ea91b", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjoahymdGUop5hb:vvQn4j+ZO5fKAlxDs3Uozx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744767, "uuid": "044af0b3-82ca-4842-a0f4-b3a884d3ed85", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744767, "uuid": "57dc0d00-ea4c-4273-9d1c-bd2fdb9c214b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744767, "uuid": "5f03aaab-b952-46b9-968c-5117cd2cb58f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650c1e6e-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806881, "uuid": "277bae28-bfa7-42f2-9e33-d8853bd945b1", "comment": "Malware payload (Mirai)", "value": "844bdc13460dc589db80cc1989e117b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806881, "uuid": "908aa27e-3148-496b-bcc3-c713cd438f21", "comment": "Malware payload (Mirai)", "value": "b23acca69fa717f1c8151d6c86888ca74f98194290a9ded12c6c2c8a8cfaacc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806881, "uuid": "586f732c-aade-452d-9fa3-67f201dcda5d", "comment": "Malware payload (Mirai)", "value": "a1a23681ae0719ed1ef42d9a8d1569085ce109ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806881, "uuid": "5f89443f-62c3-4202-b868-fb4a3a29fa8e", "comment": "Malware payload (Mirai)", "value": "1b9eaa107429ef9976a4503761ddd1ec894c579034f15b5d3b04576493d079fa59ff694a15662633e644bb5433b6c200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806881, "uuid": "a74bcede-d9e2-40bd-b23c-1dbe6e2271e9", "value": "T16782D0E6924AB7B6C870D475B3F8C68936190BBCD3F936232414086A77C5D045E7A7CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806881, "uuid": "6587bb51-1162-4a86-84d4-eef8358aad43", "value": "384:G9ceUfku3fklu5WhAT+EfYfoFD9fd1agaNHuLEEwaurGqhymdGUop5htn:EUfD3cwG3EfYS9fdMg8EzurGqs3UozLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806881, "uuid": "ff006d99-0d63-4457-9ebe-465af5f129e6", "value": 18428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806881, "uuid": "e34825e6-041b-40b2-a829-c8c241ea2929", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806881, "uuid": "06f0daf6-0228-4438-bd6c-7202341aff8f", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6930303e-3eb3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760073, "uuid": "59cc0db6-5e38-44e9-afc7-c85b02008219", "comment": "Malware payload (Mirai)", "value": "d54b70f8a5ae0aa1315b89633a28d884", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760073, "uuid": "d22bfa62-fd78-48bf-b41d-56a0bd096bf8", "comment": "Malware payload (Mirai)", "value": "b24fcb3aa73af5374e47939f39f692b00d14095ee06334a8ca4efa60183301cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760073, "uuid": "62d2bb9d-c9bf-481c-be93-d2c2ba648998", "comment": "Malware payload (Mirai)", "value": "0170cb733ff4f465218ddfd3c343b47b8bb0877b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760073, "uuid": "8704134f-a479-423e-b329-40e6fa838eb7", "comment": "Malware payload (Mirai)", "value": "119090adc02c481f02ebe1c8eff9f1e95f73102c51072a8eb2145df6ecf1c4dacb1415e4fc7312df31cfe98239c3e92d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760073, "uuid": "fe894a81-65bf-494a-9838-d732e3007aab", "value": "T1D4538C23E8291D24D19D44B47428CE363B23E6C0878B6EF61636C776A457D9EF809BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760073, "uuid": "e52d542d-58fb-4476-a9c7-a11d92f75b40", "value": "768:QaK1WfR5bcGRRyAUzNQCs9FyKC3UAh7Rauo8vexrjCTDVZ+09dffTpwVJLIhIu:QaUscChSKC3UC78x8mhjCTOUeVJ23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760073, "uuid": "7e70d00b-151c-4b77-8799-2bd8c3b11375", "value": 62816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760073, "uuid": "0826fc42-bd0c-4809-bb30-e552b4e55592", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760073, "uuid": "1aa5411a-f053-47c6-bbc3-a324349c64e0", "value": "neon.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae9f81f-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748759673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759673, "uuid": "2e3bcd6f-bbfc-47a4-a492-811510af2757", "comment": "Malware payload", "value": "82f77be918e6a420e4c8797a257d75d1", "object_relation": "md5", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759673, "uuid": "2a4413ea-86d4-419a-b69b-85f62c27e705", "comment": "Malware payload", "value": "b29bd731fd9ee5fa49b9833f92547a7494b970159891d2f5bbaa2a40f1db6180", "object_relation": "sha256", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759673, "uuid": "f365675b-172c-4618-b91e-d64f1ebde47f", "comment": "Malware payload", "value": "1aa25aa674bd92987a418ab0342ec30298e274fb", "object_relation": "sha1", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759673, "uuid": "ecf1e003-1b2a-418a-8d34-e5ed60c90b8b", "comment": "Malware payload", "value": "9040a0df31c5343ec59b8756fe168225ecb3d7eb25290cf80a3ca58d68b34c8aaee9eaf93055e502db800ea0cf7da653", "object_relation": "sha3-384", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759673, "uuid": "e45934d0-44d6-4d46-ac48-9244e36e8a1f", "value": "T1DB94231920FC6A177C04C0E689E52D6B3F2CEB572C251BCA39563CEB9EB1244E3941DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759673, "uuid": "f7936901-6e5f-4033-aa92-923774759c6f", "value": "12288:vLTiU2JndSOu4pZfgbCp4H6uqc65EPIEICZ28:vLTxsikf0zHWEJICZ28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759673, "uuid": "9332aa8c-32bf-44aa-9d73-18a5c4bd4a95", "value": 418947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759673, "uuid": "61296daa-64f2-4cb2-b08f-87625eee995a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759673, "uuid": "e810ed1b-66a7-4eac-93ad-55d9b0a43f34", "value": "update.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7ba718-3eb8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748762253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748762253, "uuid": "6a5ffe9e-07b9-43cb-a310-7ebfab3953ac", "comment": "Malware payload (LummaStealer)", "value": "13467e34adb31d60165864883a887034", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748762253, "uuid": "beef9699-b413-4a98-83e0-d11feffb39a8", "comment": "Malware payload (LummaStealer)", "value": "b2a18311c4d0ff420978ce61a0e098013b9dd614c5c528c284c8cfb760774ac7", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748762253, "uuid": "855f5c92-df44-48d4-b9ba-23221c4f85f9", "comment": "Malware payload (LummaStealer)", "value": "e44d3aa1010ccb0e4cac5e623985506712d32f78", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748762253, "uuid": "c634e0bd-6774-4d63-95b5-e9b44b74c6ae", "comment": "Malware payload (LummaStealer)", "value": "8fcdc5517eadecb8fe293f3547ccb81891306099c07b787ccb42865e55dda0474e81a848ff9091d8fa236fd8bdcbe5c0", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748762253, "uuid": "e85bccbc-c27c-481b-abbb-3a3f4636a612", "value": "T1EF75BE399196A1DAFC2600BA45B172947422B733C62C2FFF4290E333AE07AC55F6975D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748762253, "uuid": "d9add420-bf79-4e09-8e9c-59e5465ca3b3", "value": "bb36df4412e03dad091fc4f040871a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748762253, "uuid": "b60b3c04-1ef0-44cb-8c2b-eba59698b67e", "value": "49152:xjAbIy9lcHsaU8VTjHnmcpNhv3JnmcpNhv3k:xjANzcHxV3n97hPJn97hPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748762253, "uuid": "0fd73e9c-c52b-4d07-ada6-0f4bff0a112c", "value": 1665536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748762253, "uuid": "04c3a365-6825-4e70-81b3-08ba50926784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748762253, "uuid": "79730eaf-e950-4484-a447-de914546106b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e634ddcd-3ee9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748783475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748783475, "uuid": "45d0f291-3783-49cf-838a-35f6e5fabe04", "comment": "Malware payload (Mirai)", "value": "532c1f0eaafafc88379c1fcb74445fd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748783475, "uuid": "42429165-1d9c-4df1-b6fe-202520072526", "comment": "Malware payload (Mirai)", "value": "b3df308027e5c8a298fb597f3906ea6814fecdcad415952e64ded679f77413ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748783475, "uuid": "e56cb9cd-08fd-44f8-b922-115f45f5a253", "comment": "Malware payload (Mirai)", "value": "aaaf5af97077d30ce970c0f1b33d3deb77d8bca1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748783475, "uuid": "11b13653-0ff8-4f17-a191-b3862b906230", "comment": "Malware payload (Mirai)", "value": "5a15863a2ea6416386eb75cc958cd1cfd13eaeee8c4942687b9d5892afa3a4537ed709d42bdfd98d2be8f0fb8f4f333d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748783475, "uuid": "f8253fa3-ae06-42f5-af16-821310b2df0e", "value": "T1C8142A46EA414B13C4D727B9FADF024633339BA493EB730695246FB43F8679E4E12A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748783475, "uuid": "5122bc40-93d9-4169-9943-9bb54cae0511", "value": "6144:BrmsSuobhy4CaP26ex8onaLHULnjJM/RkcNFw0mf:Brm5Jy4CaP26ex8EOsjS/Ccra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748783475, "uuid": "c22af5db-f6af-4934-be79-c200814baa91", "value": 198887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748783475, "uuid": "a2112a9c-aa57-4d17-ba85-7a779f422ed0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748783475, "uuid": "4a8ec436-b8b7-4912-8c47-430e93a126eb", "value": "navo.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70468e6c-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806900, "uuid": "ca692128-10a1-4353-aeda-b0bb03523ee2", "comment": "Malware payload (Mirai)", "value": "a5f8a591303aa59f9b9fab91ce7b02c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806900, "uuid": "d67a55c5-a436-42f0-8e37-b9b280b750d3", "comment": "Malware payload (Mirai)", "value": "b4334d54a00b6222850b1a3c11e0a28604ead6fd91f4b48475c4e79bdf366f90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806900, "uuid": "d2518a4a-c35b-435a-8052-47e799bb7c19", "comment": "Malware payload (Mirai)", "value": "2883f2f786a529673fe3abd3dc9938bf49d83c8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806900, "uuid": "6327ddac-1f29-4ffe-b33e-58100c917b2d", "comment": "Malware payload (Mirai)", "value": "32654285e05712c36a41612d45549b7c939bea7ddc629d5cb7a1c4e5e3b1800c8fc1bbe77b0d84a48b0acfef9d0464b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806900, "uuid": "86243aba-f597-4326-b64d-87e876cbeef3", "value": "T1DC330215D3E2154BCE7342795A3448CEA9498FF2F3AC3C2AE3788292F192164A7FD5C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806900, "uuid": "6266a763-7b2b-4593-a9b0-edb6b67aea79", "value": "768:AhATR1y2naiFUc73u6DawtJnjGhDWKw4TkEd7j9q3UELAuwtrPB/53fL644jVEfu:HTR1pdU4nKhDBwVJLArPB/53fLojVEbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806900, "uuid": "34b5a01b-318e-478d-a8a5-abeaf1661045", "value": 53328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806900, "uuid": "58920595-bd12-4c7f-8dda-86059dfb76ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806900, "uuid": "c33ab384-c206-4a8d-8f5b-7ba26ff07b64", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ea5694-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806877, "uuid": "fd9be99b-f6bb-4007-aac8-5370340a8a10", "comment": "Malware payload (Mirai)", "value": "b153089928751c198c30390efe15cf0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806877, "uuid": "6242cef1-fb1d-4e89-8e9f-301e98da8304", "comment": "Malware payload (Mirai)", "value": "b4c7e47f66ed1f420bba2dd6fa29eadde9185019786d200f327d323537a4ee8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806877, "uuid": "259128dd-2880-4dcc-baf9-fe791e936f2e", "comment": "Malware payload (Mirai)", "value": "b73fdf9e21e3525cd92825c14317b6a95fe47425", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806877, "uuid": "93c9124e-4045-4319-9959-5eadf85f0e30", "comment": "Malware payload (Mirai)", "value": "39b39e3aed15ddc971252875470552fc89f3a5462b83ad954e149d8ec5e96a917910fd0e51c5724f1e0ecc15df9e5b58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806877, "uuid": "ecc993fe-2451-455b-bef3-c6080de57bf3", "value": "T194B2C0CDF1F86EDECD5D243D64EB0AB52A84F1E4325D1F4583A51CC87E32082BA950B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806877, "uuid": "9a7c80be-d5f5-4610-848a-b096923b85da", "value": "384:Gqn1XZWc8t9Br+VT5eojDUW+VhghmzfbdTl2V8ZB1MrPHBRWGVCz0NvXqv:Gq1mtbru5ewDb+gmzfbdsMMrfWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806877, "uuid": "c9af347c-6627-4f22-af77-f7528eda44ac", "value": 24824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806877, "uuid": "606cbb59-88b6-4220-9df3-bad4a1b0adfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806877, "uuid": "25ba1d94-ab34-471f-a44a-f3cf026de625", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51125c2d-3eb1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759173, "uuid": "11de3fa0-447a-4add-b908-1c1c4d5fa617", "comment": "Malware payload (Mirai)", "value": "46ec9c8d8b73a64411d3d231f7d3d946", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759173, "uuid": "b563890c-1ea7-4e72-8ef6-c3f3ef7ea8ce", "comment": "Malware payload (Mirai)", "value": "b51f0eb4b099ffca642329af43b43411cf6d019ab7ee79281f56c1eb26891bc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759173, "uuid": "c1890b16-4706-4e70-b800-384996f0d344", "comment": "Malware payload (Mirai)", "value": "f3dbd8a068bb4d3d7f5f6fbedb1af83b75839e13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759173, "uuid": "978fd4aa-386b-4e45-85b5-95ebf275508a", "comment": "Malware payload (Mirai)", "value": "07d4661e20c940da691418da904e10bceb97d89e9eec601fab1da03448691777a9666d4ec42e3671399c3ccaddafc3ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759173, "uuid": "42a704cb-72ef-4eca-aa54-6b976cc66536", "value": "T13D53721ABF601EF7E86BCD7385A91B8534CD641A21A83B797934D828F24F54F45E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759173, "uuid": "4f1f8f6c-6ff7-4266-9376-831d4e85d677", "value": "768:DEP8t3RI3muKp8KYWoMhte2ecJsf5x5ejeT7e0OiFQiddd55YBBRXii7hcEmzDQj:Do8t3RI2Rhhte2eBfJWC73O7XcEmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759173, "uuid": "a317138c-07e0-4570-bb7d-17961ae99cf5", "value": 60896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759173, "uuid": "6d4d2d81-f327-475d-905b-bf3a3a2ec3bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759173, "uuid": "e78d15d8-f500-47f1-b4df-bb91b4383ee4", "value": "owari.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ef14b6-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744773, "uuid": "90160e86-2438-4345-b56e-001774f01c86", "comment": "Malware payload (Mirai)", "value": "52588b85e1ad47111c3a97c37e70a3ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744773, "uuid": "de68c922-5c9e-4d26-b183-f58a29bb891f", "comment": "Malware payload (Mirai)", "value": "b528f83a7b6e4b8af9be612394bbf7a78e978a5c0bd16d526b63d6d51a7da75d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744773, "uuid": "85fec1f0-c554-47fd-be75-8669ea281917", "comment": "Malware payload (Mirai)", "value": "46a0d15ccd79bfcc385bffb6d0a5d0f7c246abe7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744773, "uuid": "37bcf11b-e659-4877-bfd1-ab43a2cfbd6f", "comment": "Malware payload (Mirai)", "value": "7aec37959e82082550ea7c1870a65de187410a3fc54d8272af9926c037eac7c30758f9bece44462a9d61535030e90c30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744773, "uuid": "13d45c52-e9ad-4639-bb00-5040d54e7d2e", "value": "T137330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744773, "uuid": "11bae48e-41ba-4c62-b1f7-2317de7a9621", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGi:r/hqaJMDg9eqK806MHdkfQX6HuCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744773, "uuid": "683dd2c1-920b-439a-8b2b-7023f20c6756", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744773, "uuid": "28fb8f40-90ef-408f-9331-be86fbea461a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744773, "uuid": "f851786a-cbb1-4096-8bb9-9dcd9fd751e0", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af9cec8-3eac-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748757069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757069, "uuid": "3a7ca8f0-24ae-4c18-8e02-07c7ca452ea9", "comment": "Malware payload", "value": "707400fc80c4466466c1f05494ff652b", "object_relation": "md5", "Tag": [ { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "sdfwer234-com", "colour": "#E0B738", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757069, "uuid": "9975b53c-4f0e-4ba2-a8d9-478edca2791f", "comment": "Malware payload", "value": "b56a47d08edf4a0f1b1956e86b7e2b78174022c3b301d520cf15cf612749cee7", "object_relation": "sha256", "Tag": [ { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "sdfwer234-com", "colour": "#E0B738", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757069, "uuid": "9ef9cb8f-62de-4da9-b30c-aaa35d25b3c1", "comment": "Malware payload", "value": "ff7496bb48687961d3e64c90abadb5681217027b", "object_relation": "sha1", "Tag": [ { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "sdfwer234-com", "colour": "#E0B738", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757069, "uuid": "7d7a5a4c-178e-4845-93a6-408f247e99c4", "comment": "Malware payload", "value": "21dabd1379130702e5b6ec3186b4230063ecd3514d69c30bed39974edb95db461b51c7ea5b105778b5ef21a0c1e82d7e", "object_relation": "sha3-384", "Tag": [ { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "sdfwer234-com", "colour": "#E0B738", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757069, "uuid": "806e74fd-b8a7-4c18-ac83-4a4238ec5fa5", "value": "T13952536B5EB302616977D179279B93043231D0479181CD2E3BDC9204CFD6DD6AAE3BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757069, "uuid": "68664c74-ce8b-4378-a119-8851dea9d094", "value": "192:2dk+6ekLxGLBTUqRg7QpSFp0F0SZV4a4d4PEd5+JwdODinsU6iP:0EFiFsdB5mwdODinsU6iP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748757069, "uuid": "e52c69cf-3f5b-44d9-89d7-0ff7d0b053ab", "value": 13910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748757069, "uuid": "c47f167c-5a9c-40ef-9689-f1277fb57d79", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757069, "uuid": "b9d375d3-7a23-4256-a3a9-acdd8667f322", "value": "b56a47d08edf4a0f1b1956e86b7e2b78174022c3b301d520cf15cf612749cee7.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c74169f-3edc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748777688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777688, "uuid": "797e3a39-f425-4116-a55e-243f17510edd", "comment": "Malware payload", "value": "6d19172da651bf7a8a4ea7e36747e272", "object_relation": "md5", "Tag": [ { "name": "209-54-102-173", "colour": "#131546", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777688, "uuid": "de4db355-098a-4ebd-b12c-e52cb9e05838", "comment": "Malware payload", "value": "b580acf8cc263605a758b4ea1b90c2b1509ef7555f2e1e6be185d48191920b4f", "object_relation": "sha256", "Tag": [ { "name": "209-54-102-173", "colour": "#131546", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777688, "uuid": "400f456e-aad4-4cfb-92c8-e6344d94907d", "comment": "Malware payload", "value": "3d4b7ef0bddaa4ef9a82de9f9dfc88a5b09857cc", "object_relation": "sha1", "Tag": [ { "name": "209-54-102-173", "colour": "#131546", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777688, "uuid": "8c401e7e-88ee-4a10-a353-13911b30eb4d", "comment": "Malware payload", "value": "ac4b2f251824a4cee522fa87ed2a49d31d0d3b67c995925a2947a62d35fd9d98276843317d2f77833616b948c1be607b", "object_relation": "sha3-384", "Tag": [ { "name": "209-54-102-173", "colour": "#131546", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777688, "uuid": "487ce56b-193d-4499-898a-fd1696f1fba2", "value": "T156C3597E27358CA6F484F481908967F0ADE0874A77174EFC82DD4B9274B85ACD871AF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777688, "uuid": "8748b75c-8eb0-458e-9b78-dc6c0601a38d", "value": "768:yx2lx7Fx5L2Zx7AxHx2Tx7fxWx2qxwFxHLxbxcIxJxxyxwhx1x2Ixnsx8x2Qx7Fa:lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748777688, "uuid": "030e8438-2a83-4343-a393-bf0246503226", "value": 122538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748777688, "uuid": "da1b33df-3516-4b12-b25b-dc284c91f551", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777688, "uuid": "4c075490-1475-4107-b955-b85285d2028e", "value": "goodwaytocreatebestthingswithgreat.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c94498-3f11-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748800472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800472, "uuid": "297a7fc5-8802-44e2-99f5-31031adca5c0", "comment": "Malware payload", "value": "982780cdc531fbad49827c0196ee5a39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800472, "uuid": "972d2dbc-92cc-43f6-88f0-e87c5f3fe1e4", "comment": "Malware payload", "value": "b6ca5725344f3c6be5e37b33aaef72fd9eb3393ca0adb53fe263085d29d40e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800472, "uuid": "5874c789-5e76-4c6d-91f1-093949a83b00", "comment": "Malware payload", "value": "2adb88434a5fa70f0e736cbb8e45558c1ca1e089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800472, "uuid": "e748bdde-8c24-43ae-9aa3-c274d378c724", "comment": "Malware payload", "value": "53dee3b03712992ff68f9037b0edc6b8b2294ab3bfd6bd67e7c7be40303dfd228fd9ba0293fba1d4cdc018db1ae77ab1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800472, "uuid": "389b3264-8b47-4dc3-83de-15c3e01c6f46", "value": "T1DC26333F532686ABDB98A571A4C18511FCD382E81C22ACC6774E129D7B5337B07B6363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800472, "uuid": "72ac96eb-c0c2-44dd-aa7f-2464b0487fa7", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800472, "uuid": "2a1f584b-2454-4490-94c1-40bdf09e26d6", "value": "98304:iYeAktWkgGeFd/iy7ZEQV6BQD63yvQCXzrQKpRw2A4Ln/rr+hivisVEM:AWkg1Yy9V6BQD6UtxTTehuZEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800472, "uuid": "f2a4c8e7-76ee-422d-9f5a-c07517d41d36", "value": 4784128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800472, "uuid": "4359c37c-d9f3-4c43-bc10-09fa840fcaa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800472, "uuid": "5b1fdfe7-7a8b-4de2-8185-a9d7ea19f6fc", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31207c6d-3f27-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748809800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748809800, "uuid": "0c3c28bc-2b75-4ede-b57d-96c48446b1ee", "comment": "Malware payload", "value": "482c803eec74c3729a483ffa50b7d684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748809800, "uuid": "654993d7-a24a-4527-aef8-3f9015fe2324", "comment": "Malware payload", "value": "b73aa988f0ff746593583972ab3a3276636c4ba30da2f51feea72d4bd534b1f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748809800, "uuid": "ffc50a27-2641-4d62-8735-3b654d07b94a", "comment": "Malware payload", "value": "0174987fbfcb054420b677eb963e112a98465db8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748809800, "uuid": "c1b6a9ae-55be-4d8f-b3ff-4f41f946f9c9", "comment": "Malware payload", "value": "4f559d33caaca8a11cb169475c86a14c1a7795b681a72ec2f90070190bc789aa024c4d5f480090ddf3461a766a3cd18d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748809800, "uuid": "0fe634ce-b3f4-435c-b67b-7a300c575fa3", "value": "T13D263367603B198BE7580776E9F31971DC23895E0AED0C96291E1F903A6333B42E2F75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748809800, "uuid": "7fcde30f-03e9-46f7-ab2f-78606a726033", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748809800, "uuid": "e8f0e3b7-49ae-4c31-8f4e-393c9c90c5de", "value": "98304:m8b6LyeCa3OZN+cnBRYPr0uv5wD9I2NcYggc8wR2aQCALBMfUX4o:52LyrCOZLnBqPrNxwpNaR29t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748809800, "uuid": "adce1de5-046a-4524-b2d3-14d4e22d60eb", "value": 4708864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748809800, "uuid": "5b5c212d-7ec0-4c7f-8191-8b0cb96952b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748809800, "uuid": "48871c61-8771-4948-936e-40ac419f505c", "value": "SecuriteInfo.com.Win64.MalwareX-gen.10595.32634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f101432-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748807193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807193, "uuid": "546dde9c-5167-4c1a-9816-24876a91aeab", "comment": "Malware payload", "value": "932c2ca49e133c6540c300c259288918", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807193, "uuid": "133b2ad6-13e8-472e-bcca-c8bc1c7c3037", "comment": "Malware payload", "value": "b7b68cb90a0b1c3550d9d8e6b5c7143fad2fc4b4e1d0b6bf39a36d053eb31849", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807193, "uuid": "5ab1e71a-f1fa-4060-b5eb-8b3d3f6fd479", "comment": "Malware payload", "value": "96d7c5222cf8aac2e536419c0df712acaf81a60c", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807193, "uuid": "b122984d-209e-4cdd-a376-48a35101b79d", "comment": "Malware payload", "value": "972a23dc3ba42aed2a6d2d0835953593f55499ba3e30240de7e3f6506dc1446e35b5798947735e81fbda6eb8780f9de0", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807193, "uuid": "ae9da6d6-d253-44d8-a859-e8e5e2a3a269", "value": "T15151AE3D8A21FCD4436F71A089A53E4710985E73CAB06B3CE896186B4D65654DF6B28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807193, "uuid": "e76581ab-9e8b-4374-88df-9377ac889f6a", "value": "48:tsGi0BUJauLhWiy0fAr0f6qLMJGT9tkKEKKHtQMkRLLJm4vyjCwRwQoAl:xi0BUJauLny0fO0f6qoJ6AKEKKt6RLLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807193, "uuid": "41b6b7cd-a336-4c04-bc69-6cc76f6d80eb", "value": 2814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807193, "uuid": "cbe32c0f-fb47-4e27-84fc-dc9a0414189b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807193, "uuid": "e8da1eb8-466c-4613-82a0-fd29eab80a5c", "value": "index.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124be731-3e92-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1748745754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745754, "uuid": "daf03162-c5d0-4808-b5ee-edd4a0aacdbd", "comment": "Malware payload (XWorm)", "value": "5094748611c28a8b39f92fea36f42b60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745754, "uuid": "12a9de47-5e6d-44bf-96b1-5f7cfd3901ae", "comment": "Malware payload (XWorm)", "value": "b83aafbc430af19f722ff6bddf66d2b46e42454082f917a144603267d8a654c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745754, "uuid": "045393b8-3601-46ec-8685-5535e5bd234f", "comment": "Malware payload (XWorm)", "value": "23115b6f4432067b996e83badad2ece571f94c20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745754, "uuid": "5f113c05-1c75-4d07-807f-fb6c72a69c20", "comment": "Malware payload (XWorm)", "value": "b00a42ab8a86f26ba25dd1c63bb208058002ae852ebef85d18fe8cd83330fb6d8ddc40b5eaae85008a12da95757bfdb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745754, "uuid": "765ed784-d76b-48fe-a225-52fb4dbddad3", "value": "T1A7A4232C77DAD149E87E8AB125FA9A50D21BFD8664338B0D815283CC3D93CC6D612DF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745754, "uuid": "24544ce3-edee-46a0-b025-907010f1da68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745754, "uuid": "025d9adb-ede5-4fe1-b03f-10a55cfe4d14", "value": "12288:E+r3hetk4CHLn7g8xPATiREMeM+iMqvLwWr5aWDKk:nDhSkBHL7g86QEMeMiwr5aWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745754, "uuid": "3bb1b249-ed04-4022-9852-acfe4406d36e", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745754, "uuid": "4b7f41c9-63c6-438a-8e78-8bb2625ca1a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745754, "uuid": "ddd0fe6e-8aea-4d40-baa4-dcceb931ef27", "value": "XWormExploit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8b4b9a-3f0e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748799030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799030, "uuid": "433cf0ad-c4ed-4234-a49e-c49fe4a1159f", "comment": "Malware payload (LummaStealer)", "value": "01f880f5b33faaaa6b1711a92e1ac9d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799030, "uuid": "b9a82249-bc4e-4279-b2b5-86abb0f31f96", "comment": "Malware payload (LummaStealer)", "value": "b863db4377828c456397781647e2b05ee1b7ea7da415f2850a2eaf8a11db0e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799030, "uuid": "ce00da16-a9c7-4b8c-b6f7-ddbaf8ac7e66", "comment": "Malware payload (LummaStealer)", "value": "b2b7384973f93e7a8128ddfd2eaa2b6d06f1a19b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799030, "uuid": "9e5df784-d245-40e0-8f6d-8b21db4d9f6a", "comment": "Malware payload (LummaStealer)", "value": "480171352dd0a4b53aedb2ee550c7f62591b150563defbeb2d6cb51929ee240e776c8ca575618b1773b5ceab566fea89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799030, "uuid": "7730978c-a16c-4582-a9fb-5261c61669e6", "value": "T143459E29815691E6FD6A90764875B9547822F633C63D2FFF8294E332AE03BD05F2931C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799030, "uuid": "f6a01e1d-213c-4d4b-b79f-cae4fba93229", "value": "bb36df4412e03dad091fc4f040871a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799030, "uuid": "ed8ff08a-251f-4818-85dd-d5264e05d1dc", "value": "24576:6jhXdDhTgO+Eg+UHPx4d7jepO4Vy9WWWtqYnnKLL5pJ4XEhM9LFG/a:0dNTgO+B+pjt4VypYnnKLL5P8ECtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799030, "uuid": "f4d86ea8-565d-408c-92e6-a08ae572866d", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799030, "uuid": "5cc5cc0f-9d90-4337-9aa2-d71df47c0c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799030, "uuid": "49b83417-6dab-4d02-af00-1dd3b3dfdeff", "value": "01f880f5b33faaaa6b1711a92e1ac9d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953115b3-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748799660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799660, "uuid": "1c2cb2dd-aa8c-4ebb-8858-2a8a0bd44c8a", "comment": "Malware payload (RemcosRAT)", "value": "c9345d0b4f12f97b47c8c78bf843ca96", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799660, "uuid": "bce94281-38fa-4823-a6a3-787c1757c58d", "comment": "Malware payload (RemcosRAT)", "value": "b949c36beadf1cf1e1080a8e7e23fcadc62a678e5d36a6804cc0c4de423cf508", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799660, "uuid": "88c0decd-f137-4ee7-a1fd-f463804842cd", "comment": "Malware payload (RemcosRAT)", "value": "e455f1e0f78202ac487849e4b869fa989142437f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799660, "uuid": "99979cac-f664-4c77-919f-00b35a8079e1", "comment": "Malware payload (RemcosRAT)", "value": "01ef7361cc090ae96278f1e8a2415c899eeb3b59514c11a2dd0fd1d7673a0965eafdfda9d6bad470ca830ab0b04a03d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799660, "uuid": "28bb8d4c-66ff-4ae9-9a2f-583aeb235432", "value": "T1E0C53AB23392F94782358EC7C41F8ECADB2DC6E4A1A763CD655711D9D8FF448C286A24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799660, "uuid": "92056e39-9c43-4da7-94f4-ef4bc2a7539f", "value": "24576:Np66hqoyISBSoxf5P9/54BehR+uAnzdidkg4OUu87AsgfA4a:brhz4d5z3AbyUIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799660, "uuid": "11f26e33-381c-425e-8dfb-034d6e82e590", "value": 2741413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799660, "uuid": "fb212ed6-4a0b-4b6c-ad33-402e43c2e9ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799660, "uuid": "ad53038b-6483-4521-a720-dda7567ab145", "value": "kix.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bdcf98-3e9d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748750481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748750481, "uuid": "9561f23a-3f7c-465e-b719-3b32fcc4b94e", "comment": "Malware payload (AsyncRAT)", "value": "e760cda17c2949a8b41b32f6f76f202a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upload-ee", "colour": "#05047F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748750481, "uuid": "d8edd8cc-1093-40f6-b0e1-7dd3a8bb8eda", "comment": "Malware payload (AsyncRAT)", "value": "b9657e8c283242732a1a6e98b45f4eba2b0dabac803f7827d7f19935c0a15d25", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upload-ee", "colour": "#05047F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748750481, "uuid": "5b34231f-5411-4329-b403-b53028c69aef", "comment": "Malware payload (AsyncRAT)", "value": "f1a4dd95216085f557522983c6cb1186b7f65a06", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upload-ee", "colour": "#05047F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748750481, "uuid": "f5bc3925-8292-4ea6-92ad-6f020fd93e29", "comment": "Malware payload (AsyncRAT)", "value": "7b72e63931d1df5faf7d717d0d78023822eb19397e0c8defb434ed1990951049c2e70a91788e8eeb738515a5dad6408b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upload-ee", "colour": "#05047F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748750481, "uuid": "5c518d84-ad74-4a78-8501-2d83faaf9f9e", "value": "T134231A003BE8822BF2BE4F78A9F26145467AF2A36603D54D1CC451DB5B13FC69A426FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748750481, "uuid": "313085b7-e65e-483b-921c-1a98f1f4abd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748750481, "uuid": "ef9a883e-f69b-40a6-891e-f5db80909f21", "value": "768:qu/dRTUo0HQbWUnmjSmo2qMwKjPGaG6PIyzjbFgX3iP8P2OEzizbiBDZS/:qu/dRTUPE2kKTkDy3bCXS0emcdS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748750481, "uuid": "eb7baf3c-a819-4e82-b4ed-2fd954022813", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748750481, "uuid": "678b71ca-8567-4ebd-87db-c6c668877995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748750481, "uuid": "8af9c971-fe8f-4677-ab60-b99772678260", "value": "AsyncClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2dc491-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748786524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786524, "uuid": "308ab10b-c936-4f4d-82e5-2c7bbf113c16", "comment": "Malware payload (Gafgyt)", "value": "548cfc359bde5b131ece63c7e5b8da5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786524, "uuid": "a95f595f-ada2-4ea5-9184-e5c2b82f4861", "comment": "Malware payload (Gafgyt)", "value": "b99d613414b129ad0487c20fced9e7fb8136b5b19d284c971e22e49c13c3c046", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786524, "uuid": "4ddad911-9167-4624-8e02-b56f46f4014f", "comment": "Malware payload (Gafgyt)", "value": "f476adddde2bbfe1d8c25b191612ca57c20f2488", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786524, "uuid": "9c7711ac-54b8-4bfc-884a-548898b96232", "comment": "Malware payload (Gafgyt)", "value": "49316aa870a15b531a96a2f37b52bd942668398e443aaa9d73fa7a13b3bd9c928f53187ddf51ce7fb36405a72b05e423", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786524, "uuid": "3f4d0059-749d-4ba0-a361-69968eb88246", "value": "T1DC04A72E3E11ABBEE168C67107F75B60C3952AE325D15382E26CFA185F7028D195FBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786524, "uuid": "da3ab0ec-dafb-439c-bb9d-91ed183a3d79", "value": "3072:SfKeAhEHB6kdZN/WetJ8add9QzxsbSROOfvqtdfi+KqLwZi+LUk:WKFWwmFWetJ8addQ2Sedfi+KqLwU+LUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786524, "uuid": "a02c520c-5419-45fe-8d66-36abcf2dc388", "value": 174954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786524, "uuid": "64e0eb90-e58e-4a1a-8bfa-95ebc137031f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786524, "uuid": "63a02f28-a9db-43d9-99e3-a7d99021b79f", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213bcdc4-3ee7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748782286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782286, "uuid": "0324cd91-1954-4c77-aff3-c636f44cce3d", "comment": "Malware payload (Mirai)", "value": "a1b9cf5bf012ee0a98212fd073fe534c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782286, "uuid": "770f5579-86e1-4ac0-9b42-07c447cd3d87", "comment": "Malware payload (Mirai)", "value": "ba86aac36c7c86f1222f62547c0e787abbe7b89214ff39b75d58eb41ca65c776", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782286, "uuid": "6b030aa9-f13f-4f73-855a-2f3952b555ee", "comment": "Malware payload (Mirai)", "value": "221fcda78fd44aede5e7f40a37cf62a7fe6609b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782286, "uuid": "5694bbde-970f-4538-9e5d-ff052785a467", "comment": "Malware payload (Mirai)", "value": "4f35c89bf591b876b7a07fb2e8c42041d622ad6ee1759a8a050df1bad8a0c2c46447dcdd86289923b3c265d53e59dbce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782286, "uuid": "fbc56798-fed6-4697-aaab-9134395508aa", "value": "T13DE3F945FC404B27C6D622BBFB5E428D372A17A8D3EE720799216F213B8695B0D36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782286, "uuid": "4f81571b-af1c-4e89-8b4c-313c622ae934", "value": "3072:yK0EOnyAti31qTfc4tF1D9UtGl6zA5C9R:yK0ZI3cLc4tHD9sGl0A5C9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748782286, "uuid": "cf02ae40-5233-4646-b93e-f5a70ae488d6", "value": 146304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748782286, "uuid": "913e7b44-7e5b-4551-a545-08c8ea5de72a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782286, "uuid": "d280d0b5-57ee-4a58-95d2-3532c6cbd020", "value": "navo.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c83202-3e96-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748747749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748747749, "uuid": "75d29ed1-04ba-48f9-8e91-1cc63cec88b6", "comment": "Malware payload", "value": "073be361046e4e164400d765496fe55f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-noxiodaaa", "colour": "#EA5AD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748747749, "uuid": "98068af5-c732-4ce0-a7c1-3b87b64eac40", "comment": "Malware payload", "value": "bb63729fb9011dc2f24f60059b3943f18d3e289ea4223bc0b061af93d8f347c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-noxiodaaa", "colour": "#EA5AD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748747749, "uuid": "2162add7-c404-4f17-808a-9aa9d291018d", "comment": "Malware payload", "value": "ea8b2ec41a51e468e6800f89a760416cc0942d3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-noxiodaaa", "colour": "#EA5AD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748747749, "uuid": "baecba02-5579-4dcb-8bbb-ac7a2cf6fb00", "comment": "Malware payload", "value": "c5f52cc94abd1fd790e4b085b2b0e9f2ad1e025aebf30604f0aa7685f39aa7beebd8ce65b55dbd855e8a7064efcb989f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-noxiodaaa", "colour": "#EA5AD6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748747749, "uuid": "71a77223-4c7a-4da7-bdac-75f4f29585ee", "value": "T1E2739437DB1690BAED698436860B1D05BBB9F88943605BC767CA0CDF0E657F49E3A301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748747749, "uuid": "31b4a309-b01a-444b-9f7c-1f6da25c5fab", "value": "16e425ea6fec3acd91cd254b59c9d5c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748747749, "uuid": "f517d457-edcd-421d-8b38-d31257229357", "value": "1536:r8d+mmqixFCFHtif8MO8p5d4xFIxJG9vCHG:r8Qnq2kFNif8MBkxFIxJ2vCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748747749, "uuid": "6b322dc8-c73d-4b68-85ba-8086a6216448", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748747749, "uuid": "ea80a3b8-ef54-4043-add4-65743a8d8f1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748747749, "uuid": "29175fe9-dc32-4c80-b1c9-92d1f991b459", "value": "Cobalt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b6e3ca-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786568, "uuid": "20361db2-2d30-4f8d-901a-584f07b626c0", "comment": "Malware payload (Mirai)", "value": "888063f5273816426c11cf5c93e049f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786568, "uuid": "96693895-b84c-4016-b5a5-5eb1e004372c", "comment": "Malware payload (Mirai)", "value": "bd269dc4c778e4f542a8944c2b671ffec2cf40bf336143e1d8b68989384c4f2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786568, "uuid": "8a39b0b1-a13d-4a63-aa8e-be8ec202ee9a", "comment": "Malware payload (Mirai)", "value": "4a92eb24d9d530feab0e6276f4518830c34c06f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786568, "uuid": "3cc00c1c-0e02-461f-941c-0cf40dc059f1", "comment": "Malware payload (Mirai)", "value": "5ab49759584b29eef3cfffe3c1394f042f992f5d7ec9d14f3597eed4b55a846736ad68ede0b1a68af9f31b1e45708145", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786568, "uuid": "9a19b605-6267-42be-8bc0-34d2dcbd6ef6", "value": "T1F2630A96B8818F26C5D5037EF92D118E371227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786568, "uuid": "afe4674e-5628-4b1d-b605-902786de4f67", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlcrfuscXIui8jB70w7h:VqVMkWV8PPbGjB70w7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786568, "uuid": "f6e3ffbd-1823-4d1f-8c2e-d7482b08a565", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786568, "uuid": "00155bf5-4c9d-4ce4-9344-22d640db3d58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786568, "uuid": "0ccaad3b-3058-4ec2-9ac9-bb203efa5f54", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b36eb3-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744852, "uuid": "a2cea6b1-56b1-415f-b2b9-926307fa80ff", "comment": "Malware payload (Mirai)", "value": "59751a3417a646a5390badbfbd767a39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744852, "uuid": "08b40809-b382-4f4a-acf0-f38e69183d9c", "comment": "Malware payload (Mirai)", "value": "bd462db773dfb875b2e4df09c504926ff003b1f63528c3b01507599310502c55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744852, "uuid": "d2289266-131f-4250-9d20-d38b204e2be5", "comment": "Malware payload (Mirai)", "value": "43375fc892b43d4a05a75350c7ecff0a5954e1a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744852, "uuid": "1e260d78-1518-4a3b-9c20-441b7b17c963", "comment": "Malware payload (Mirai)", "value": "3aac990e9ce17db0d452e6322ca1173a55c34210b6ca0b36497e29b47c5aea88728e6672fed6591d558b492ac1904586", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744852, "uuid": "e4791707-0a9a-4e53-8cbf-5366cbe04c3f", "value": "T181431891BC819A23C5D4137AF56E56CD372133E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744852, "uuid": "274174dd-144b-4a8d-8f09-d9e68f796350", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744852, "uuid": "047f927d-0da3-4e12-8818-1c4620b48acb", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744852, "uuid": "b8e21bad-8e8d-40bc-8614-d8de5de0a264", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744852, "uuid": "a669253a-de27-471a-8228-987b29c05a0f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f757996-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Metasploit)", "timestamp": 1748765237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765237, "uuid": "e538f569-eb26-4909-8f33-23eb7be2dc3c", "comment": "Malware payload (Metasploit)", "value": "d9b04f5d6f1999cbdbf4f89e15f5570c", "object_relation": "md5", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765237, "uuid": "ae0d2bd2-3f98-47a4-b06e-ffe6e5f5b0f4", "comment": "Malware payload (Metasploit)", "value": "c1a3fa2dfce0f0a2b57254388089e1518e7c1c707a6ef16907df97502e797a63", "object_relation": "sha256", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765237, "uuid": "9ddaed7a-135f-4ae6-b722-34339102cec5", "comment": "Malware payload (Metasploit)", "value": "860655792b4ede24340130b82d3a080d5d512968", "object_relation": "sha1", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765237, "uuid": "1cbd077c-0213-49a7-847b-ce9248dfd3ee", "comment": "Malware payload (Metasploit)", "value": "34f4b632cfe9aa4c7fc4177f14f581b5daab14b1cfba7d0a6a523ca78b42fda642f8e5ff46719737fc341b69a1b6bd1e", "object_relation": "sha3-384", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765237, "uuid": "4b5c0b05-e158-47a7-a4f7-33a9f33a27e6", "value": "T1DE445CC5BBC9ACD6CA044239889B43293738F6D157974F272D2973311E27AE4BD8760B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765237, "uuid": "8549dc61-005d-4d99-91e2-7a29ae60d163", "value": "6a756e5db3934c4fad8741205849011d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765237, "uuid": "35f5605f-7463-4d90-887a-2261a062fc07", "value": "3072:FFGlr1ckyr0meVA1JYTys3FzRzHXti2O1qPZg6QSa/ImggX6EeIuiWFEx/eLRd6:+lrbR9zRrXgrxT6suN5Rd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765237, "uuid": "3f8e38c9-e397-4cda-908f-8e7e05934628", "value": 274171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765237, "uuid": "c2d0252b-690f-4625-95d9-36ba28dfa348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765237, "uuid": "1280410b-a965-4144-8c4c-ec7c79e5f368", "value": "winxclient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc0499d-3ef0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786520, "uuid": "e817d417-361c-4697-b533-27337854e08e", "comment": "Malware payload (Mirai)", "value": "d21577c5dd1f8b16482f4f0639e25fe9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786520, "uuid": "80993627-cf9e-405b-b8d6-9086414fd1e1", "comment": "Malware payload (Mirai)", "value": "c2c42ae94273cf5347555cf5808a50a2f97a43283268a84e6164b8925ce5b81d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786520, "uuid": "4e4cf12b-cf5e-406a-8e08-fb6105003afd", "comment": "Malware payload (Mirai)", "value": "f38ab9d06d7e12ff08809a36c6f822a1431b84ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786520, "uuid": "56b2236e-abc5-4a9d-bd20-723924dd5030", "comment": "Malware payload (Mirai)", "value": "fc7074875f3a4259f46bb774a4e504241543eac643e0c1fe0764a4fe2821902b8c59f997e0839779898b408fbecf5571", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786520, "uuid": "d6fff655-3732-418a-863d-1a3b2c285b73", "value": "T10003D079E4480CD4C8BBCCB5069407592E1853E7F4D29C13B8824B87AD66DE9199AFA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786520, "uuid": "c5c7df7c-c468-4d49-8d21-3d87c6b279b8", "value": "768:ZngtcZsBQlKfvKC1Vmr+fLtPfeG8UNcHUhqNj7Y/J0LdvxL1Jq7lq21JgGlzDpbc:Z3ZsbfvKC1W2Vf+UsJ7Y/J0RvQlq2vVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786520, "uuid": "0e496121-e69b-4511-a8b0-3070ff359958", "value": 38172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786520, "uuid": "1e2f795b-e3f7-4638-be09-f6bf0447ebd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786520, "uuid": "f3ca9372-2e57-4c76-8e6a-0cf9b3cee23a", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02199612-3f18-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748803279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803279, "uuid": "713d2b76-7cf5-4023-acd9-a1f5cf0ce804", "comment": "Malware payload (Prometei)", "value": "cbd845f384de4bd2073aa9299003f25f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803279, "uuid": "3ebffb05-96b0-4b48-841f-2e246577a12c", "comment": "Malware payload (Prometei)", "value": "c32424bdbf401c5ae19259e6d8940021918e43d2a916618b0738854729c778a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803279, "uuid": "41200d75-2ca2-4fe7-9bb0-e812f5e234d3", "comment": "Malware payload (Prometei)", "value": "f8327946dcde8d73a21fb7438be1191a2529fb66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803279, "uuid": "09b248c9-a2d3-4e57-aa74-db0a0fadb1e0", "comment": "Malware payload (Prometei)", "value": "40097f9491099f1f6549d520af04423d047586e1a923bd846a536af73abdd6f9434d536cab4ee1ada1487a5f57821c76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748803279, "uuid": "4041b9d6-7711-4cb0-b111-d23ceeb634b3", "value": "T163155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748803279, "uuid": "7d349957-ff67-4762-8df8-14382fc7f4e6", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplY:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748803279, "uuid": "8d3bc871-372b-456d-868e-0be87ee33e24", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748803279, "uuid": "1449cbdd-de5a-4c72-baf4-c014d165cb32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748803279, "uuid": "e7fb2e90-95f8-4f3f-b256-1c75ba0cd3b7", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04aa8c42-3f01-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1748793405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748793405, "uuid": "55d6b46d-b6a2-44fd-90b3-936a761054b2", "comment": "Malware payload (Gh0stRAT)", "value": "a933857032c2d20f9b2b9ea5705cc183", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748793405, "uuid": "ef824e30-15fa-44ac-a96a-d7a5e8e79cde", "comment": "Malware payload (Gh0stRAT)", "value": "c369ab1e4d63550f5e9ff7944e2f5c3abe95e7a4918c5e6432f404df5ebf0db7", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748793405, "uuid": "e31f3f8f-bcc3-48e2-99c5-e4dbb8f79b2c", "comment": "Malware payload (Gh0stRAT)", "value": "358691d5fd8d1db64438c803e9796310e196b9a1", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748793405, "uuid": "b438b2ba-2ddd-412a-ab8c-5ea73beb662f", "comment": "Malware payload (Gh0stRAT)", "value": "eac45effae1269c5751d26d4152c969cf6b49e61a24f6fb830e1ba81b8b898715073e90887b3ab9448cf655c5087d68a", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748793405, "uuid": "05472bf0-daa0-45f0-8d77-63726e9e18ad", "value": "T15546120A76A211B4C453C175C7D7436AF3B1B64B8B224E8F27E499025F63AD46F2E339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748793405, "uuid": "78c607dc-4fba-49f5-8e3e-6d125f0fe2b8", "value": "211eafd76f4f1d028188dbce11ae54d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748793405, "uuid": "4a543fe8-6fff-4db2-9c35-31d393832744", "value": "98304:vsIeUppSn3SDVYAly3+3Jdy9iIuxqtTVE0LpR1kOKIbTQ1+fNg3eb:AgUnCPyO5CduwtTDl5KI41ENg3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748793405, "uuid": "5829c486-54ff-4cbc-8dce-5ff10aa4590a", "value": 5376512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748793405, "uuid": "839fb4cb-6964-46d5-9224-dfa851dcdbfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748793405, "uuid": "58a5126b-433a-4c7a-a803-6f81a8dde230", "value": "cC.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38192f6a-3eb6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748761279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761279, "uuid": "11c8b33b-db89-44e2-9baf-76de451f9161", "comment": "Malware payload (Mirai)", "value": "7b7bfe83ef69e5129224da7ec5ca42df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761279, "uuid": "8fc9191e-56ab-4e6e-98d7-d5090148f67b", "comment": "Malware payload (Mirai)", "value": "c3ec4e7966aabc4763016714fff5dcc7276f3e84c598f69350671d4489b3989e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761279, "uuid": "df285125-da55-40df-8b17-0f06c5077596", "comment": "Malware payload (Mirai)", "value": "c954e7a8963373924cac60488d9ed3829ffb31ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761279, "uuid": "88c90805-789a-4da9-a39c-07dcc306d784", "comment": "Malware payload (Mirai)", "value": "c0d6c152fe3fd7694acae9a2df53d147098626b227a41dd54fadac2e6f53c8b7da757a38ecf538d26085f17973e3cbc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761279, "uuid": "8c9fcaa0-597b-4b55-9340-f3ffcbc3144e", "value": "T1A223F19064EAE548F64481FC0AF971092C58A9DCDA2243DF1944AB32FF5BF295BDC3C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761279, "uuid": "95e53d84-bcaa-4ada-bf1c-2dbd687a8388", "value": "768:9S0YctpPgTiFXLCD96o2RlyxqPbCXQJ47eZcYlreLSGhez5TMnzrQynbcuyD7UH8:U03YTiFXKcoWgxaH47eZcYlrebheJMz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748761279, "uuid": "0868f05b-c7b2-484a-834b-8e6ef199461b", "value": 46944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748761279, "uuid": "98369db2-39cf-4988-8f16-006eb3f19145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761279, "uuid": "50ee7396-edda-4c79-a1ec-90d711095afa", "value": "neon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23bc225-3e7e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Loki)", "timestamp": 1748737513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748737513, "uuid": "fd4a8885-eba1-4611-8c0f-9b89ea412ad7", "comment": "Malware payload (Loki)", "value": "e14e8af8b219f2de750410e5604f7005", "object_relation": "md5", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748737513, "uuid": "9a5a8de0-2d88-4b18-86a4-ae2adc9df1b8", "comment": "Malware payload (Loki)", "value": "c49ffc408cbe1ee74d051e6c0ba32bc49f2f16f72e41f008892ffd2a0be87f20", "object_relation": "sha256", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748737513, "uuid": "1fdcab3a-7145-467b-b3fe-30d956d0e3c2", "comment": "Malware payload (Loki)", "value": "8be90fd2bb19bd7e5356332b88e9dc5a461479f6", "object_relation": "sha1", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748737513, "uuid": "600324eb-e56e-4056-8f3b-809700e40076", "comment": "Malware payload (Loki)", "value": "c595cd18ce83bdb9c25a892d35de2adb7e329a6bc25edd17d44fc491f78230d976a0684d0551618e13acdb20f63868ab", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748737513, "uuid": "484fc6ed-fda7-4d51-8cdb-a7688b37d78e", "value": "T1D925BF1363DEC361C3B25273BA257741AEBF782506B5F96B2FD4093DA820122525EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748737513, "uuid": "1023c89d-b4fa-4e32-8a0f-ca8bdeaf91e8", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748737513, "uuid": "88fbe324-47df-420c-a085-29e9c0abd5c5", "value": "12288:utb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaOTCuW36rvjb6A:utb20pkaCqT5TBWgNQ7a26mrb6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748737513, "uuid": "1dfa839d-1255-4b58-b770-038dc912ad8c", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748737513, "uuid": "181eb4ec-1305-4489-9724-23894d541235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748737513, "uuid": "4d6502a5-99ba-43d3-b4f6-206ab34d7aa0", "value": "alphanm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1479deec-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786560, "uuid": "652e8b99-f297-4745-9fe2-1e18d3ca59ae", "comment": "Malware payload (Mirai)", "value": "4d6d780d9ae1a66d52a911307af58603", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786560, "uuid": "519f9aef-d5cc-45f3-b5d3-3eeea6cc4076", "comment": "Malware payload (Mirai)", "value": "c4b0e963471660597005630fcfe8b9373274cc60f92fd9e8f4d98a6d45855c84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786560, "uuid": "9cee20af-54e2-4a70-8b34-3ffa0fa10ff7", "comment": "Malware payload (Mirai)", "value": "07808a1c21e657045847a8f9ecc346546fcf770f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786560, "uuid": "b790429c-3cc7-472a-a582-52cf3cf5f9f6", "comment": "Malware payload (Mirai)", "value": "681f1b94b268e9fbef47b4b8be97c6e34ba9564440d960f42c3edb7fa7a927131b0e8472553b5190f08b263b56ef8a20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786560, "uuid": "54beee56-3c41-45f6-a059-038b2ffdc04c", "value": "T1E4B2D03C5B111B98DA1EC0BD839C1B513CB81B25E182AD4B6207FDD7AF968747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786560, "uuid": "abd61dab-c87c-4ed6-9bde-d6ff6dbd0540", "value": "384:6eD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuifsvmd1JgGlzDpH7uNj1Jy:6eD8ZSWvZHZbs1row697qohQvg9Ci1JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786560, "uuid": "d2d52d0a-1ee0-4775-aa0c-9c452afbe806", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786560, "uuid": "4814b84d-8367-47f2-85a6-5f809d54ef3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786560, "uuid": "3cb66def-55c1-49ef-bbc8-84562c1155ca", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e055db-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748765084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765084, "uuid": "c775736d-193a-47a3-ad15-b46e86e5ffa6", "comment": "Malware payload", "value": "12e25cd01d0582aec498e928f1a315de", "object_relation": "md5", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765084, "uuid": "846b9c3e-1d20-4e0c-96c4-423770d28aa6", "comment": "Malware payload", "value": "c5261c0aaa7d85df85a033d58280261e84f2814f8c07a409e59a687620410cec", "object_relation": "sha256", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765084, "uuid": "f0e331be-968a-497c-9b2e-75cc01328552", "comment": "Malware payload", "value": "3854b45cbf5d2a0850367a9e4aad8d4a24c210f9", "object_relation": "sha1", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765084, "uuid": "c262e914-ae25-45ba-857a-608aac058e8d", "comment": "Malware payload", "value": "bd5c0b41bc871ee6179eb8623c77a37fafedb33f55e6726179fc11ad0b433631cfe2db7424dc3edc4aa25503cfd31874", "object_relation": "sha3-384", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765084, "uuid": "40554cf5-03d5-4901-885e-884f6df78efd", "value": "T1A231650560E896059A4643BDE9FB995C731F4197E8679E00F56E40816F38B3C87D3A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765084, "uuid": "1ee9aad9-a57b-4f38-8036-40dfef501f7c", "value": "48:wQlnw1D3W8riyrt3ejgShMyc6yPC4KLZeSAUC:LwtPtO9ryPctz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765084, "uuid": "478e8f17-118a-4d4c-ad66-c87f6a9b03c3", "value": 1585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765084, "uuid": "27ce8edf-4d68-46f8-9df5-6b5e10548e44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765084, "uuid": "0aabcb4c-29b8-43fd-b73d-58f222d599de", "value": "a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc188c7-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748800264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800264, "uuid": "280c3d76-f78b-4d4d-8285-91946c219c9b", "comment": "Malware payload (LummaStealer)", "value": "797c48fdadced37cc6089c3ed272f753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800264, "uuid": "20fc382c-1e34-41c1-8aac-cf3c8c0decea", "comment": "Malware payload (LummaStealer)", "value": "c63e591bd3694a4ab2dd9fe6e2907813fdc6efbb94663c4957054572fd2b6d7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800264, "uuid": "f791d761-f190-43dc-871e-f68731c30fc9", "comment": "Malware payload (LummaStealer)", "value": "e350e743aaad180aba1fe0467b97a3926ee39fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800264, "uuid": "f66f991a-dfd6-4140-be25-24775e4a7c22", "comment": "Malware payload (LummaStealer)", "value": "eba5e77a0f05b4c9c13c18fe4d3f136cd94b207146e73e074cba38acf20cbcb10ca0c1bbaa5eaca80fd8c77f0de42766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800264, "uuid": "f04e4473-6f78-4d7b-82b9-dc5bd3cd4cf7", "value": "T1FBD56C52A949F1CFD48E277C9467CECA986D8BB90B1448C7B8AC747A7D67CC011B7C28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800264, "uuid": "e9b6204c-5d78-4995-b4e5-a2d077bcaaa4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800264, "uuid": "a2598592-049b-4162-b83f-015d19098811", "value": "49152:dvKt1sQQk/80/wzRw1r7LG62aywNCKbxjW7pS:dv8q8/80/yRw1r7LxVCKyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800264, "uuid": "7ab3921d-8c61-410f-ac0a-72c2a60571c8", "value": 2987008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800264, "uuid": "e974fd70-7dd8-4a5a-a65d-7921ec4e5773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800264, "uuid": "aae7f60c-92ff-4760-9991-fb7ca235bac2", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd7b237-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786552, "uuid": "70d28044-5b3f-4b29-80e0-56689db319a1", "comment": "Malware payload (Mirai)", "value": "4bedfd149c9713cb4974a989e4c36fe7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786552, "uuid": "430cf012-83a6-4a73-942e-85c69da4ceb7", "comment": "Malware payload (Mirai)", "value": "c663612f28b020f247ef7baaccb7b8d097663b10c257091955b69fea65dce96c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786552, "uuid": "f6460f8d-148d-431a-bb2b-793d63fa6152", "comment": "Malware payload (Mirai)", "value": "758325439a4de3f3e2f95ac8dd463c020bf7eba2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786552, "uuid": "d641a383-c767-471c-b2d3-e2ca76f902e0", "comment": "Malware payload (Mirai)", "value": "76b78a566c342461e3eef694bb35d7a5aa6f4381ab75ca865b079b077d04f13ad37dbc4188632f6cb4474ffa147846aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786552, "uuid": "e9ddd9a2-7a90-48d7-933d-22bfb038a9d1", "value": "T19B63AE73C9296E54D29986B0FA308F789B23F54482071FFB1A9AC1B59087DACF6453F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786552, "uuid": "da14c814-6fa9-42da-96ac-c0e63a36748f", "value": "1536:4OaI7wt2/kKNoq6E0/KFCMWAAp5CpPUipNxwot:7xLkKNoTEnFrAp545rxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786552, "uuid": "6abca24e-511b-4880-96b2-6230991dfc49", "value": 67044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786552, "uuid": "ccf14d4a-0da0-423c-a491-23e8d51bf2c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786552, "uuid": "01cfe3b9-b7d7-485e-8e5f-58070a3052a2", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de1d94a-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748807191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807191, "uuid": "85d2c45e-20b0-458d-a8a0-ec5be3feafa8", "comment": "Malware payload (Mirai)", "value": "6ec672f78da2fadc80c3c496631f61e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807191, "uuid": "9f5da741-96ea-4fd8-a701-acf684b842d5", "comment": "Malware payload (Mirai)", "value": "c68d19ffbf440ae6c6a62bfb038d8cb0139c99205d9f6ba4ba2d37dad7068ee3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807191, "uuid": "17af9063-82fa-48ac-8cf1-2cc72a02143e", "comment": "Malware payload (Mirai)", "value": "96a5120b53ed94eb3fd3a2a8c6c1317603509c68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807191, "uuid": "6f0b8951-b123-49cc-be73-cafb92e2d2b6", "comment": "Malware payload (Mirai)", "value": "ac9f10379e9d979d96b2ee51365fa8040ed28f3e058627bab3ae037262ff51e997cd3835d0c7d6574e2f84296669ab06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807191, "uuid": "ba328ba3-1bcc-4f70-86e4-4dc8c48836ac", "value": "T163336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807191, "uuid": "4949d75c-bba7-4767-a24f-dd080468080e", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807191, "uuid": "3ec9d424-e700-4269-8626-131977aa1503", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807191, "uuid": "2a957560-4119-491d-890a-53b9edab1ce4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807191, "uuid": "a016b107-77b4-43bd-9d55-aa6ffede9bf5", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db52350-3f17-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748802976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802976, "uuid": "8aaa006e-7f99-481a-9d45-1c97bf6395d9", "comment": "Malware payload (Prometei)", "value": "cf1bd42290b860c5920f0cb5c8b7bc63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802976, "uuid": "8d42252c-80c0-4145-84b5-01d2f940d09d", "comment": "Malware payload (Prometei)", "value": "c7743a0dc5f06ff24c1eec29076ba1742e2d909d1edede424d05742773f5f7ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802976, "uuid": "8f961d1d-3b5c-4997-a8b2-19d07d0b16ff", "comment": "Malware payload (Prometei)", "value": "43c253e8d9fd131c062a47d24f1739e2f98d0a97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748802976, "uuid": "1b1a1a9d-52b3-4fbc-bedb-02a8b61b3882", "comment": "Malware payload (Prometei)", "value": "611d45273d99fbd196211c6bd996302d616f36aed1893a3216ea046b7b0a43912c0fcad8163fca861f90648d9a3a2be9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802976, "uuid": "2f4c52b8-970f-4882-b231-7405965b3461", "value": "T1169423F8C87D2E3098169B3CBB1A826CF0E15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802976, "uuid": "d5b344d7-9706-41e6-a6a3-6ed1facbf0d5", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgw:25WOSACZSV6eKRH5EPiamb4DsDwwcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748802976, "uuid": "9a283a31-a272-4700-bf49-da743a8a5c26", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748802976, "uuid": "48d5ca51-f9ec-4274-8745-18c1de2c76e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748802976, "uuid": "44ef6d74-8251-4064-9a65-5f716d88707e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838e8f8d-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748765271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765271, "uuid": "b68f9d77-dd86-4893-af98-33af92410234", "comment": "Malware payload (LummaStealer)", "value": "a7dc5c08e8b9c058c90a2c0c4ab2d998", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765271, "uuid": "fe90050b-1155-416d-aae8-abe5914d5647", "comment": "Malware payload (LummaStealer)", "value": "c7753cee74cbcb08ada1e61e9ef708cffc11d4c8f70493e439187b97acf0b238", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765271, "uuid": "3b55c25c-0995-4281-9d9a-ecfd86634ab0", "comment": "Malware payload (LummaStealer)", "value": "14e2fc401f7a9a7a9855cc7747b624f02c0db298", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765271, "uuid": "9874c141-e4f6-41fb-a6f1-de3c9ae6b823", "comment": "Malware payload (LummaStealer)", "value": "8ce9ac7f9b42e83faab3e9b30a3aa23d2d84125a8487176d563507700705dda4f98805e6284a440d60c684e70f5ff1f4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765271, "uuid": "5f279500-58d5-4384-bb64-db7876666751", "value": "T16DB4AF52AA81D073E58210F516BA97BB5E3EA6354314D4C3F3D44D746E20AE2BF3938E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765271, "uuid": "752c30a2-6695-4bda-b60c-7447eb60f89a", "value": "a8e4e1fe33697a4cfe2bb5ea52824f1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765271, "uuid": "a9db7216-6598-48d8-8048-a40db66472e8", "value": "12288:/w/Yl2eOOZ/Ql5ZWIvHdHl7EX0JbRoFO1fSBi9b2nYyCnQtvooR:/aldHldbXfSmb2n8nQJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765271, "uuid": "e96943e3-cb5c-402d-a8b5-afeb59bf3026", "value": 508752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765271, "uuid": "3e4b4380-fb56-40d7-a546-afc242aff8ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765271, "uuid": "d5e1caba-1081-43cc-bd95-93565c62e3c7", "value": "AliyunWrap.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8cc6bc-3eb3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760077, "uuid": "6cabb7ae-1b84-4a8d-b0d3-4c16e4e701ac", "comment": "Malware payload (Mirai)", "value": "3116eb417f1d8ab496624b2718b9051a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760077, "uuid": "61e852c8-dfec-4f87-8cdc-d97708777643", "comment": "Malware payload (Mirai)", "value": "c79b123c933874c1a9a39d28281ba000a83b899c48c2b1099921c4420f1bf6e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760077, "uuid": "c46376a1-d32c-41a2-b7e1-d99cab6041c6", "comment": "Malware payload (Mirai)", "value": "25a11af07133775b03cfc3878ed6201e4d908a9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760077, "uuid": "bbb7f618-886a-4e26-8c12-b1c4e6ad24d4", "comment": "Malware payload (Mirai)", "value": "7445b9061c8311b4e949aa8cda79374b160d6da67971fea85f5d3799b6a28e26bd39ce4cf7421a394fe954e300bf45e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760077, "uuid": "580594f9-dc9e-41ba-a63d-3f6f7d402085", "value": "T13643E75AB9828F05C5D822B6FE1E119D331357ACE2DF72139D106F207B8786B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760077, "uuid": "20c6bd39-2841-41a3-a411-0e43c3b3a134", "value": "1536:xv9nnyWTjWfzz7rQ/RKg9iutZGyJVsjcEOz9ISiN0yUoJ/g:xc+Uo/RKg9iubJOj9UoJ/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760077, "uuid": "4097a1de-d1ed-4493-b2ac-fbffacb75203", "value": 56040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760077, "uuid": "ebc42131-1533-4cc6-a7a3-cce633ee4c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760077, "uuid": "2ea63155-ee41-4931-b85c-a6eaae2cf0c3", "value": "owari.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58141eb-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748800251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800251, "uuid": "8e10e510-a08b-4f80-a4b6-e195a8180980", "comment": "Malware payload (CoinMiner)", "value": "d8f510ac64823de966fd7bcf06bb56ab", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800251, "uuid": "244032d8-5c35-4765-9c2f-4c3a855382a4", "comment": "Malware payload (CoinMiner)", "value": "c7a9bb79efdc381a2db4c5c43aa9afa37f5b2296bde4427e96238929ef9626a9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800251, "uuid": "1905d020-c7d6-4c2e-8533-e3130f6a50a6", "comment": "Malware payload (CoinMiner)", "value": "1031eaf7868b13d4ea4f70f1c1b3a5902449a6bb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800251, "uuid": "0b5601b8-d58e-408a-80f1-7bc15f894030", "comment": "Malware payload (CoinMiner)", "value": "694713eb2512163f513faa638c1a159cfc0993293f293b49c03cc186fe9caf0f20c425292b9a815595c00fbef560a2be", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800251, "uuid": "f7132fcc-f570-42ce-aa8a-c5f9d53f45bc", "value": "T15DD53381F799CED5E6C8E8B9042F81D923B6872A0C2E7610DD843A34E1D1963DF919E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800251, "uuid": "5b0fc9dc-1e31-4af8-b4ae-be6ee7a7d2e3", "value": "ab98215e9455f221a87db4471a49dfe4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800251, "uuid": "3ba5b5b3-4e11-4888-8a39-05ed2d1bc89d", "value": "49152:4maQsS23yDMykCDIJj654X3m47K/rEdVwBgemzO0y9m/yJ9Ab:GQsS2Fybsj654XWG1dVzet7Y/yJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800251, "uuid": "cb43a207-8f00-4eed-a0de-365361b4625f", "value": 2857984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800251, "uuid": "0b2cccaa-8e9e-4f7b-9147-a0b284fb9e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800251, "uuid": "c78df99b-9416-4325-839b-4a0f74757f0a", "value": "addon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524f49fe-3efa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1748790529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790529, "uuid": "1c3f5b24-e2f2-426c-865c-8a295f37818d", "comment": "Malware payload (ValleyRAT)", "value": "5365a0e786c2772be3d642afabfb6525", "object_relation": "md5", "Tag": [ { "name": "38-181-22-7", "colour": "#414557", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790529, "uuid": "4d1a9ee0-e392-4666-8ad9-496e581c79ae", "comment": "Malware payload (ValleyRAT)", "value": "c88ab130ce39eb602b71aa22312b20c9485c86ae6680b2081701312e5321f780", "object_relation": "sha256", "Tag": [ { "name": "38-181-22-7", "colour": "#414557", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790529, "uuid": "a691022d-a3ee-4cc8-b4ca-44b886ba8f3e", "comment": "Malware payload (ValleyRAT)", "value": "09afe24ee212ee0978fd9c8a89f6945c8046c30d", "object_relation": "sha1", "Tag": [ { "name": "38-181-22-7", "colour": "#414557", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748790529, "uuid": "4ed5e3ef-b303-4f23-ab35-03158e2051ef", "comment": "Malware payload (ValleyRAT)", "value": "d71da697345415f029c6866c416310817631fe2b966b6a59a2f2bb7615de8a20c0fdaa581fd7e8dbc2fe441922077de4", "object_relation": "sha3-384", "Tag": [ { "name": "38-181-22-7", "colour": "#414557", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790529, "uuid": "f810d7d9-381f-4a79-a528-924be97d04b0", "value": "T178773357B382A27BE03D0F334676E38499BB3E5118227D17A6A4B99CDE3D0541D3EA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790529, "uuid": "42f77ffd-da0a-4d02-84c0-1ddebf15b92e", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790529, "uuid": "f86f3b66-0af4-475e-b512-232a92eaac0b", "value": "786432:CZLVDGsh1eR8lLi1WTgIVwQbKvDmdKRptR/wZ+RwpXHIyx07ye47:CZLVCsyRwiET5VwNvDScp0Z+G9o407yB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748790529, "uuid": "15b2e470-3a0f-4959-9244-086b69c55416", "value": 34333270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748790529, "uuid": "1419480c-d62e-4deb-a372-59107e116efa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748790529, "uuid": "43c64219-15f0-42d6-b8b3-653b08515c94", "value": "Mxs_win7-11_MSTerams_2.36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fcbbfd-3f0e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1748799024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799024, "uuid": "b5f3dc42-8525-442b-a1c4-86502d618e41", "comment": "Malware payload (QuasarRAT)", "value": "ad6bc04a571b04d2f7dea935297267a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799024, "uuid": "9a074bdd-14dd-4c9a-8202-edf3da1279b7", "comment": "Malware payload (QuasarRAT)", "value": "c8b2df4130ad422d0dab2be3798677609f0555f37d825cda228662d2112f3d6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799024, "uuid": "45752745-0671-4324-b7d9-9dd5e9ca34db", "comment": "Malware payload (QuasarRAT)", "value": "f42772ac6842a6f2c4467bb557b5a50e4a9f8888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799024, "uuid": "25d77262-5676-4692-bb07-6b297da070a5", "comment": "Malware payload (QuasarRAT)", "value": "7ec02d0ea737384d2729f6626e4c03d9849721aabef9fe8b2a04466bd4a7a3dba30136c4611a4010e0cb6ab5e260ef29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799024, "uuid": "9c89c701-1b8f-4b95-86d9-73b1b0197e36", "value": "T1C3D5120373DE83A1C7725173BE55BB01AEBB7C2906A1F5AB2FD8093DE920161521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799024, "uuid": "084dae5e-c306-45fb-8e06-355b039003d0", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799024, "uuid": "02d6c8e9-85e1-49d3-8a51-ea05676a44c4", "value": "49152:Skwkn9IMHeaGz7Yv8NXqI1jZER1s88Of5GRGsUOjyrYDysJJaCPbaPCS:RdnVicMigfss92YD3ePC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799024, "uuid": "255d2dd3-06f7-440e-b9a1-ba0022c41162", "value": 2854400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799024, "uuid": "4418eb65-3d77-45a1-aa92-f4d6809fbeb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799024, "uuid": "44f7a782-e135-49f3-aa70-b44ccc129ade", "value": "ad6bc04a571b04d2f7dea935297267a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fa4be2-3eab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748756818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756818, "uuid": "8828477d-4823-4611-83eb-eea8f3d03e8a", "comment": "Malware payload", "value": "445003879e6101d659527dc5a9189acb", "object_relation": "md5", "Tag": [ { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "sdfwer234-com", "colour": "#E0B738", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756818, "uuid": "c8919b8d-73cd-44be-b01d-9e8af1154650", "comment": "Malware payload", "value": "c93f74559cceea50788ef2ba59d3867327ce28b3d7983fdf07f91cd1d7afd789", "object_relation": "sha256", "Tag": [ { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "sdfwer234-com", "colour": "#E0B738", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756818, "uuid": "53539238-ba55-4ddc-a8a4-e8f7545c05b1", "comment": "Malware payload", "value": "2655dfe2a723728f00e8cb6cb9c7dc6f7d11f818", "object_relation": "sha1", "Tag": [ { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "sdfwer234-com", "colour": "#E0B738", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756818, "uuid": "94842f1e-8b7b-47b8-b0e8-d20639962ad8", "comment": "Malware payload", "value": "48c9374c4615e4e7a419c244095389144206242dad4b895b2f0be74601c1c6abdcd797677cc4f303112b287473caff7e", "object_relation": "sha3-384", "Tag": [ { "name": "domainservicecontrol-com", "colour": "#95AA96", "exportable": true, "hide_tag": false }, { "name": "sdfwer234-com", "colour": "#E0B738", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756818, "uuid": "7b4e46b1-e4ff-4093-ae84-d6e4fbcc2a5b", "value": "T1E4E07212CA4CC42B22AFC0B6126094AC8E88EA084004A8A3EAA03C4DAA092A0CBC5084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756818, "uuid": "6ea35d03-9cff-4441-a38c-12687bd9ed79", "value": "6:j6Nqsks8XI+g7yLyFPbGVzLh8JdDh8iB8XIYAGQO0wKjFl8u8v:Jsd8XIP7y+FPbGVvGHDh8O8XIYAHpwoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748756818, "uuid": "b10ff8de-575a-4dc9-ad94-c97c0fcf9256", "value": 300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748756818, "uuid": "28cbba2c-5600-4108-b19c-0d8d0a412184", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756818, "uuid": "fabff09a-863e-4b77-9ce2-f042c67c4d63", "value": "13.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21304be2-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748807197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807197, "uuid": "d3d8474c-1bb5-45f9-bb55-e3f8a1ad14eb", "comment": "Malware payload (Mirai)", "value": "5432b72bc020518ed820995877346746", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807197, "uuid": "865baaaf-f80d-431a-aac1-9b68d1af344d", "comment": "Malware payload (Mirai)", "value": "cae5ac3b393a3c489e2f0a7a5eab81e696be12db6e74b75471a4e18ef87d5a1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807197, "uuid": "54d6ecf0-3da7-4883-b63c-15ef2903c987", "comment": "Malware payload (Mirai)", "value": "51d03ea4cbb12e291803d8a2725b81a066d68a0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807197, "uuid": "400281ca-7cb3-4fd7-b25e-22fda2387c91", "comment": "Malware payload (Mirai)", "value": "8b3e3e648ee2eb5d261f060767855ea46af80b298e16f303a7305e1d85e7c26b4b2ab2edb9acb7acffb86b626ee2b0a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807197, "uuid": "ba0b8958-d882-4dcc-a912-9fdf455cfb5b", "value": "T1DDB2C0CD61843084CA8D7C7C178D4A564E6CA1D0BAED9B25E350CDD8B3BEA8B7459079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807197, "uuid": "e7bbc45a-77f1-415f-bfd4-da5015fad064", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpZZqEWv1:/QlS07FUXqIYSXQKquPqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807197, "uuid": "ac8846eb-669a-4708-b9c0-197b0424d22c", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807197, "uuid": "21b33fc9-4820-44ca-a551-da7b71cb577a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807197, "uuid": "5507213e-7bde-4f6c-8d53-4247aeccf6c8", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30090560-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748765131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765131, "uuid": "eeb357f6-9cbd-4257-9a8a-021482a25e9b", "comment": "Malware payload", "value": "5829c9d72ddad51521c7bc3513e33946", "object_relation": "md5", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765131, "uuid": "da0e9f45-3c15-4c67-b05d-09f9b5c68373", "comment": "Malware payload", "value": "cbb4fc45c913ce73abda8957418e0313393663c7c01042299fa7a9c1c77b0f00", "object_relation": "sha256", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765131, "uuid": "08893d9c-7461-49b5-8929-0ebf028fd552", "comment": "Malware payload", "value": "a7b113f3027cd514d6b0ef283a5c6b840423d1bb", "object_relation": "sha1", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765131, "uuid": "594ec691-1068-42dd-9c3f-19cd67d64834", "comment": "Malware payload", "value": "d0622369994e1c638e3354611c5e894c3313425b364c2b2354a6957eff344ef1ef12f54ca04d87cc98a28b31a86ad576", "object_relation": "sha3-384", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765131, "uuid": "ce797b16-4021-459e-bb2d-6ada42f86422", "value": "T139E23323DB4D1661C05DC638C5EB0B817A35F471877A633F0B51C53CBE9A385AD5285B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765131, "uuid": "0bdfe175-82bf-4a07-894a-c61c28c5b578", "value": "24:vP/8oj8Kh82GLzqaKvjNf9i2CKtTTsuJscZmZI0s7kQeUeKMfNJVCLjfgnKMfELl:bV3vTiPCTsuyc8+0NfU+SLzrfQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765131, "uuid": "4fd46933-1ab8-4898-9480-38d93f13bf3a", "value": 33816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765131, "uuid": "fa8067c8-5e69-43ed-9f15-6ef2a84e5a90", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765131, "uuid": "bc727ab0-362c-42b3-87f6-bde5d742d85f", "value": "macreverse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f111b3c-3efe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748792188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792188, "uuid": "467de84f-2e26-4b4a-8572-0df524352e28", "comment": "Malware payload (Mirai)", "value": "9bb98d8442428a65923b1f1b06134fe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792188, "uuid": "2d18ac21-3e72-4c88-8cb1-98ee0545bed3", "comment": "Malware payload (Mirai)", "value": "cc2a04e6711597c4c51d1a6f272cc7a58a476b9b960fee8a5f8c039664e2c5f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792188, "uuid": "23441e54-7d53-4599-8459-2768899c63ef", "comment": "Malware payload (Mirai)", "value": "4502de18f4c8c6ec3094d44e406c916d656cc623", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792188, "uuid": "992e691c-e0b9-4b93-a4e1-56d5c278a714", "comment": "Malware payload (Mirai)", "value": "85a5b991badb275b5e509819f5315bc5bbcbf3b65f69b909993098d9902cbc1dad1a5aad88a0d5a263e0878b68d8f010", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792188, "uuid": "0a26cdac-9345-44c9-925d-40a49064d510", "value": "T1D363830ABF654FB7EC6FCC3749A91746258C641A21A93B397E34D828F24B24F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792188, "uuid": "c3e153c7-a798-4182-8541-ca5f6b590e2f", "value": "768:c+xGiJEEYlDIR99U0RLy38sSC+c55AexeAkejzBoNxpkkN5zXirCMsnqUm:c+xGiJxYlkZo8k+c4YdkEzvOFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748792188, "uuid": "a899f5fb-3b3c-4ce2-9ee0-29d272149ef4", "value": 67484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748792188, "uuid": "c045ab07-0319-4b21-872b-78d5def4632c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792188, "uuid": "a6fc77c7-d996-48f1-a6c0-ce5e9b54a242", "value": "hoho.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849bc2fc-3ebc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748763984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763984, "uuid": "d3ec29f1-1ea8-41a9-a325-e563f169c04d", "comment": "Malware payload", "value": "5a9835f4f8cda94f648ea4eeadd57a22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763984, "uuid": "9b4f1c56-0544-4ded-a9c6-b81c01007d63", "comment": "Malware payload", "value": "cd4da0455b21045370b46901428a1bd52c199285d10851c74ce966f03dd4d956", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763984, "uuid": "7bf76555-71a1-4d38-bf02-b4933211fe89", "comment": "Malware payload", "value": "9dde8985f9a417bb8001fe15bae1dc26a73afbd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748763984, "uuid": "c292b6ca-e615-45f2-81ee-91e69de28e79", "comment": "Malware payload", "value": "5ebb759edc40d88d44c84f5abc86bea4b25064f2fbcc80d536b477d4c4b56b5b2a1ac2740a289742820ba10961a8f76a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763984, "uuid": "03595a55-bf6b-4b93-9bf5-edc4e88b9063", "value": "T109A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763984, "uuid": "154ce0b3-fb19-4ce2-a6dc-693930558087", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748763984, "uuid": "d2eb7713-84f2-4efb-ba67-717fc1011b11", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748763984, "uuid": "d33251fe-c0de-4ce2-99b4-c8b95c2d23d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748763984, "uuid": "ce33e7a0-65e7-4959-b752-eceade5e0722", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ade1ea-3e91-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1748745712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745712, "uuid": "06e3597e-a6a6-453b-9a90-e75ac41c8708", "comment": "Malware payload (XWorm)", "value": "db79f3d2509371ee2bd0685c6aeb9615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745712, "uuid": "0671be0a-d65f-4006-8a06-9a4241d01a03", "comment": "Malware payload (XWorm)", "value": "cd6666c3120c2bcf0f67f11b4d31f5e7666ae8fbff29af85ebccdc84ffcfe1cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745712, "uuid": "50828932-e145-425a-92af-f02ad2b93c6d", "comment": "Malware payload (XWorm)", "value": "5326a0522db8261589109dfb69a0317ccf1ad6f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745712, "uuid": "b26a0c67-e5bd-4e31-bdeb-1267149adc98", "comment": "Malware payload (XWorm)", "value": "f06e5b5aea4ead4972f56d154588de7ffaf9640fe9f2d6bb385619096b4189d92dec6b41ff4924156a2145f2b11bf0b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745712, "uuid": "05f9572e-8612-456a-b917-2b2048b7df1f", "value": "T17DE23B4877D44712DAFEAFB129F262061270D517D923EF6E0CD485E62B67AC047403E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745712, "uuid": "a468dd83-5fba-455d-a1b2-84163eeec159", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745712, "uuid": "7284bed4-5abc-46a0-b51c-df84c2f6b459", "value": "384:4EmNYo85DCeup3fEhjLuwUr3Tm2eaFO4FzRApkFTBLTsOZwpGd2v99IkuisjQVFQ:dA8wlaPBs3Tw49FzVFE9j+SOjhab0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745712, "uuid": "91e26ba4-864c-41f1-906a-bc759a013352", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745712, "uuid": "4d42f8ad-199d-4fbb-a27c-f22127355f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745712, "uuid": "d8a8d425-66e6-47d4-8aa9-1ed060bdca86", "value": "TRemover.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3e18e0-3ed8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748776209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776209, "uuid": "3897ff77-35d7-42eb-9ac4-285d4fbc35ba", "comment": "Malware payload", "value": "93a7ee1844d0631e3d97990f5e42c696", "object_relation": "md5", "Tag": [ { "name": "107-175-246-45", "colour": "#29B2CB", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776209, "uuid": "382552ea-f492-403b-b265-8620293647bb", "comment": "Malware payload", "value": "ce67ccd11c1e72161d56442405db0b85961abee6c1e628b6d41a38ff5c66f24c", "object_relation": "sha256", "Tag": [ { "name": "107-175-246-45", "colour": "#29B2CB", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776209, "uuid": "b23a5b3b-d036-44f8-a915-1bf7604876c7", "comment": "Malware payload", "value": "4731d2333b380d1472cea577462b197210701d3e", "object_relation": "sha1", "Tag": [ { "name": "107-175-246-45", "colour": "#29B2CB", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776209, "uuid": "1906db3b-3235-40bd-8556-d75cc5fc70dc", "comment": "Malware payload", "value": "6ccfe57784ff0ccff289e764c4d7a96535d4f1311fa5c45147d320a3e66e84d0bb4556b43425eea11867694ce0419c24", "object_relation": "sha3-384", "Tag": [ { "name": "107-175-246-45", "colour": "#29B2CB", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776209, "uuid": "7ee7128e-368f-49fb-a383-1e52b037ae2e", "value": "T12204ED16BF7D5930DB0D0E7328058086BB48005C53E8654FBBE6C5D2E5398CBABA376B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776209, "uuid": "8d0ef076-813d-4f82-a119-71b334f57ba1", "value": "768:t9i5H/CZo95RUt4VX5fguC17j6cTasa/x5prjhDMz7Z8U:t9i5H/CZoXYN7Z8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748776209, "uuid": "35cacb23-b02f-417f-b4a9-3d8f03adf506", "value": 188688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748776209, "uuid": "c874ed19-c3c4-4eae-926d-527bb8aa816c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776209, "uuid": "69ba6cf9-e663-46f6-83fa-4ac2fa8898f7", "value": "greathappinesswithsuchagoodthingstodowithmebetter.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7a4ab2-3ed7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748775597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748775597, "uuid": "68143d20-35ab-4476-9879-4747cafe2783", "comment": "Malware payload", "value": "9fec8cf2a72c853744f3cacec08d7454", "object_relation": "md5", "Tag": [ { "name": "107-172-132-32", "colour": "#1C82F3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748775597, "uuid": "0746a989-8eb6-47de-8d99-cbd8990bb48b", "comment": "Malware payload", "value": "ceb372bb4b79e14af6090665bd36e42e7a38f1e7b13baf964cfc9250222012da", "object_relation": "sha256", "Tag": [ { "name": "107-172-132-32", "colour": "#1C82F3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748775597, "uuid": "a63eedcd-243a-4474-8a55-215acc5da7f0", "comment": "Malware payload", "value": "f2a47f0b6932b63b1a0c326cdff71a0519a6bb9f", "object_relation": "sha1", "Tag": [ { "name": "107-172-132-32", "colour": "#1C82F3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748775597, "uuid": "76b24b1f-f156-4710-ad98-69b19bbccd4f", "comment": "Malware payload", "value": "331921614737fccbf6ac527e1edc9f33dc92324ff4ce67a2a35cf7cf20b0c1ab1677a777346542069dfbfe3313a938d7", "object_relation": "sha3-384", "Tag": [ { "name": "107-172-132-32", "colour": "#1C82F3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748775597, "uuid": "ff7f44c5-776e-4c05-8b2e-de15a269d597", "value": "T1E883062EE30F0955DF5597BB434A4E4A05FCB33DB28540A179AC97343BADC2E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748775597, "uuid": "80c3f2fb-fc52-4374-8feb-cca87a869cda", "value": "1536:OTrddO+dyF0ZpHQ1PB+n+Z0CqxJVm2nvVwS9N+xcO2FUgPOQMkPmjwNKs3AJrP+:OVdOj+ZyVB0+Z0FxTvVwSTJO2FUgmQMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748775597, "uuid": "8b50081b-ae25-4ca3-b0fe-354003b066cf", "value": 81780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748775597, "uuid": "93590a63-9ce4-483e-8d4e-94e774f9dd33", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748775597, "uuid": "0fb3f605-7b41-4762-a21e-f7f6456631aa", "value": "seethebestthingswithnicepersongivengoodthingsforhim______seethebestthingswithnicepersongivengoodthingsforhim________seethebestthingswithnicepersongivengoodthingsforhim.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e52b7a-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748786542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786542, "uuid": "28028fc5-fc83-4e4b-a198-42cfa4da22c6", "comment": "Malware payload (Gafgyt)", "value": "f739eccd9a43a515caf460db1fdeb280", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786542, "uuid": "d040971b-f2d3-498a-9450-719349b504f7", "comment": "Malware payload (Gafgyt)", "value": "cf86b995049028228972442d6e1b57c95edef85e04411cb741eff204030aa126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786542, "uuid": "c4229ff7-9ae5-42c6-bb94-9e2e601dec72", "comment": "Malware payload (Gafgyt)", "value": "e692bb78aef0dec3c3d1b8ac3182d362dad70511", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786542, "uuid": "1ba2b839-3eaa-4095-a7ef-0d139160e604", "comment": "Malware payload (Gafgyt)", "value": "b37621f0127f375ec4baaa420dfb55f05e03c172d42114df0511a6ceb97322ce9d8d5df12298e36d0996f62b8862ce72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786542, "uuid": "7ea10422-ff19-42b3-83b7-37e4fa63f775", "value": "T11DE31A06FC404623C2D16BB6B35B438D77265F699BCB3341EA297DB02FE0B591A3A5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786542, "uuid": "68a019c5-02ad-4d41-a2b2-96fc299c6b00", "value": "3072:ji+lT3j4X6LJBKiAZ8E/JbixSHpQgetJ8add9Qzxsz86d1Q/aX6X4TtQ6W8GoQTG:m7ZJbiQJQgetJ8addQi864/aqX4TtQ6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786542, "uuid": "d4343a35-9afa-49d1-9029-9b8ef4a64fd9", "value": 146438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786542, "uuid": "f8ea3edf-3b8b-4b0b-a16b-ba85ab0f1dc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786542, "uuid": "f02a9dbd-ef48-454e-bd23-74729b3fe7ca", "value": "apache2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0858e917-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759481, "uuid": "dafd601b-642f-43f3-964a-0936cdb7b875", "comment": "Malware payload (Mirai)", "value": "9f949458f54edd7b4dd9ed1afefeb665", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759481, "uuid": "3d4298f2-78ba-4894-9df7-45f5fc40e5ed", "comment": "Malware payload (Mirai)", "value": "cfad8e20d9e3613d4d308a5aa6725aa871da40e91894bca931a7987a333099b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759481, "uuid": "86297916-d16b-4fbb-a7b6-a38eb7629ff3", "comment": "Malware payload (Mirai)", "value": "497c9f849c954adc57fe4df256d6fdc1b647440f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759481, "uuid": "5eb4559b-1df3-460e-9d01-6f1a2ee93039", "comment": "Malware payload (Mirai)", "value": "2af27722807611e7cc7be5f93b8305d5683cc8045c2b6ee3866ff9cdb41649f63c7b5d8f5c6c7880d917110bad6a1fde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759481, "uuid": "ca7df566-ed4c-4226-a7a8-1d7b1575e28d", "value": "T1C0B3AEDBF24715A1C4A247F007C74F8D2E2323819F57E8E76C1E2A7A19751CB5A1ABC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759481, "uuid": "5c7dbed4-c049-4e85-8120-5a58fc6b10f0", "value": "1536:qPLwUZuEcPdODOf4NHTraNMSu/Ro0FltL3W9xVMVqgQB/LW0:q87PdqHnbF+0FT3Wgqgoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759481, "uuid": "7810a1c9-be10-4276-89b7-df1ff23463ae", "value": 116068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759481, "uuid": "b4ec6131-35c5-4be0-b87e-8c9a9519353e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759481, "uuid": "3fd15383-b6cd-47e6-8fa2-195b0aeb3dac", "value": "neon.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3af7187-3ead-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748757675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757675, "uuid": "d88aee92-7484-4622-8022-1d9cd08774a0", "comment": "Malware payload (Mirai)", "value": "1b7fe0f14beb2e18d1c2f159a8bb42ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757675, "uuid": "05873a1d-c496-4ecb-9e1c-339291bbbf4c", "comment": "Malware payload (Mirai)", "value": "cfd62c5cf4422b9e4cadb4194a3ea715d50e3820bc9d8d2ee8bf43a805e5168a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757675, "uuid": "d0a0a02b-0199-4fee-a376-503c8ad57d99", "comment": "Malware payload (Mirai)", "value": "ef14747e85648e3d035b42101bd7eeede1020ea9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757675, "uuid": "565187cf-5427-47d8-b980-eca6f8033976", "comment": "Malware payload (Mirai)", "value": "7b4e5ac4c61e3251c088bfefa2d1161839050cd15fc9884d64567f246e0dc95830c38ef5adf72d61e37853cc07a45195", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757675, "uuid": "03cdb663-543f-43e8-987f-7539ffedcd12", "value": "T15D632A95F8819A12C6C6127BFB5E068E3B2613D4D3EA72039E396F2137C391B1D7B944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757675, "uuid": "6774d608-9596-4fc3-ab88-07e612cc29ee", "value": "1536:Rd3hjJAbdTJC3j6gITsiCLHjIfST67vw:RdNJA5Q3BITuTiNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748757675, "uuid": "eb328058-886c-474e-9a1e-a8c2227b54c2", "value": 72668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748757675, "uuid": "f7524b9a-40ff-497a-aa61-92b0782b8792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757675, "uuid": "a6f1255a-6cf0-429f-960b-71ce5f4a8bbb", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eeadffe-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748807193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807193, "uuid": "1c1398cc-e703-41df-84e2-bc7823567e8e", "comment": "Malware payload (Mirai)", "value": "60fd5b6361dc4850690bf8335d1008bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807193, "uuid": "c137d309-6065-43f8-a2ef-4cb743dc2858", "comment": "Malware payload (Mirai)", "value": "d1753cfda68defc04ce37b0d748ee891e7cc396d5de1da5f71e08c724d3b8491", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807193, "uuid": "e2240c86-ce35-437c-908d-685cb76cad63", "comment": "Malware payload (Mirai)", "value": "9b861e167182948eab9df6df25c1cc8c7d5408c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807193, "uuid": "13c1b1b5-f066-463d-91d7-c128543b0ac4", "comment": "Malware payload (Mirai)", "value": "c5f32e8e0aa0d01096d1bccb7ee20f5aafee642f44da00acde2f332f4a1d1f029a11beed34646d3da4f964d80ca262d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807193, "uuid": "b4d02c12-9e96-4488-be0d-feea46047a19", "value": "T1C0330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807193, "uuid": "b27d6239-0080-4ab4-846c-40535a4636fb", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGI:r/hqaJMDg9eqK806MHdkfQX6HuCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807193, "uuid": "4b356b84-2b72-425c-8353-ba1ad2cd767b", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807193, "uuid": "9f029fa8-5a77-4126-89a2-1cecdf22ed4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807193, "uuid": "b22c8c30-9b71-4355-a321-d91fbc3a08cd", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d185da-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748807260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807260, "uuid": "dc0dde1f-02f9-4e72-9149-b91548dc4bff", "comment": "Malware payload (Mirai)", "value": "8c7ac6787c6e7b5f2c73c4ec5c6556f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807260, "uuid": "58c8e605-7a03-4a86-9179-5cc2680ddcc7", "comment": "Malware payload (Mirai)", "value": "d179a89b930caa05206ab399d61ec755eeb198e5cc4222071eb4896243a52401", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807260, "uuid": "7133a486-2337-4d34-96fc-4d18114a9e65", "comment": "Malware payload (Mirai)", "value": "343ac28b3a097e5dce8e2864da523c9d4eaa8855", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807260, "uuid": "8507a8e7-fae1-4b9a-8125-f13b4d094f2b", "comment": "Malware payload (Mirai)", "value": "ef47275c75f4b2e029bb37c3e916dffb717b4fdcf4ed511e0e42216672f518ffd493b55f037f94dc9b9155721061bb87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807260, "uuid": "a8c3df05-c407-4e12-a023-3e414cba037e", "value": "T19C230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807260, "uuid": "0eb75756-7d04-4443-b9cc-69bfc12ff37c", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THx:5DmKF7Gxyk8cqoHAmWurAufsG5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807260, "uuid": "11043cbd-1474-41f2-9bd2-31045ce0458c", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807260, "uuid": "9ede536b-5b4a-4e50-a6fc-8c3bd3f69e08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807260, "uuid": "cd0de6e5-6ddc-42c9-b1d9-3da30788bcaf", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a89a7a-3f23-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1748808015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748808015, "uuid": "dc9f76f8-febd-4b94-b124-1f0b52fc6f46", "comment": "Malware payload (DCRat)", "value": "bff6582f82ad59415fa4ee13027736ef", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748808015, "uuid": "ba02f607-c292-40b9-9d86-202491786b4c", "comment": "Malware payload (DCRat)", "value": "d21fbd588526484177101efd655d757fb3a0b37060240633246242a7dcf5942b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748808015, "uuid": "5cb24bd1-f682-4abf-a5be-84b947219e34", "comment": "Malware payload (DCRat)", "value": "f361284f2189696f339e2c5af55c482380463828", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748808015, "uuid": "c7b45d5e-b014-4be7-bb7e-8986ff4d4b8b", "comment": "Malware payload (DCRat)", "value": "a0152ff31d8992b45bd4ec79c67743983cabfa5049c6e456e9457bcddc2374f2fe2265aa686803b55a21167947f841bb", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748808015, "uuid": "dd4814db-bf14-4fc1-888c-f80f7036559f", "value": "T1E395AE0A65928E36C2741B3186A7413E42D2D7273662FF0F350F24D2A907BF58F766A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748808015, "uuid": "1677613f-e05f-4d77-b492-a6dee11d2440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748808015, "uuid": "4185e96a-42bf-4ebe-a8f1-59ff51cabd69", "value": "24576:wm7MAYWSJ4EVkp/aE/FfQyldFgD5DbinvvCx0flL4tY/CjfbgSTLI99Ga6jD5U:wm7MA6uakp/WFinr+Y/b0s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748808015, "uuid": "6abb8b09-cf5a-4262-a964-2fd1f8fd30b0", "value": 1927168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748808015, "uuid": "d3940a1b-43a7-44e3-8786-0e5f4320749b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748808015, "uuid": "c6c50f8b-875b-4a13-9c7d-b9671c6b66c1", "value": "BFF6582F82AD59415FA4EE13027736EF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1506d83-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748800191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800191, "uuid": "79d3160b-8515-4ab3-98df-0022ca67d8d0", "comment": "Malware payload (LummaStealer)", "value": "29f26b6324acf2aafceace1e8da82a50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800191, "uuid": "3ad9d1cf-841b-4a31-9a53-affba5818a8c", "comment": "Malware payload (LummaStealer)", "value": "d29f1a81cb0cb805d5504629d2f9b4345b28f901fbb0183834212be5a630c886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800191, "uuid": "96398466-3aaa-4b85-8c65-95000e1864ef", "comment": "Malware payload (LummaStealer)", "value": "bd7f0ed5408bda159a44539a33c49b7ca143de7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800191, "uuid": "b4fb0fed-1e95-49a3-b626-3cdcb7fd174a", "comment": "Malware payload (LummaStealer)", "value": "a863e5d181cd554926275ae75a42264eb5a0648f2b4d65f577cebf0782a46e3a440cc4f9211a7d6a6ca941c7b84070dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800191, "uuid": "7eb4105d-8160-49f0-a85f-50485d804ebd", "value": "T1C975BE389151A1DAFC6600BA49B1A1957822B333C63D2FFF8290E373AE077C55F69359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800191, "uuid": "29e84c4d-1797-4937-9a03-45d15a315944", "value": "bb36df4412e03dad091fc4f040871a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800191, "uuid": "2da705d5-f046-48bd-9171-f2da7aa61651", "value": "24576:sS2f+i6umQ5MM0FeLVePFjvOQ5uCCXJnA2UGM7JeJIIfzgJPAZU44dIfzgJPAZU7:S6umpEVeF7tqaJe8WfoWf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800191, "uuid": "92ea352a-16a7-497e-8d1b-da96df289654", "value": 1663528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800191, "uuid": "d8674d69-6660-495f-aea3-ad0368b58977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800191, "uuid": "1bf9744d-6df6-4dbb-9e47-feb2136b1d9c", "value": "sGe7ljJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb22d41-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1748800240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800240, "uuid": "7321dc7c-a476-41ba-98b6-5e252e182825", "comment": "Malware payload (Amadey)", "value": "45c3800db283a6ff1c492014f18e8a86", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800240, "uuid": "c32afc13-a70e-473a-b73b-193c478269de", "comment": "Malware payload (Amadey)", "value": "d63d9b292f2a11e577611047c46a6acb5e40fec59335af409a91dd927366a065", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800240, "uuid": "9875a95c-96f4-4c4b-9ce9-047e31cd71ca", "comment": "Malware payload (Amadey)", "value": "b48a5a4d6c4ecd84eee89b4e100d45d508e26c6b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800240, "uuid": "3f0602f5-39c4-4052-8f66-fc556d59fa9b", "comment": "Malware payload (Amadey)", "value": "26b76b7c36ed149caef07287e46ce7601dc01075f02c11595069889effd556199b82b78760f76219be08da9af578ff70", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800240, "uuid": "0dacb429-75ff-45ac-80f3-16ae0c677c62", "value": "T165D54AA2650972CFD48E17785827CD86A99F43F547244EC3AD2CB4BA7EA3CC112F5C29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800240, "uuid": "9ccd51b8-8ca5-476b-b41e-4147eb55443b", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800240, "uuid": "7cdfcb5d-bab6-423f-a83a-5fba6b10c35c", "value": "49152:+fNnoQJKGLRbYVVJW4mPxn4UmuxpQgQ7GVeDLUnXBp/sK6L:+fpnoGLRbYVziP93muxlQyVefuX/16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800240, "uuid": "6e9244e3-9bea-4784-aeef-307a7256d938", "value": 2992640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800240, "uuid": "63f270ac-9e4d-4b88-8579-115ecfd43094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800240, "uuid": "4f8b9164-48e9-455a-9a3c-e27c041c5b08", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea0254a-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748765182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765182, "uuid": "9d7153bd-c3be-4ffd-a8be-c9ff54a0e6be", "comment": "Malware payload (Gafgyt)", "value": "42b366d3ddd102f9f01a091cd58d17f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765182, "uuid": "4916617e-31f2-4cd8-b54b-1143fae18e09", "comment": "Malware payload (Gafgyt)", "value": "d6f9c9fd78e54f6385c39be94d646482427dc3ba910b2df310954ff40cb621ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765182, "uuid": "43413f5d-af3c-4b54-a27a-42d36dd23212", "comment": "Malware payload (Gafgyt)", "value": "998be42c7ee9b64cfcfdf07b482939a330e1fa2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765182, "uuid": "f74608dc-54af-44e4-be2e-19d3f2fda618", "comment": "Malware payload (Gafgyt)", "value": "6ea29e2aa9f01b42d7728b29ab6b7c2918b2097e275995d87ff77d2c8d9f1604ee31465faaa0262dab90e54521408166", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765182, "uuid": "6bb9598e-ccde-408a-843c-8d563fe4f2db", "value": "T10C935D27B552C67BC08752B42BDFEA615833B4BC0B32720B33D47DA52B259C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765182, "uuid": "91c875e2-3cdc-40c8-829b-85f39d25e448", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3vyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjK/ifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765182, "uuid": "efd29f5a-a6eb-4e86-a7a1-a14b4fc7799a", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765182, "uuid": "a30d706c-0f62-4c01-b408-8851c79c66e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765182, "uuid": "72d5165b-6633-4e0c-aed3-663b5dcdc8cc", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7606ffef-3f11-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1748800467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800467, "uuid": "f70c7952-2e30-4d1e-8a4a-9708ea363af5", "comment": "Malware payload (Amadey)", "value": "cabb4a6255762cc16c7a3e9dbae46098", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800467, "uuid": "eaeee3a2-718d-4ef5-b38e-fc077092206d", "comment": "Malware payload (Amadey)", "value": "d70b395243502a75296f93168276fe5b4d27a39a9af1560ebe70aa44ad351615", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800467, "uuid": "f381d1d9-894e-4376-a273-d619ca844457", "comment": "Malware payload (Amadey)", "value": "869b3ec98fa380d014897f1f5edc53807b1e957b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800467, "uuid": "d413a8ee-360a-4aeb-8653-730e7a88dc80", "comment": "Malware payload (Amadey)", "value": "c6efb865cc5cf4210096fa1236fb76c979df6f05f479181f430f0b499ce70c29b91da4f2fe37b54a95c399a612e0072b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800467, "uuid": "2b94b3fb-caf2-44cc-991d-1af7bd9610b2", "value": "T1E0E55D63B40AB1CFD88E277C8627CE529A5D47B5072408D3BC6DB4BA7E63EC111B9D24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800467, "uuid": "132ae3b1-6f51-49c0-9e47-c6572b8013b2", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800467, "uuid": "2149ba90-1f86-4732-ac98-7ec9ce523942", "value": "49152:2elPlKcZUpYcGIPts0mkYys6JeYshPBApnofGABvK:20PlKUUpYcG+mys6Jh3pngGABv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800467, "uuid": "6d474e36-6159-4681-88f8-ebf277655f0d", "value": 3021312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800467, "uuid": "d432132f-3a70-4970-9e5d-09f8065cc727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800467, "uuid": "39d55f16-0c79-45bb-ae32-3ccd776afea1", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb5f3b6-3f2e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748812959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748812959, "uuid": "bfa1e931-7333-46bf-bce5-d46b91a8a045", "comment": "Malware payload", "value": "2f794e1791c8e34f38fb8ed3d74bad66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748812959, "uuid": "aff3a894-282b-4e0f-9a4d-666dda581867", "comment": "Malware payload", "value": "d7b7d06316b4ef6ec336d921be2212f568c7d4fe00342aa3e65d1296a3b5adcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748812959, "uuid": "aea55111-23a4-47c5-95b5-334fab43ab81", "comment": "Malware payload", "value": "56f9c7d6b68f07db70cb16f7e338a3b78242f9d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748812959, "uuid": "fd7e8fd2-6c02-4c63-80ef-4b9d665df99c", "comment": "Malware payload", "value": "76c6b7adbb45555ed7c3375f96ba17542c8bcfb0ef41873addcb30570a2e1b926468ac49d97370235111783129c2b962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748812959, "uuid": "6f2fc48f-df63-4493-bca8-29f3c6765d10", "value": "T1C526333FA6234C13D54C81B568C21A30D567924DACFC8DEF6A0C073D099B37B5AB5B9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748812959, "uuid": "d41de216-0dda-49d3-bcc0-0575e3209735", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748812959, "uuid": "f7f6a860-c262-4ef2-94cb-6ed6a2269a72", "value": "98304:r/XNGPHjkr9XQR435UVqJElTVuFNBS85ZygDiY+CfmE/5ODv3/ORm:TXNuHjkRX0oiTUXBTV+CuKqv3/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748812959, "uuid": "17c455b3-561e-4f39-ae99-61df7bb75a7c", "value": 4752896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748812959, "uuid": "e9c5595f-5343-4ac8-9c8f-abc08c4c7d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748812959, "uuid": "3a9ebfcb-a8a6-4f49-b97f-d11640a435ff", "value": "SecuriteInfo.com.Win64.MalwareX-gen.28628.32742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea109835-3eb6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748761578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761578, "uuid": "20398f54-6503-42eb-844e-3c4f971ca07f", "comment": "Malware payload (Mirai)", "value": "9a059e6a98a7ef4be7dc965eb029e775", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761578, "uuid": "22f1c241-3561-4089-b120-7714e708f894", "comment": "Malware payload (Mirai)", "value": "d82610f0b6b14fa8893f3c809ec52abaea7794965c8fbf57202fc260017134dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761578, "uuid": "32bcbb39-bf4d-4600-8225-0ff8206ff98c", "comment": "Malware payload (Mirai)", "value": "3cd99e8ccc6c94012e4dfe1824d0923d835be224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748761578, "uuid": "1aeedee9-3855-4fc2-a724-f1ae8c9f091d", "comment": "Malware payload (Mirai)", "value": "0ce9bc2dd9e8f911b6e6b59bc8d2767fdc55baa938eb4dc9a9415c794ca23622c1d8e00344f292999226460b64335e14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761578, "uuid": "47963831-c68e-48ab-a02c-e09b859dcd6d", "value": "T1635302F4C93750A8CF6BC263FE940D05C5176BA9817B562276869FBD32F91883E17360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761578, "uuid": "09f595ea-8a1d-41ec-8648-a44148c058bd", "value": "1536:2/q2wXHaxs83lpeMWu+Wvje6gybowub0vYDR/MqLm:H6K5kHj4yTvAVEqLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748761578, "uuid": "0d8014a2-6be5-4156-9162-b2fc3b51577e", "value": 62172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748761578, "uuid": "6507aed1-ecfc-454b-a116-381f4e10ff10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748761578, "uuid": "ab28f9ef-0661-4195-a43c-2e83f351abdc", "value": "neon.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2015f9-3e91-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748745720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745720, "uuid": "a54f7b5e-0d4f-4710-be7e-c9b7afe9e019", "comment": "Malware payload (Formbook)", "value": "e36e866be3531af57c2360f231012aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745720, "uuid": "86dfb560-2a5d-4ec7-b5f9-872ea47f4177", "comment": "Malware payload (Formbook)", "value": "d92a8b7e5b40961a659c5e3a001d09c87d80b4c85013302c2dfc42397532c4a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745720, "uuid": "9f3e7a69-b741-4d05-a4e3-f883922b7dda", "comment": "Malware payload (Formbook)", "value": "d6e15ca10712b71a0292d72f1346df8c6eb725c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745720, "uuid": "9a6481fc-5039-41e4-b2fc-2688b11dd31c", "comment": "Malware payload (Formbook)", "value": "54af4a4a4ad62a9e4b95d0ed9a49a03850e160fb2d0f128073846c2f677644a7ad2edb63fc131a62958e44b7f2e648a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745720, "uuid": "100caa06-0d60-48aa-b34f-3d1224ea06f7", "value": "T15E44229DE076CEE38D6D48E06D21CAD4E882D228D95517716F8FEAC4412BD380AC9FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745720, "uuid": "2fbf24f5-3118-4ba9-a48a-5f545c024306", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745720, "uuid": "f9cf5603-687f-4fb1-8b6f-528338cb1d86", "value": "6144:2PpT0sq3FiScWMAzxJXvgzvNySxvrwoQEJymW/:aTKViFw7YQS9rwEJBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745720, "uuid": "a4e9ff78-59a9-4b49-9665-56c224038991", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745720, "uuid": "63102649-f89e-4e2e-9b34-d2271f022f83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745720, "uuid": "54985c6c-3c09-4283-835f-9a7e3d335306", "value": "valuryans paid.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd7108a-3e81-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748738710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738710, "uuid": "79533b7e-2620-4fbd-9c6f-ab3067afad43", "comment": "Malware payload (MassLogger)", "value": "dd925f9c450e845e5401d5011a3bdb1f", "object_relation": "md5", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "htcp-homes", "colour": "#2240DB", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738710, "uuid": "dfd42dae-07ec-4cae-8d01-62bbf8338887", "comment": "Malware payload (MassLogger)", "value": "d984016d8407f83353d5d02820cb9e3087b5dca494d9d5a907000712d162d5ad", "object_relation": "sha256", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "htcp-homes", "colour": "#2240DB", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738710, "uuid": "8f0dc698-b81d-4924-88a0-06fedfcb48fa", "comment": "Malware payload (MassLogger)", "value": "834792ef1c27b52ddb36b7fc2a5b3a3722bc9367", "object_relation": "sha1", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "htcp-homes", "colour": "#2240DB", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748738710, "uuid": "6523d164-d258-43d7-a505-1bc1559feefe", "comment": "Malware payload (MassLogger)", "value": "08eb7c0f1d4cd8eefb142c3187a15d00f8052b2fc12a161d2f145f2830bd9f6711f3f64cb979de9aa1e55bd243054ab2", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "htcp-homes", "colour": "#2240DB", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738710, "uuid": "51af1834-5bc4-4d00-8601-4b0e36e20b79", "value": "T15425BF1273DD8361C3B26273BA667701AEBF782506B5F56B2FD4093DE820162521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738710, "uuid": "13b192db-d67d-42d7-8e8c-e693d957e708", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738710, "uuid": "1a1271dd-1cfb-4944-8601-24e9f6f03138", "value": "24576:2tb20pkaCqT5TBWgNQ7agfLvmCNN9q6A:jVg5tQ7agzvmyQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748738710, "uuid": "3badd776-3c41-4340-8376-9d461a283ea6", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748738710, "uuid": "b130d46e-dd7b-4269-856b-63e2620af2f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748738710, "uuid": "181edf07-a797-4138-b75d-a74abd742a53", "value": "prosperff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7958dd-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (njrat)", "timestamp": 1748799704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799704, "uuid": "4dbf3762-4e47-443b-a5aa-5bc3944a27c4", "comment": "Malware payload (njrat)", "value": "ab17b29cef1556d7e4320753ce85ff83", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799704, "uuid": "2678ac57-d423-4f01-b649-8c97ec9ce80f", "comment": "Malware payload (njrat)", "value": "da610da7dde31e26f1d7159d80493b4e9122a84dc3e2e7663272b95cfd965215", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799704, "uuid": "c2ac2fad-52ed-4105-a750-3e37b10110fb", "comment": "Malware payload (njrat)", "value": "edba906627d4e0d1af42d920fd42b6fa5e7aca15", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799704, "uuid": "6c24abb0-1298-4e75-a255-b3d5491d9d38", "comment": "Malware payload (njrat)", "value": "157797818c409268130e8698b4a92007cb4277599c6afe35e194023572edba1d6c0e43a5d7c69af2edc1760f4258c0d3", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799704, "uuid": "d2ceef86-0091-41f9-9ca3-dee544ee7739", "value": "T19193A43EDBE8EDCA0B2A30D4126E2A4E118CD722A1BF47FDE5BF1910741C54A96F561C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799704, "uuid": "13c0c849-7218-4f8f-b1fd-07cd82760013", "value": "1536:hkYiBdCcApAxuDNSjedArmEwiq9mXD6j8vk6r8rG54B+MSWn4u:RiyAxuwYmTFVA4Yn4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799704, "uuid": "ea228ace-0376-43b5-b9bc-c78abe1f9ac4", "value": 90201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799704, "uuid": "928b20ed-c031-461d-a5a6-0e093ed1c59c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799704, "uuid": "0e6cfd1f-597b-4efb-9803-688807dfb283", "value": "Photos Samples22.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660c2d60-3f19-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748803876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803876, "uuid": "44207274-3c06-4a8b-88fd-0f52db857fab", "comment": "Malware payload (Prometei)", "value": "718cdf9c400d35ec7175610e8c3ca209", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803876, "uuid": "c1d8c3ea-0afc-4ec9-8af3-9fd3be4387fa", "comment": "Malware payload (Prometei)", "value": "dada41ab429041699785a6b3a4c6cb0ebdc5ccb86f721facf7b19b5c9a570b73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803876, "uuid": "7b1580a8-0c76-4a56-9c86-e7c5483ad788", "comment": "Malware payload (Prometei)", "value": "ea5d6e513714c08f9456b5b77451af1f98c9303b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803876, "uuid": "8c3fc4dc-8418-404d-8752-6571ff145470", "comment": "Malware payload (Prometei)", "value": "4b677cf087a76ec234a84d08d3a4063bff7f9839a8c97bde20f62b4944f413ed945dcc9a23383b0a9de01ff7e5ef2bc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748803876, "uuid": "af65039f-ad65-4dff-9e27-26aed48a7d9f", "value": "T1D19423F8C83D2E3098169B3CBB5A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748803876, "uuid": "026c5f6d-ff3f-4759-849b-2d7b1b0517d4", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgc:25WOSACZSV6eKRH5EPiamb4DsDwwcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748803876, "uuid": "128eb690-bf2e-4c5a-803f-998c9835e0b0", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748803876, "uuid": "ba681337-aa9e-4ae8-8f34-b3c9a3d7ae0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748803876, "uuid": "72c3d93c-6cc5-4075-ac02-ebc1b014285a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d561ac-3efe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748792194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792194, "uuid": "bed01139-70b1-4250-924f-3d0e204321fd", "comment": "Malware payload (Mirai)", "value": "74e9521e3a9a6b1f944045f71a139419", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792194, "uuid": "c7fcb2d3-eb36-42a9-b05d-bb4f03bf0bf4", "comment": "Malware payload (Mirai)", "value": "dadf9b3226667158d460e58f44971552a159490c8f32a64191fd024c675b403a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792194, "uuid": "1cc1d491-a8df-4440-87b5-ae9f5f3c0e7e", "comment": "Malware payload (Mirai)", "value": "65c559cd32902c7dec3b07a23fba3166d487cb2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792194, "uuid": "8ee4447e-c7e7-4b3b-8d5d-7a12ef074f3a", "comment": "Malware payload (Mirai)", "value": "f71f757940fada0ed8ccb94e5da36b21c890dcc6bc108e9d654c16409002a72b9d514f91e7a1299ec92ac985138f430a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792194, "uuid": "85c713f5-21ae-4efd-be1d-bea8638e538c", "value": "T14E332A51BC929A12C6E46377FA6E41CD332663A8D1DF33079D252F107BCA82F0DA7651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792194, "uuid": "d60bcf36-47dc-4330-b13f-f61746606999", "value": "768:4+so1sEalxYAxBncJ3qHxJ3UOFxvG4UHPUWTSh0ZKrSFhvYPvT/hcK3D8rRRbPNn:WoAOAxBX84UZKyhIvT524NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748792194, "uuid": "16349b32-3394-4a8a-8ce2-13e4b45cb6d9", "value": 50684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748792194, "uuid": "285806b6-4021-4185-bdf6-f187c8cbaa54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792194, "uuid": "fbfde292-b6f4-498c-ad3d-5d6a74626f5e", "value": "hoho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212af1dd-3eb4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748760381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760381, "uuid": "6bf9b950-47ee-418e-8c0d-e4ddf0791ef0", "comment": "Malware payload (Prometei)", "value": "8cd089d7a02c6ac90f08b567a186ec80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760381, "uuid": "b8ec1a44-4033-4db8-a72b-86ef682bb6c4", "comment": "Malware payload (Prometei)", "value": "db4555a7f189abddf2c3c9d93083a918f43299604b4c5cd405cf79db721add9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760381, "uuid": "cc29c5d0-8d09-4801-a02a-254efb65d2c6", "comment": "Malware payload (Prometei)", "value": "66e98839bafe6975e8541f6ddbba3fdeee0b2260", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760381, "uuid": "506adbb5-a093-484e-a9c7-a5d20594d535", "comment": "Malware payload (Prometei)", "value": "46be694418a6f1a27c4cfea3279daf0d6a5bd05af876b196d0ee29c3a39ce27cce3224b6c3c50833542afab5eecb91c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760381, "uuid": "77908a76-1455-4948-bb44-1ce804cce19a", "value": "T1F7155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760381, "uuid": "acaf8b26-612f-46ff-bd65-f69f0c0e7001", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplk:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760381, "uuid": "d3cc2fb8-7965-4ca3-8663-3577b2db7e77", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760381, "uuid": "f7d0b320-fa01-48d2-b650-6273c95bab24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760381, "uuid": "b3e3a51c-517a-49d2-8ff8-36eec7cbf0a5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42446379-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748765161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765161, "uuid": "95a36d69-b78d-49a5-a142-f43d67aa8401", "comment": "Malware payload", "value": "1eb89cfec4126bc54d5802742ebb1102", "object_relation": "md5", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765161, "uuid": "327a781e-5987-42f7-9f4b-5eae3e037931", "comment": "Malware payload", "value": "dc25c5b44cf46365abeed701eeddcfaa8e7a2fa4cc23dc741a5f22094009ea7a", "object_relation": "sha256", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765161, "uuid": "64955931-de24-4a7d-92fd-1167c101c3e8", "comment": "Malware payload", "value": "c7183b2f8f826def09fb2f9718070b01c3954213", "object_relation": "sha1", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765161, "uuid": "423f717f-cd85-49ca-99d4-e8bae5b382f2", "comment": "Malware payload", "value": "ca6a0939d48f74c89f05c37ccfebe898e037fe2f4ea1d4b2f75945414326438e6441d30dac9399ea1db3a29e1df90f4d", "object_relation": "sha3-384", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765161, "uuid": "477d24ee-d7d5-493c-a0e0-8dadee328233", "value": "T1E8F05410FFC7A7AD060165468816EFDCB07855072215D69276CEC99C4049C987B746F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765161, "uuid": "0f42b970-bde4-411b-b07f-8f0b77d08ebd", "value": "12:CWVmoxJPMJBJqRfE7yARzg6dhHLknpHbnu1HeWGX6BXe5n4txiK:3VmoxJoqfE7JRzvLknxbn2+WCqXeitV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765161, "uuid": "a188813d-23dc-4b63-9aa5-94d32a4b58e4", "value": 486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765161, "uuid": "b4634c8a-a993-4744-b4fe-8ff368cb4bec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765161, "uuid": "8fbc987d-5b51-470f-bba1-d758fdd22f36", "value": "rs.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fc3680-3ed8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748776046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776046, "uuid": "c7822407-0af9-4815-93a5-e6ffa0d84d7c", "comment": "Malware payload", "value": "1ae4dd118f84facbd83a152ee858b896", "object_relation": "md5", "Tag": [ { "name": "107-175-246-45", "colour": "#29B2CB", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776046, "uuid": "bbe27d00-33ec-4596-ac6d-32fa15c58534", "comment": "Malware payload", "value": "dc2ef16351225077c9239f1fe27e04c822eb09a0c9a4d38ffdb88d68a241780d", "object_relation": "sha256", "Tag": [ { "name": "107-175-246-45", "colour": "#29B2CB", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776046, "uuid": "1f750153-ae75-4c3b-b50d-e6e606842c4e", "comment": "Malware payload", "value": "aaf21e42f23d84c5cfa5fe85bbdc38fe35857962", "object_relation": "sha1", "Tag": [ { "name": "107-175-246-45", "colour": "#29B2CB", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748776046, "uuid": "fdc00385-c9f5-4d1c-ac14-7bd34468f0b1", "comment": "Malware payload", "value": "7c40dbf4b31f49d35af163b500083bfd550f111603f5deb5f66be1c180ea2e46b5974e444c764459f948f3a21b56dae3", "object_relation": "sha3-384", "Tag": [ { "name": "107-175-246-45", "colour": "#29B2CB", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776046, "uuid": "ae2e8a9d-b3cc-49df-8b4d-a0bc2edb43b1", "value": "T14663F62EE34F0955DF55977B034B4E4A06BCB23DB38540A039AC97343BADD2E4A6297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776046, "uuid": "2c3038b6-70e1-439e-bfcf-6442b84c1354", "value": "1536:vJRY6lOAse/igC06NXodaEC15lHdKOg7199LLy3G5p7TkLgz2d:BRhlOAsscVV1jHdKOg7X9LLy3G5p7TkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748776046, "uuid": "1eb50c4d-fd07-420f-b084-26803e83a1ea", "value": 71458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748776046, "uuid": "05732d29-dad3-41a2-936f-839b91d5874b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748776046, "uuid": "cf5f6667-fadb-4f84-8252-de03e925c977", "value": "greathappinesswithsuchagoodthingstodowithmebetter______greathappinesswithsuchagoodthingstodowithmebetter_______greathappinesswithsuchagoodthingstodowithmebetter.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54f9c6e-3ee4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1748781326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781326, "uuid": "1ec034df-3ad9-448f-9641-9695fde43cee", "comment": "Malware payload (XWorm)", "value": "2cd1c4651cfc6ae314c10fb68b83aa18", "object_relation": "md5", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "Injection", "colour": "#99A2CC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781326, "uuid": "2812ad50-557e-4f86-ad43-c8f0befed048", "comment": "Malware payload (XWorm)", "value": "dc497e349ef569c0bc41a44010f4d3526f7546303b427148f1def151a1cb11d0", "object_relation": "sha256", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "Injection", "colour": "#99A2CC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781326, "uuid": "2634d643-738e-4f88-9e49-289faefe3226", "comment": "Malware payload (XWorm)", "value": "95e921a6c656968fa02fa6f6f8902fe64976d3fb", "object_relation": "sha1", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "Injection", "colour": "#99A2CC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781326, "uuid": "2fa0611f-4740-41d2-a2a5-9d33f6af0289", "comment": "Malware payload (XWorm)", "value": "4f084f4157e99b9a43ee762f31ef2ef10e390097d0e8148ad97c0d4baebce5f9cc806d733ad9b9394c25c0e1d0ed74d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "Injection", "colour": "#99A2CC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781326, "uuid": "f8c3318c-bfb7-4922-bb79-b4938316392c", "value": "T18EF533EBC234DD4AFF29BD92EA08C8C69E3E9F52380BE124275267777E6E631550C441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781326, "uuid": "fe508f23-f859-4b0c-ba5a-2b3d6cd3ecc5", "value": "98304:/cvu7NlOfiJzmfIXqD5sEyzniWusy+TnRYO:Evu7NofsqD56iWwCYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781326, "uuid": "da4792b7-9021-4d5c-bc2a-f4660d6bee62", "value": 3592800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781326, "uuid": "582de073-cebe-4cba-8963-fbb294cf371e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781326, "uuid": "27724ac9-75fb-4fb8-ba4c-41851eee31df", "value": "DETALLES CITACION JUDICIAL RADICADO No 20259969-9966569-99962366-9986.zip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfb41d6-3eb4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760373, "uuid": "000a6600-1029-4534-9e30-97d4bfbbc718", "comment": "Malware payload (Mirai)", "value": "65bf3e32506c4647e0915359aca98c44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760373, "uuid": "7473af0b-96e3-4f38-a78b-f1e6d3932bbe", "comment": "Malware payload (Mirai)", "value": "dc6297a8182952c49238b4405149a46f830cab151e793587385ccd6062d5cad6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760373, "uuid": "dd87fbdf-cea6-45f0-9be3-2943fce2d13e", "comment": "Malware payload (Mirai)", "value": "13245a0c6b37ae0cc3f12f424c0461abd9275992", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760373, "uuid": "b4fed66e-fa42-4f47-9d95-822443c96578", "comment": "Malware payload (Mirai)", "value": "5ce5876df3dc00456f642f0ac0b20a1bf52f3788dcdf4e632822042266f1d9e50933567abb09b5b85795b8a8c6f5c2b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760373, "uuid": "97c51962-8a32-42cc-827b-11225d55aed6", "value": "T109230846B8919F06C9D462B6FA2E41AC372523E8E1EF3203DD206F5537C782E0EB7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760373, "uuid": "bb01da59-6fb9-4a41-b223-61337eef2a62", "value": "768:fF+V07J52VX+PZtC0NdI6JEHx8H2C1Pcg2L821CHqQMkxgdt1/NOlRs6iGiktx4:d+V07J5o+RtC0NdBXWC9v2L9wHMtiRFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760373, "uuid": "ddf23dff-0bfc-47f3-8711-82e90b1455c8", "value": 45892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760373, "uuid": "8eecbe9c-4c3f-4494-a504-09a7f5df1a7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760373, "uuid": "8663fdca-8ec3-4359-86f9-b1426e52074d", "value": "owari.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d7eaa1-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748800116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800116, "uuid": "56ce8a43-c8b8-47c3-8d6a-091303d57a5f", "comment": "Malware payload (CoinMiner)", "value": "992a55be7c25c1952f5335205bbf7833", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800116, "uuid": "2bb4532b-c840-41b6-abb4-1c176dafd5d9", "comment": "Malware payload (CoinMiner)", "value": "dc8e93a50c7b2c22d97dd282084a48ef69305a23b5a0075fe3239baa17d7d7a3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800116, "uuid": "faf0bff6-8c24-41d4-a405-b7782d8f303f", "comment": "Malware payload (CoinMiner)", "value": "936f71c8ceb316e2424ab8365c7193a8307c9710", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800116, "uuid": "92d9c8da-dddd-4db4-88a1-78a6a79951ca", "comment": "Malware payload (CoinMiner)", "value": "772362ecf664df3886be3794d3c9d1a6cc6b9506eddd3c3616e3ac4105face9b466d0b443294fa3aab46dfb4d5e370e2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800116, "uuid": "bb6246a0-540e-40d6-ba4f-9d129ce8ce47", "value": "T14BD533B3B19A3C26E228E0772BDE7FCDB7E515E1B493709231820453787A16C61A7F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800116, "uuid": "637e60b7-d241-4162-8d42-b4ffac7334e1", "value": "223bc1f99711b3023176f73134553f71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800116, "uuid": "f8696b27-48e5-43af-bb2f-2b4881f2b155", "value": "49152:CuvMT0oqQqWNSSr62Vk5594nFtLsS2jDnYIbuGxRjcZ+y48KO/eCymds4t:Cuvt+k2u5+LYzHuGxRjVy9xmxmd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800116, "uuid": "2ebb5dfb-97e8-4b0a-a8ec-1bba3a8755e4", "value": 2857984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800116, "uuid": "f2b83bde-5d2e-4f70-b568-040ea98a70a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800116, "uuid": "5515dad7-5c82-4d79-8b33-9b2f1988c335", "value": "addon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8b11ea-3f3a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748818113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748818113, "uuid": "64274c72-c8b4-4644-8d1c-bf383e877cc4", "comment": "Malware payload", "value": "45ed74f14b2bb8cb3fbb9bb68ff2186c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PUP", "colour": "#82B746", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748818113, "uuid": "42157724-03d4-4d69-a4e8-251dc8c13dc3", "comment": "Malware payload", "value": "dda6ea62548fbbc296a7a11bb3f2026aee35ac9f73e96190535d9a02d36d5fb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PUP", "colour": "#82B746", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748818113, "uuid": "40112336-a252-45f4-82eb-444365e974f1", "comment": "Malware payload", "value": "c106c8048c02cdaf7d16860a010fb8d5edc32ba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PUP", "colour": "#82B746", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748818113, "uuid": "b72b5b1e-1c57-47ef-9409-683467a4fa3d", "comment": "Malware payload", "value": "7f97b6a6c0209016feb4404d393a2c270cc3b524bab4d708d004ccdc805478706993dd6be96c68f8202fa20b37b7ab48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PUP", "colour": "#82B746", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748818113, "uuid": "3868ee32-3c5f-446a-bc83-1b137fac212b", "value": "T1AB15238BF7A7163CE5722A30EC43502B57393A436E2FCA56D3FC5D8D5932204EE125A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748818113, "uuid": "3a566ffe-fdc6-4751-b949-774de5f4fe65", "value": "0c97c38021e73ae3921565566bcfaa66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748818113, "uuid": "8c97e015-2de6-4e73-ac7d-1369cc0c05c4", "value": "24576:kokNbqIvaDG0Yc+VFwMMv2ITPM8/7cfgYOXjFMbxUv3:kokNqKR0zRMMv2If/wfITFMbxUv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748818113, "uuid": "7614bba7-7ca2-4250-b14e-b571d008315b", "value": 894105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748818113, "uuid": "f90c9ff8-1415-44f0-be1d-3cdff5550e34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748818113, "uuid": "3ab40bd5-d71c-4740-ab5c-5303620aa4e5", "value": "dda6ea62548fbbc296a7a11bb3f2026aee35ac9f73e96190535d9a02d36d5fb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33b0c0f-3f41-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748821212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748821212, "uuid": "0d6c209f-6ad3-47b8-892f-d63034376b98", "comment": "Malware payload", "value": "446bfe1a623d5f15da5d8c1451afbd3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748821212, "uuid": "c1a2c140-37c1-40aa-b1ff-46957b85e1a4", "comment": "Malware payload", "value": "de0a0216bdf577ebd23fdb0dcd0774e1dc01bce1f2baf38bab8c66b3a84d3395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748821212, "uuid": "00ed4589-0bee-4be2-9b20-7ca09653bc2e", "comment": "Malware payload", "value": "0cd70b74ce75fcf2a76deb82adbdb99e32f16d96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748821212, "uuid": "a25205bf-831b-44c7-ad6a-8717011875d8", "comment": "Malware payload", "value": "ecae5652b8ae2c024e98a437bfb5495ce273417f67e73263731ad359f3477109e9dc11f2b71d7b5d91165f6344e85986", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748821212, "uuid": "937a976e-42e9-4550-bd47-5c09d0e92ae5", "value": "T192768E19F7A514FDE56B823CC9460906EB71BC5607A1DACF13E04A963F236E09E3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748821212, "uuid": "c792e4a6-23ff-42fc-8309-f83806136525", "value": "cd37300a8fb115f7595746251b563f51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748821212, "uuid": "2a214a9b-d50d-4097-9689-24aaf79dad01", "value": "6144:4XiRtxWiJ8QYn7xNierfyLxEVD/msgaS:TWk8vn7xNBWxEZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748821212, "uuid": "8727e07c-e928-4937-8d7b-bd01d72d341b", "value": 7340032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748821212, "uuid": "6a3f88b0-27a2-41ff-991f-7014caa128f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748821212, "uuid": "d63862f5-0bfd-4305-826f-19f6553f1a09", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b10386d-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748765203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765203, "uuid": "4da9c117-9341-45c8-84f5-7014dc0b998e", "comment": "Malware payload", "value": "42308b5b079561a1ed57ee796e27798a", "object_relation": "md5", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765203, "uuid": "41f73378-baaa-42aa-99ba-467db9a1f55a", "comment": "Malware payload", "value": "de47d497755574983bbf238424555395bc3d49a679f35b1855292cd7fcb9d5ac", "object_relation": "sha256", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765203, "uuid": "ca74b268-ff00-422f-bcbf-3a9ea4714780", "comment": "Malware payload", "value": "9d3fcd3df2fa46cb4feaa629bd0ca04b8afc838f", "object_relation": "sha1", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765203, "uuid": "e567ba3a-4326-4aaa-80a5-bc1e7c2a3612", "comment": "Malware payload", "value": "e286a6a3126eea09e475aaf1c2807481561bc6590e3274376c8e8cc4e2894af206f73964f12b394b51ee73fa132e5f44", "object_relation": "sha3-384", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765203, "uuid": "deb827df-878d-4430-a40f-3d57ab93a030", "value": "T189152B1BE6B345E9C52BD03883539772AE70B4694234BE2E1DA9DB321F21D509F2F724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765203, "uuid": "86dca1e5-be79-4ccb-b62b-92dabdaf4925", "value": "5cee5fa816007775f192a8dcaab39723", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765203, "uuid": "cbb3fe93-032e-4122-9f2b-ee750a5cc30a", "value": "12288:wSiMS+kpV3IKVMw65Mg9pKZ6Sih8TN1A1AkORykuSZta7meZEp:w9MS+kP3IVX5t9pKehLBSZtWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765203, "uuid": "1cec240a-d32d-43ff-b0bc-13ce9882cb5a", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765203, "uuid": "14bf8170-19cc-401a-a043-72592854cca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765203, "uuid": "e5ba1402-79e0-4f21-8161-235dec55248e", "value": "vnc_server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c405a624-3ec2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748766668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766668, "uuid": "939ffd1a-96c5-46ec-ae81-a24ae9cd6688", "comment": "Malware payload (AsyncRAT)", "value": "9fc9ae98fea73883bd4cd3f6e264c363", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766668, "uuid": "a4bdc1b6-78dd-4e8b-8a8f-63d666933ec1", "comment": "Malware payload (AsyncRAT)", "value": "de779242b6631c689f39cc5ef0e6fe23f5cbd8e1f48e3623b631202ddcfd421a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766668, "uuid": "211fe7ae-3a9b-4fb7-a8c7-898384935859", "comment": "Malware payload (AsyncRAT)", "value": "fa9d448d75fd3d0dcadc2d7dcc36932dfa7bdd85", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748766668, "uuid": "4cd18feb-a4ff-4ace-8d4e-47086cc5fffa", "comment": "Malware payload (AsyncRAT)", "value": "8b348a4539e9c95e29b45e2afeb5a91454505ae7b7ac0406a26aa9f306fa212ee3fbeed6cfb2f1b22c0240daedb9b118", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766668, "uuid": "c861e719-71cc-43d2-8359-11effe00e96f", "value": "T15AA47DC2CE88248BDC356E31D2B0A79C4E3BBAD0B8A95F69106D7D2D7C94E905C1277D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766668, "uuid": "05d56493-4776-41be-8f1e-f6682570e192", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766668, "uuid": "4c99e2a9-428b-4ed1-99db-b92b58c0db1a", "value": "6144:jpxIO/1XbtFAjI/SqAg8m5xA+eyTaoKVVN4HiTVVmVVV8VVNVVVcVVVxVVVPVVld:j0O9XAjIaqAg8GxPTWoKVVNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748766668, "uuid": "35c819f8-053e-4d11-9f3a-c04bd07e0229", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748766668, "uuid": "9a277070-bf66-42a4-b561-ad6fae1ba315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748766668, "uuid": "8b5932ca-9eae-4a53-9ceb-0910322614e8", "value": "SecuriteInfo.com.Trojan.InjectNET.17.17072.9972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f076bf0-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VenomRAT)", "timestamp": 1748799569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799569, "uuid": "c7320e2a-97eb-4fc9-9f16-9819e18e1c1c", "comment": "Malware payload (VenomRAT)", "value": "a29e866e3ef853b85a748ae59e7a85dc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799569, "uuid": "7b36c7c4-b5b6-4139-a8d0-79409a4b2a5e", "comment": "Malware payload (VenomRAT)", "value": "def70cf438e0c5a064f8314709a90ad67a2a30b5e9d48e36015cd035cf33e75f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799569, "uuid": "f88b2846-1d94-4c93-a491-d6f9ceef68a8", "comment": "Malware payload (VenomRAT)", "value": "42ab3ef40e6b292f7d1d8c0eb6059c351dc0febf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799569, "uuid": "a5f251e9-5139-45d8-96ee-8dead06b569f", "comment": "Malware payload (VenomRAT)", "value": "958a2913ab90b42568ad875a6452c655f7c8179d685ba5781c6ad8626a94c8c6ac7aa7733509bfe0855c304bcf211a1f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799569, "uuid": "c540929b-9e2d-4c14-95d3-ec899691e467", "value": "T173D3F83E9870FEDD8BB530D171A8A658919B4BA3E471CA1CD85C09EA5E3C1ED5FF2018", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799569, "uuid": "78b10236-de02-4020-9f06-f49859163cc0", "value": "1536:zFFHcXbGU73AUVTnmQb1P4bOK1UCi3H8B9rbu6Hdd3+ldArmEwiq9mXD6j8vk6rE:RK6UbuQJP2OGi3ymwYmTFVOzIPZZz7wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799569, "uuid": "c26dc126-a21b-423c-a4e4-59537a400744", "value": 132280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799569, "uuid": "4855d432-525a-4bb4-a494-214e67220b72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799569, "uuid": "6f4bf42f-5c95-4443-b771-50bd9ecb0e31", "value": "Purchase Inquriy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3238fd9f-3f1f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748806366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806366, "uuid": "761801f4-6b83-4a50-99b5-a1c73a82f03f", "comment": "Malware payload", "value": "6fc66aaab55611b4bb4a62c1f7c37e39", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806366, "uuid": "fe7075a7-39dd-4b71-a86a-8bac5e3f5c4e", "comment": "Malware payload", "value": "df2d7b37fe38ea380215d40fbb5f4d8ca76f86e733b873dacb58c3921064d403", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806366, "uuid": "0d68ae74-511d-4938-aac7-7914aad15f13", "comment": "Malware payload", "value": "5d984d95323fc13f850832a040d89f737ed679a1", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806366, "uuid": "d156a202-28f3-45e4-a557-10e21f349e30", "comment": "Malware payload", "value": "1023b073bec6cddd8eb3979ae6c51e1c8215b5ef6ac449c8332bb1659652c119c5f8d16b7f423c0a811ba55a93324418", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806366, "uuid": "832195af-dde4-42bf-ada3-7787dd90dc5d", "value": "T1923172533805A1209E778E4ED1F5BFB4C1BBAAC70703FED435D28514392B262C0863D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806366, "uuid": "bea6ab7b-f747-4b11-8e13-049f4d10c9b5", "value": "48:zUjaXrZKu+oV93GZdJPpRTSvz5siIOnxotg0:oaXrJ5G9PpNuJIOny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806366, "uuid": "3c484f41-3277-4fdf-97c9-33b2c9b90533", "value": 1686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806366, "uuid": "2d57bc01-4312-4712-a457-48065c7cf70a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806366, "uuid": "1ccf2f5a-2ed6-468e-a96e-bf79575083f1", "value": "ChatGPT-4_Cracked.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b65677-3ee8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748782889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782889, "uuid": "649b1e1a-d7ba-4149-85d5-85949840bf07", "comment": "Malware payload (Mirai)", "value": "55d054f64666a33092fc82e3655871f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782889, "uuid": "248abbfa-0e74-473f-8938-52a087f755ab", "comment": "Malware payload (Mirai)", "value": "dfc98b33649b4b8d2413a6443d952e89a0d45a076c4e402d7e6ac1cbd57e65b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782889, "uuid": "6897b7a7-97ba-4af2-b9c2-c268ffd6d28b", "comment": "Malware payload (Mirai)", "value": "a794b8ce6ae08090449e9d7d4f8bda28de796da0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748782889, "uuid": "d00e2b4a-2ef9-4f72-9975-dc7a7454f2df", "comment": "Malware payload (Mirai)", "value": "6d295d72843e4a4066197f2d0369f5f4913654222b1a7b66c1c04c8254fb994ff4f5cc3401f469026a1c9294f278082c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782889, "uuid": "7a00579e-1fc5-4e72-b924-ca8034df83b4", "value": "T1E4E35B16B4C184FDC4C9C1744BABF63BED31F59D5238B26B27C4AB226E8DE600E5DA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782889, "uuid": "f1c403e9-15f7-47f4-ad37-6557c897cbad", "value": "3072:I74zb6vo+YCrsEf3Odtys4S4kHVfpNNH131CWHpbQYAvNW63bDR:I74zb6vo+YCrsEPqLNPlJ3AJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748782889, "uuid": "70bf27d8-5610-4051-91e6-b86a7e5511b9", "value": 155736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748782889, "uuid": "16728a44-65ce-4cf3-8820-d57dccb80e8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748782889, "uuid": "fd4bfa35-8e99-41b5-b485-a2e018eb6df9", "value": "navo.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1a80dc-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759544, "uuid": "ad535443-0929-45f8-b453-7c384ee615e1", "comment": "Malware payload (Mirai)", "value": "109718ac046537a5a73de612f32e9a35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759544, "uuid": "4ecfcd1f-dacf-40f6-9bdb-c036368847ed", "comment": "Malware payload (Mirai)", "value": "e01404058afdb956405ac1a1358d118112a381784a048b8435d163ecaa8d681a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759544, "uuid": "55f1882b-664a-42d6-b89d-719ca29be35a", "comment": "Malware payload (Mirai)", "value": "66f6d0e0d081ee3ee364f0e3068b8e4fd8a2d227", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759544, "uuid": "7b75d16b-ec8d-4fdb-ab85-07311805b220", "comment": "Malware payload (Mirai)", "value": "207ca392497261fc1af9b5a0dd52cac0b7a1c5948fae54b861bc65a8a2dfd37361b4c9842a4dcd94e09934ed1fe2b149", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759544, "uuid": "bc012c2a-5023-4f07-8e3c-03cedef1c86a", "value": "T12593D91E6E219FBDFBA9823047B78E215B9923D227D1D685D29CD6001E7034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759544, "uuid": "27bb480d-ec1c-4c96-b335-ac363b353324", "value": "1536:qnFtHPJeBumYl07QlxOO4dQ1HxOC4a3LV0GmTGoXe0LnGVcxWje8:qnjvJNl0RQOi3LWGmTGRcxWjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759544, "uuid": "d48e1522-528f-489a-9fb6-24c1e7599554", "value": 93104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759544, "uuid": "6d88ebc1-bf1f-42ad-9ce7-25e38baf3b35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759544, "uuid": "eae0e519-9e51-4958-8370-96d8c06839da", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7e07d4-3ead-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Koadic)", "timestamp": 1748757632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757632, "uuid": "e3014f36-d7d8-4caf-8ccb-ea980a74e637", "comment": "Malware payload (Koadic)", "value": "500acba31a3d4ca0ee82777ca79aa3ff", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757632, "uuid": "b884b54b-c5ff-42bd-a64b-dbbc731eef14", "comment": "Malware payload (Koadic)", "value": "e2ca64882de9f67ba117645a505827fe0212c691d7dd4df6af7f82109b8f08d2", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757632, "uuid": "cc04c900-efe6-4cf3-9919-7ee5c32254aa", "comment": "Malware payload (Koadic)", "value": "c568f6fba46befc183adfb7debbadb44bccf3bfc", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757632, "uuid": "9ba066e2-f4b2-462b-8d33-7ad8cda5ce3d", "comment": "Malware payload (Koadic)", "value": "68f9b23757c4029677c5151cf7869265e8eda9f568c9d2b60c78152eadc41392801688a9f2c1a7d9bcee38214e09f1b4", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "Uacbypass", "colour": "#0960B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757632, "uuid": "d3069237-9359-49dc-8df7-f8cce873f529", "value": "T1CC05CFAF0E85F75EB10485CAA29790FE52CAA4FCB1E9C59FD849F65A1CF1D12E103C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757632, "uuid": "73a8ee1f-1d0e-467b-b59d-f0f580ee4103", "value": "768:mQ/W+ABNNNoGzp4Fjw6Zcz0NF6mVz4giFTjIyFM/gXjUF5J2t/zG+/GOFxI7kO0+:TMvNbO91R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748757632, "uuid": "4f609bf7-9c42-418d-82f7-e015faf12ca3", "value": 827117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748757632, "uuid": "c91d00b9-bef7-468a-b709-275bffb935f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757632, "uuid": "d1b4ae90-975a-444f-8fc2-869b3a1820c6", "value": "FirstLogon.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72936dbf-3ec5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1748767820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748767820, "uuid": "00e1a6a2-0ee4-4df7-9c82-157eccd3be91", "comment": "Malware payload (DCRat)", "value": "7622a224e1735e23f7ad4527886c885a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748767820, "uuid": "f4982118-3968-465d-99a4-887ebb92fdf2", "comment": "Malware payload (DCRat)", "value": "e31b997d118cff687de394cd347248efb5fd0f1d2fa6ba6639c42505c28f4a59", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748767820, "uuid": "bab424ef-03aa-470e-ad63-29ffe269a0ba", "comment": "Malware payload (DCRat)", "value": "7b2fd78283d452aafd7baff2ef867620ea870f70", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748767820, "uuid": "357bec98-1adb-4276-bcd8-868d15685d54", "comment": "Malware payload (DCRat)", "value": "a70afcf40870f9f953b1354d72fdb07aafe97a46c397e85eb0dda5a10945eb3011a17f50dc3e9950ae858e58677e85b4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748767820, "uuid": "4256729d-de10-41aa-9b16-9ec30b132da9", "value": "T10EA5BF0675928E32C2741B3146A7463E42A1D7223662FF4F360F2496A917BF18F727B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748767820, "uuid": "eb0b5762-b6be-44f8-88cc-e48276f3fc6b", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748767820, "uuid": "149456b7-7d5d-4ebf-a14c-d0ad7de17b63", "value": "24576:2TbBv5rUyXV8m7MAYWSJ4EVkp/aE/FfQyldFgD5DbinvvCx0flL4tY/CjfbgSTLY:IBJ8m7MA6uakp/WFinr+Y/b0s2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748767820, "uuid": "d5230529-9e91-40b0-8dc5-7ceda442a6fd", "value": 2248928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748767820, "uuid": "47126ecc-c8b9-4adc-a305-e4540f0820e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748767820, "uuid": "d632afc8-f56b-4c35-bf4a-8e3aa59a1298", "value": "7622A224E1735E23F7AD4527886C885A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cfea10-3eef-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748786030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786030, "uuid": "9e251e32-9336-4775-887c-ce5ddfb5410a", "comment": "Malware payload", "value": "64249bac3810fc75f762d536f67db05f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786030, "uuid": "111fba71-8a4e-4be3-a2b2-e57f4cec986d", "comment": "Malware payload", "value": "e333104f5dbc4f8b11905323e926a57b2724cd7242457f243146ac25989b71ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786030, "uuid": "005c5464-8b5a-4565-829f-6be67d9092dc", "comment": "Malware payload", "value": "641d5f3db188916fa2f29990882d186d58b6fe54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786030, "uuid": "a4612128-7e85-4a4b-a341-ea2df37b8a46", "comment": "Malware payload", "value": "dc1eea6d42fa1326ff8364a0a4337327f0bc6b603cf0f3dc3951061b85151cd8d86d0b4a33b126618b2f57c4b0fb084f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786030, "uuid": "c39eafe3-aac9-4758-99db-40b56a4fae9e", "value": "T16CD7494666EA0481FDF7EA3489F65513C673BC166F3185CF220C1B2A1F776E08A76722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786030, "uuid": "e565c155-67be-40d0-a6cf-be459ee9bc10", "value": "be4fab12f4723443ba169a0e35943ad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786030, "uuid": "f6f327e8-f0b8-4272-9c63-d96a9bc51d69", "value": "393216:usqGxqsktO5GG02US1P+/U7q7K0mAb5ZUjcDUND3usyBvaRRMV+o33irYVI31BLj:u4lmOIUMFCrYVKAGmjve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786030, "uuid": "9700ba93-0f49-4358-ae0b-043abd7327e2", "value": 63130313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786030, "uuid": "e83c6ac5-c98b-4863-8ba6-514c13bf6634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786030, "uuid": "4432722e-d267-4a7f-9b6e-3f5dcb5fe2f0", "value": "lnstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89690f4-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748799827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799827, "uuid": "83a8c5c5-20f9-4617-8ee0-47c2be2aea5e", "comment": "Malware payload", "value": "8748ff69cf08e3304aa92e1d2c7b2690", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799827, "uuid": "a9c51c30-c9c6-4866-a345-95ea7dee54a7", "comment": "Malware payload", "value": "e344a7edc7191188abe579bb7abf29eb5ac33c7c56477fa859340d4765e80936", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799827, "uuid": "bad73e62-d9ea-4cd5-8800-71674857f1c0", "comment": "Malware payload", "value": "0a7b8f6116c1a5967c7165f439b5b6da76136df0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799827, "uuid": "ed88c418-53a4-4e09-a356-149ea44b221f", "comment": "Malware payload", "value": "60c60a890c157d6f7607cb75f045ff175ca045aa599d95d2f2ee2af368f1ebfad7271ff7a8927120521ac6a40bdec936", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799827, "uuid": "c319dac2-28b7-4f06-a852-11eefe487635", "value": "T17941D34237E51B66F3B789710277F550463FF9559D45D71C50A4820C28B2A1CD83AFA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799827, "uuid": "19c10db5-f1a9-428c-a34a-93221a9ba10c", "value": "24:8QlQnnu1Yy8A5ueCxN/ddNXuHY8dYWORgGbvq+3Ym:8huSk8BdLXuHJYWOR/bvfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799827, "uuid": "5b3d34ba-0407-46fb-ba8c-51157b1b5e34", "value": 2115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799827, "uuid": "a194bf5a-84ae-4dd6-89f5-e4fe94f8a951", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799827, "uuid": "3397dee1-0a80-48b7-b7a4-0a8c4e098313", "value": "gt00184637765_000437743212332.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361f6a84-3e88-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748741519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748741519, "uuid": "35b2fede-45a6-46bb-bdc1-6bf6997ab7ea", "comment": "Malware payload (MassLogger)", "value": "f5b01f41f78a134b7a9ceacfa7e9db85", "object_relation": "md5", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "aewn-buzz", "colour": "#D57922", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748741519, "uuid": "4e6eee09-ce49-46cf-a1c4-ab41efaf1a00", "comment": "Malware payload (MassLogger)", "value": "e34e46b3c020a7a74b0590cdca94c987c42d925a7d64e320b32dd0a51075e895", "object_relation": "sha256", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "aewn-buzz", "colour": "#D57922", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748741519, "uuid": "1b29860c-aaf0-467c-9723-3125062d8b58", "comment": "Malware payload (MassLogger)", "value": "278404ecc2eb9d9cd200e1e1b2e0f9aa9ca6df7f", "object_relation": "sha1", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "aewn-buzz", "colour": "#D57922", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748741519, "uuid": "4c69af0a-e5af-4915-ae94-e024b1d3b646", "comment": "Malware payload (MassLogger)", "value": "74cc04044466deaf3df18512cca35ced8336010e97560f236301e878a4021c913b54ceb373f95826ac6dec2f52370a06", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-150-18", "colour": "#331427", "exportable": true, "hide_tag": false }, { "name": "aewn-buzz", "colour": "#D57922", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748741519, "uuid": "dfcbdd4b-9d84-4b9f-9c2e-1c09fc7d036c", "value": "T19725BF1373DD8365C3B25273BA65B701AEBF782506A1F96B2FD4093DE820162521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748741519, "uuid": "e7430de8-b057-49d1-8e14-7426e8b7cb5c", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748741519, "uuid": "c97eae07-3d5e-4844-a828-04a293593c09", "value": "24576:otb20pkaCqT5TBWgNQ7avWXTHKYzIMjp6A:xVg5tQ7avcJJN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748741519, "uuid": "ad963338-959e-43d3-9e76-61d4ba55d846", "value": 1025024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748741519, "uuid": "30079e91-536c-4eff-88ce-f5f0760e302a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748741519, "uuid": "9a367c04-8923-4156-9f80-4b5d4f5c2899", "value": "catbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a138385-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748786569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786569, "uuid": "901326d1-9385-4256-81f1-cf338dfd0a55", "comment": "Malware payload (Gafgyt)", "value": "b7bc606c8bb026c5d4499dc000b4aeaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786569, "uuid": "316a1e63-ce28-42df-abbf-643af8cdbdda", "comment": "Malware payload (Gafgyt)", "value": "e36461cee76e99f0e9b33fe858cb52455107d61e3721299f0c683f7e591f4e7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786569, "uuid": "5596be63-25af-432a-8c26-0265887ff901", "comment": "Malware payload (Gafgyt)", "value": "488b6465fe4fe634b492d2597393348f392eb728", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786569, "uuid": "2981a572-5ca5-43ef-ae6e-e8f0cf144e12", "comment": "Malware payload (Gafgyt)", "value": "41016e21f12fd9b032c1a845d8910aeb1b34860e99f11695244deeff0e11b3878726616ba6062c6667362121bbcb33fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786569, "uuid": "fb47f97e-e9ff-48cd-87b8-ffcf436eba41", "value": "T13CD33A1748514E72C004ADB225A722200757BE774ADF26DAF92D79E08B7A9CF712EFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786569, "uuid": "2d10fad6-56c4-4676-a807-3ca7d5768ecb", "value": "3072:bMvAPOJblHh3809YetJ8add9QzxsJdEFNQFyzKQ5CGBgBFU:bMcOJb7N9YetJ8addQodEFNQFyzKQ5Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786569, "uuid": "da604888-83af-4ac9-a017-f375bbd22aa3", "value": 133893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786569, "uuid": "e612893f-36c4-4f1c-b3d9-e2d790ab9665", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786569, "uuid": "f481571c-83e3-473f-aa20-8da184ec9524", "value": "openssh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0236a21-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744784, "uuid": "44e43bff-78a5-4072-b6b0-3813bff2399d", "comment": "Malware payload (Mirai)", "value": "95e269032c2d45e409fe5e1134d25cdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744784, "uuid": "dd75210b-8280-48d7-8be9-088fbdb9b229", "comment": "Malware payload (Mirai)", "value": "e58d8d7d90313204ce5e4baf85ea9d558e6e8a0d9a62346461b98ff9db8cddd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744784, "uuid": "0960c650-03e3-4536-9a0c-306a4ee2c4be", "comment": "Malware payload (Mirai)", "value": "45b4c31b84fb21ef5ebe513b99917dd5ac9f7e06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744784, "uuid": "ff449604-4797-4e51-95bb-6da01d59a229", "comment": "Malware payload (Mirai)", "value": "cc0dd171ec5c23e44e3c85b922b61de443faf4d9f2118249125a70e087ac8e51a715eb61ecd6051894eff0d767c9d4a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744784, "uuid": "7f4c8042-bc68-4470-ba0f-e0e11f4b6830", "value": "T1BD630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744784, "uuid": "13cb74a9-f343-4684-bf97-3261c5e24ea1", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744784, "uuid": "3cd64aff-9682-4c68-96ae-3147c097b303", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744784, "uuid": "99aaf177-ba1a-474a-9433-5d3803931bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744784, "uuid": "5f62f1c5-2298-4597-b9e4-8645e577e06c", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23054871-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786584, "uuid": "4532d8e8-6bfc-440d-b313-2ab2a176d86d", "comment": "Malware payload (Mirai)", "value": "e9758784f5daa7d142b18c04954ce441", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786584, "uuid": "53fd9e85-269e-4159-a20f-966f86c2786d", "comment": "Malware payload (Mirai)", "value": "e5e2a242ec4e721418f124153b7b67fbb9a9e152639f8b389a8726d3008dc816", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786584, "uuid": "8b3e2ce5-1771-47d0-a463-50aa39cdb47d", "comment": "Malware payload (Mirai)", "value": "fd43e66a0b69c90a78881d19241a48938a66c28c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786584, "uuid": "f9283cb3-eab7-47a2-87e2-5786b2e1be31", "comment": "Malware payload (Mirai)", "value": "3a7317558408cc370c360709c92f5b8cf78a7d2c4d864d6122be7d01f2510d8b1d6ed270d33617ee024ae031cb1967ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786584, "uuid": "cb8ae03e-d7a6-47c6-9d84-7114575e57e8", "value": "T1C9732A81BC815613C6D122BBFB6E428D372A53A8D2EF7207DD226F21378781B0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786584, "uuid": "df2714aa-774f-4dd4-83f2-2e6a3d687e9f", "value": "1536:L/VVdHUOy6hgnManJHshrQi8IOHtflHIxRqqATvbwo:DVVdt0nYhrNOogbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786584, "uuid": "2430ba12-31d2-47ec-9039-82f92f2f72f4", "value": 79336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786584, "uuid": "b9016e4d-e2d1-4bb7-9735-f93f175e7f1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786584, "uuid": "8ae9f6ae-9198-496a-9d25-85d55c3cc897", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45785dbe-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786642, "uuid": "760bb747-2ae6-47ac-bd64-fba648f3b719", "comment": "Malware payload (Mirai)", "value": "98bdad0603e3694f0c7b5d84e0c162dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786642, "uuid": "303a72ab-c231-4f92-8875-b4f0e82ea413", "comment": "Malware payload (Mirai)", "value": "e698ec4ef0403770b9936e31e775072ed830b368e05f3dfc2044c91222279479", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786642, "uuid": "6ce5fab7-aa0d-45ea-9d0b-35cc9d95177a", "comment": "Malware payload (Mirai)", "value": "5ed7ebdcd4d19a986cef97300c621aa292bcc085", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786642, "uuid": "053556bb-00a8-4a0f-9655-3040a38cc414", "comment": "Malware payload (Mirai)", "value": "624df38ccad7ad654a0c3cb72db3c694843b3727e9504128370977d76fdd93e8b57eeaa8e4f6dc863c552afe5880c482", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786642, "uuid": "80bec1b8-cdb2-4bd8-bb8a-3c9d8cc335d7", "value": "T18063951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786642, "uuid": "3c67c921-5e00-4973-886c-339c832fc004", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAY:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzDL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786642, "uuid": "66dc6686-9946-4860-93af-52bf14e5bb8b", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786642, "uuid": "ba014a04-1097-43d8-8a5b-0f9aaac60569", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786642, "uuid": "78b30914-3773-4308-ba24-91a480efbf4b", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251ecd76-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Metasploit)", "timestamp": 1748765113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765113, "uuid": "90e7949e-7dbd-4f1a-846b-070f4236e32d", "comment": "Malware payload (Metasploit)", "value": "5b7db16854bffdac78cd50fc2f872492", "object_relation": "md5", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765113, "uuid": "56d6ecd9-05bb-4430-9835-2487a2bcd028", "comment": "Malware payload (Metasploit)", "value": "e77a5809cd8cf0cbb4b7d855bf6da5fc86d6fa4ab686a4f2f6d10d34082b200c", "object_relation": "sha256", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765113, "uuid": "6377d9be-31d8-4179-8388-9f5660505388", "comment": "Malware payload (Metasploit)", "value": "f03458b68ab52db8120d9f71cfe96b2a5758e9c7", "object_relation": "sha1", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765113, "uuid": "cb7a48de-31b8-432b-8919-ccbb65b9f5c5", "comment": "Malware payload (Metasploit)", "value": "48c299e6d1354b6d9f6b22dd210a9fba006b9f16e445c6a1be6fcfe6be65534b1382f589580b0af70b1918f1845d58d5", "object_relation": "sha3-384", "Tag": [ { "name": "4-233-216-36", "colour": "#F8C61F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765113, "uuid": "2bb36620-b6cb-4403-8bc4-3106d582e082", "value": "T15C346B85BBC5ACEBC6054639889F43693738F6D027839B271D3872351E27AD0BE87647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765113, "uuid": "9c727248-5ccc-455a-a2f5-a532cc5860bb", "value": "75be0d53eaccd7bde958900212bd4c6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765113, "uuid": "3ecd1c5a-ff42-463d-afe2-8785e5731e6c", "value": "3072:zCEvDxKsrW5MYkS134/Y+rFjoqO/GaJOgxn418PWZ8m1XtAQbutugtELIhRRr5BA:e6xnSQm4neqO/GaD/Bdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765113, "uuid": "801a31a7-b68b-4319-a7f3-e4f90aaedd18", "value": 250632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765113, "uuid": "d2829559-868e-4635-8a37-2819afb2814f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765113, "uuid": "af4d680e-0789-4dc8-9139-83c0222e4966", "value": "esp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b1a011-3edc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748777603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777603, "uuid": "62644f92-a521-4317-a6e1-9595c9c3b878", "comment": "Malware payload", "value": "a1c114c7f00b35aad3ba5f35d94468ca", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777603, "uuid": "7ad26e6c-b8f4-416d-be41-193ea03549c3", "comment": "Malware payload", "value": "e7eaa69734a2e38b7dac7abd153754c225410370ac370f2e86e7b91910cdd965", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777603, "uuid": "9d7b3053-75d2-4ac0-a78e-7d5671f4e615", "comment": "Malware payload", "value": "6ceb7b24cb11aaf2601b99bb0152cdabb95409d6", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777603, "uuid": "042a9001-3780-4065-9c40-07bb5c074e71", "comment": "Malware payload", "value": "5a8d896ee94d2ee58e5841b435867c7785413965c44314d53b4b87bfc3d86c455562c18c1a15d8ed96920070b4967bf3", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777603, "uuid": "aa7b4a4c-60cb-4cc0-8d40-5e701e77a408", "value": "T1ED6302F67C1661240B117E6475F56FED601CCB84EAF1809BAF0826681FB5E838BD6239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777603, "uuid": "55b79c97-511c-4eb9-a41a-10479d4ab56f", "value": "1536:wY2XDWCAKvxso+xftSuObTtDSqytON9yHSpOpd4rrxA:CTOQu2uOlDSXswyMz4rrxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748777603, "uuid": "1011c9b7-bc7b-4630-b363-735b02bd0d75", "value": 71280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748777603, "uuid": "d6e97946-d8e1-406d-a61f-abd16a56914d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777603, "uuid": "eef4b679-68fe-4ff2-b494-460eefa195c2", "value": "Atros Free Internal.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be465b1-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806946, "uuid": "ca0ac25c-ccbb-47f5-ae16-9ee1bae5f12f", "comment": "Malware payload (Mirai)", "value": "fd79701b6fec5c253651d5f2eab74019", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806946, "uuid": "80535f1e-4181-492a-a53a-eb0a916c5884", "comment": "Malware payload (Mirai)", "value": "e8792598ee3a7b51b3ed703e9c2480db6e944a276fa1710e569f64306c15414b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806946, "uuid": "29c86004-f663-4ebd-8bae-46c9fda9ee02", "comment": "Malware payload (Mirai)", "value": "beddfb77d2b221bb1ce0dbb70ab6ad76216701f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806946, "uuid": "75ffc409-9c94-4b93-8918-e3bcfe799448", "comment": "Malware payload (Mirai)", "value": "aa88c069577ff0b4e0074de752c779fec9f7e1b827176adabf4e28a21e75f949ed4d2508f072ccbfe16e0e4a00d1f00c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806946, "uuid": "9df4e1d9-b3ff-43e8-9d81-2490b9fac375", "value": "T1A6431881B8819A23C5E4137AF56E46CD3B2173E8E2CB7317DE215F5136C682F0CAAE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806946, "uuid": "d1ff51f5-ba61-4061-b64c-0248e5649e90", "value": "1536:mwgIUdCcNbLpjry4QkeMDy54KDOGB4ba:mwgIahGOba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806946, "uuid": "045096b5-9d21-48d5-99a9-128ce9a3a015", "value": 56064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806946, "uuid": "9e6c883a-cd4f-45f3-8cc7-0a0a4705a0c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806946, "uuid": "f87076e1-3842-4f2f-859c-e21c8141ce66", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0848e3f2-3ec0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748765494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765494, "uuid": "a6d178e5-7332-436a-a540-1812c68ba80e", "comment": "Malware payload", "value": "a11593aa32496ebaacce7970b496b23b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765494, "uuid": "3130f7f1-4142-4a2e-b38f-ae264118a561", "comment": "Malware payload", "value": "e8c7ad9fbf1fd6bcd60ff9339bd4f4492e173651c8e67defc1df46c5d796925c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765494, "uuid": "643e91df-1c62-4cf6-b360-0e00ce57bf14", "comment": "Malware payload", "value": "123c677a38b5c1707b3d32b6d9af71a84191f951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765494, "uuid": "8de4be6d-3629-4515-b93f-998a984fe73f", "comment": "Malware payload", "value": "525a44ad52871a5bf7a5249ddc1c5b3b10ecda33c4190e49c50309001ad721ae149d58da35dcdbc21dbee4ec0093b4d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765494, "uuid": "8d5935b0-858a-4fb0-846d-b106474fed52", "value": "T144A41212E290D8FEC4DAC0B0469FD27BFD767C544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765494, "uuid": "8661c221-4b5e-43a2-9f1f-3a84a2c09672", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765494, "uuid": "2e75d836-f46b-4312-be65-7c767778bc97", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765494, "uuid": "205e3c2a-e165-4185-a04a-8b4ad5b572ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765494, "uuid": "a9c7f7b2-3a41-46a7-8f0f-3b64153f7d9a", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69952c7-3f0f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748799824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799824, "uuid": "a8cded41-4c5c-459d-98a6-6de550e09d01", "comment": "Malware payload", "value": "9cde8a6bab01d52d2065d0f479e68548", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799824, "uuid": "9d7fee17-f5ea-4dca-8a76-c02933856518", "comment": "Malware payload", "value": "e8dab17006948378b94183226f8e2d345a6aeb6688be02e4ee578d4618d9fb43", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799824, "uuid": "e85d44c6-45d4-4517-8495-1e8f50b1b24d", "comment": "Malware payload", "value": "38fab408803fbe65079b66cb5ecbf6686efe9353", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799824, "uuid": "e3a8a620-f699-4bf3-8cc5-1f08032b9748", "comment": "Malware payload", "value": "82686d6f39104f3bbad9dffcb9b959d0e2f9015421a1f46ce384e78be49917dff22e78d8ccb9134e29041c23f987a848", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799824, "uuid": "6e729846-6d8e-41e6-be10-44eb52624495", "value": "T1F251972819F201FEFA738BB897F973F34566FBD29D3856BC108063414322154B4A7A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799824, "uuid": "d0fb85cb-ff1a-473b-be2c-91c4504f5931", "value": "24:8Ayw/BHYVKVWf+/CW9OH14ZfsrkWk7mo6NnpWNHzJm0sHCEJMdd79dsH/nBWq:8y5ayXKrkWk7mlSNTJUiuMdJ9UnBWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799824, "uuid": "0d26b14d-c43b-452a-ba50-3ce8f81998e5", "value": 3090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799824, "uuid": "21ba9147-a37d-4575-beae-d11fc88896b9", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799824, "uuid": "58662001-bc60-401d-bc8e-949aafc73a0f", "value": "lir.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82c0b40-3eda-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748777063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777063, "uuid": "3a04ed65-f8a5-4c6a-9d33-4a5b0a54472f", "comment": "Malware payload (Formbook)", "value": "192e0bdf7feab112b198a711e6cac2a5", "object_relation": "md5", "Tag": [ { "name": "208-89-63-13", "colour": "#6E9F2D", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777063, "uuid": "9bb6aaf1-cc61-4090-850a-1d97a03315f3", "comment": "Malware payload (Formbook)", "value": "e8e2e089aea4a76bbd0ec55ab5530d38c9e84014a305e195242ce0dbbc38e2db", "object_relation": "sha256", "Tag": [ { "name": "208-89-63-13", "colour": "#6E9F2D", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777063, "uuid": "b37b54ba-5d9f-4344-ad97-5a1f051c1e1f", "comment": "Malware payload (Formbook)", "value": "efa8a6c5d3a23d99b09fb8de5f148b7a512ae32a", "object_relation": "sha1", "Tag": [ { "name": "208-89-63-13", "colour": "#6E9F2D", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748777063, "uuid": "9744eb1f-e030-457e-ad96-e1ee486b8b9c", "comment": "Malware payload (Formbook)", "value": "6faba5ec1a2aaa00fa4b757c523d372da20f687233b924238b8321daf3650b8ed6dd443c4c6a66c0745dd546a3b12790", "object_relation": "sha3-384", "Tag": [ { "name": "208-89-63-13", "colour": "#6E9F2D", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777063, "uuid": "1f36d2e7-23d4-4bb9-9dde-bae000b94817", "value": "T1B652540B6D70EF1AC34522B4A6CC9CE5B5EC8B7F84055513B0AC0149A3B57ED8DDA283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777063, "uuid": "0bc8d28a-bd15-4003-8f77-16e9290691b9", "value": "48:3VQ18CgQrJG8CxsQ+vzNHOmMsAMA4wUXwRkd1SLqq+S8Cp3QuPG:yWK3zHNumMsAM+UXBfu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748777063, "uuid": "b532b096-f027-44f9-a8d7-c5802c60584c", "value": 13279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748777063, "uuid": "dd51d08a-d8cb-4bd8-b6ec-ffed21b13b0c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748777063, "uuid": "7efb1f90-6ccb-4fdb-8c39-12c74da3c2ad", "value": "wetreatedthemwellwithgreatnesssgoodformebestsettingsforbetterfuture.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60ed29a-3ee1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1748780012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748780012, "uuid": "85fa3a81-9deb-4bb4-b9d4-2758b7ccec8b", "comment": "Malware payload (ValleyRAT)", "value": "36005542b5753e1136ac00711bdd3aad", "object_relation": "md5", "Tag": [ { "name": "107-148-239-231", "colour": "#DAE84B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748780012, "uuid": "8b37c275-7eda-4b64-881f-f7d44efdf3f3", "comment": "Malware payload (ValleyRAT)", "value": "eaaf446ea22dec624c7fa8951a90db146c7b592fe050affaa0772443d47b3de0", "object_relation": "sha256", "Tag": [ { "name": "107-148-239-231", "colour": "#DAE84B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748780012, "uuid": "0acf95c0-5f73-4697-8c90-82ab186cb391", "comment": "Malware payload (ValleyRAT)", "value": "51ccf43ec6ff71b4f49e4100b7ad7548628e2290", "object_relation": "sha1", "Tag": [ { "name": "107-148-239-231", "colour": "#DAE84B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748780012, "uuid": "51bf69b3-69ee-419a-a4b0-6c2e76caff9f", "comment": "Malware payload (ValleyRAT)", "value": "b44b83d04fff81d9b90fd220a915704412b8d6b704ab1d01cf497f9708d8ef9a3b052036804fa395e31a98191df36bee", "object_relation": "sha3-384", "Tag": [ { "name": "107-148-239-231", "colour": "#DAE84B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748780012, "uuid": "a1c21857-4a52-47f2-a147-5e70ab8e8b5d", "value": "T1AC565B444DA256A2CCACEAB928B57F3FC4FE2D4BBE4F52E10B91FD006A77C644E11506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748780012, "uuid": "57f9c04f-d5ce-47f0-a347-4518966444dd", "value": "9bff82607f72625cda6cf42cdcfab17a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748780012, "uuid": "8bb1220c-7eb0-4b6e-8fad-6b360f69a46d", "value": "98304:bbRKFWlG4+4PzskT+ydGlglZb+JZP5cUqJeySJtCheYHmCkb:4gPzvTHbZaJZuUqJe7oeSzkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748780012, "uuid": "19fb1e38-188d-492d-ba36-4c47fd959557", "value": 6004192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748780012, "uuid": "551efaa2-78a8-4351-9ef7-6bd7d9982241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748780012, "uuid": "0db1055e-798c-4860-8cbc-a10019799cde", "value": "aw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1d2923-3eb5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748760915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760915, "uuid": "a12515f5-a607-483e-9265-64233769bdb9", "comment": "Malware payload (MassLogger)", "value": "575de8fb5c61f3287b70a526bf03f1d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760915, "uuid": "ab760cd1-ecda-4253-99ed-5b5be50b86b2", "comment": "Malware payload (MassLogger)", "value": "eab3ae481434ad602d1daa5b4703c1ce4e6a9be2fa78dccf8ed4caa105ae9589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760915, "uuid": "d6a53548-a8d9-4f7b-8bd6-43e7de9bff0e", "comment": "Malware payload (MassLogger)", "value": "dfda4ccc72861b1d0376d694a5bdbc7cfa490991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760915, "uuid": "a7456396-467b-4fc0-b2f9-1110cd55ac59", "comment": "Malware payload (MassLogger)", "value": "57ccb6f4ce9fc1e01cbff4c15760c9dd894dc050ade18f8e9ea11b052fb11c5100117f34cd04bf8faaae024b5986a1e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760915, "uuid": "dcabc443-ce02-4253-ad22-4ec725145ab8", "value": "T1A893F80937EC8814D9FF8572E67191150B3ABC494926D21D1FD9B8EE2B3BA4089C7BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760915, "uuid": "3a706d29-58c6-4f82-af67-e1b06e4184c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760915, "uuid": "f25802e7-01db-4e74-bdd5-df6cde93b4ae", "value": "1536:xmhwt++eDqZ/2h+hThN/UP/UJS/UJ5/UJpQM5b7YpLN7FMRFZbp4nY:Kwt++eDqF2h+hThN/UP/UJS/UJ5/UJp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760915, "uuid": "b520f810-331f-4855-861d-dbcef0b9bbff", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760915, "uuid": "997a6065-d280-4a78-aed9-2fb2b35620b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760915, "uuid": "43b2586d-4ffb-4cdf-9b95-78de0077ecdc", "value": "CloudServices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74dfb1b-3f18-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748803583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803583, "uuid": "af1f4216-5fd6-4993-bf34-4c98806337f9", "comment": "Malware payload", "value": "b4cedea6fb45d35acbf5cbbe37297f79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803583, "uuid": "d6eec7d7-095b-44b0-b279-08fe84755aac", "comment": "Malware payload", "value": "eaf551877ca4cd5b5b18eb91a891533e3598145ff1a57b9f3037fd61f342f29a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803583, "uuid": "a5c4a068-37ae-4ca7-ad70-beca4340626a", "comment": "Malware payload", "value": "b8c2e6202d90fd9ee3876eb43ef7270789ad0344", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748803583, "uuid": "7259975f-2609-4f47-a91f-2754b26baed7", "comment": "Malware payload", "value": "f89996e3c9d554319e5fbc327c28b4cec9ff2e0c5f8290429e602e98955df6f4f7616e64cad7b0183d7a11a39a823150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748803583, "uuid": "637f7381-4935-4bfb-8656-bc636c65d93f", "value": "T12AA41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748803583, "uuid": "a4fd6065-06ba-430f-9cb5-d7e7ea26bc7b", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748803583, "uuid": "14988c2e-5beb-4619-9f09-fc69e8740b4b", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748803583, "uuid": "a871676a-e227-4092-83a3-93e8f6fc0e3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748803583, "uuid": "f3531a23-fbf4-4aac-81d6-0f130d2dcb02", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0586a7cd-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759476, "uuid": "58f0dd26-cf40-4f98-b905-0b5ac5a127e5", "comment": "Malware payload (Mirai)", "value": "db72c8e321533381f8bb1162e209b664", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759476, "uuid": "5ddaa43b-7f13-495c-b257-5d146874e665", "comment": "Malware payload (Mirai)", "value": "eb7154b9ba8b092802da1e2bd94ef4b2e6083fb9ac61f5d04298400182e42733", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759476, "uuid": "3ab7080a-e37e-459f-bf24-bcadb2e8406f", "comment": "Malware payload (Mirai)", "value": "5b93777f508addf2619e1245d786d294895b8c26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759476, "uuid": "532d8a71-9d56-47e1-8fbb-c69dfda2cb46", "comment": "Malware payload (Mirai)", "value": "19c16d1b6a6f037338ad3fcaed2f65142874380647f0e999f1b97f09b504e76c8cb62d250a47e256b6361dfef0ac1591", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759476, "uuid": "8e12c6dc-73bf-4ebf-b8d7-1f02d4af0d26", "value": "T11C5302DEBDC15A83C62EE6753A0C54E24F45B780A1E8433A9717CCE8F88947F7A4D248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759476, "uuid": "240de97e-616a-4e39-9858-69cc5e617ddf", "value": "1536:2Xg3MF8VCyIkIE/WKV3aAX0/nPG6jgrfHiGfR:2Xg3oy9buKVzkHGVCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759476, "uuid": "ca690750-4a13-4f24-a206-76a2b943217c", "value": 63728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759476, "uuid": "52a12ca7-f1ed-4ffa-b358-ec51660a3215", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759476, "uuid": "a8861a35-fef8-45a2-9b2f-059c01319923", "value": "neon.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f77464-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1748807117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807117, "uuid": "ff946391-7277-4853-b735-5c730499ce8e", "comment": "Malware payload (ValleyRAT)", "value": "b743c8d1533d628c7804653718afbba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807117, "uuid": "cb9195d8-c308-44dc-9a85-0f0bffcac53a", "comment": "Malware payload (ValleyRAT)", "value": "ec254c2d8a4ff02028505bf7c1eb994d24ff30d7395d2057d45f8cb9e4adfb60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807117, "uuid": "47a823e2-d888-4f84-a366-5fe9eacc715f", "comment": "Malware payload (ValleyRAT)", "value": "0ee31f901d540eb3e2e3d647619090f07e112c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807117, "uuid": "81e89c0d-1b6c-40c7-9e75-81de87836708", "comment": "Malware payload (ValleyRAT)", "value": "1a5ba2103d23bbe447ec2dc43e38f2b83b1683e8fbee2ba5b0e6a9d53f16427ba9c2fe1b528db11967e4de4eb120a915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807117, "uuid": "57a92da2-6242-49eb-af6c-985f0d259e9e", "value": "T1D3B46C16B3E800F9E9778239C953890AEB737C550720DB9F17A4466A6F237D0AD3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807117, "uuid": "d28eaf58-2787-454b-ad24-f5d7f4ecf348", "value": "02e48d68f6ecdd5e746e392c3513bbbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807117, "uuid": "cf7609ea-6b94-4100-898c-597773c99c2f", "value": "6144:ZCs3DkYlzQmcjoNwgvZjuUIKmrOwgw+xQol0XAD35m0ampO83rvdcrA:I0kY2LjoeuuUQqdjeKQG5+YV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807117, "uuid": "ad000830-e2b8-4485-9073-8352437cf2a0", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807117, "uuid": "e0855319-a6f1-4fb2-b5ca-6a879482bb1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807117, "uuid": "aa61e02a-e415-46ab-9fce-c9f716fadbe8", "value": "b743c8d1533d628c7804653718afbba8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e62cbdf-3eb4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748760377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760377, "uuid": "8a64a025-015b-4368-b098-e454f89383c5", "comment": "Malware payload (Mirai)", "value": "7711cd8c493e58464dfcaa6c926f1e6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760377, "uuid": "9e290087-0fb4-4875-8923-1bff2c813f8b", "comment": "Malware payload (Mirai)", "value": "eccc52e94a0e1f6c6db321a0dcd77cd16ebd0f15f22cbda986a5ac210fb44271", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760377, "uuid": "ebcc228a-4ae6-42e7-8c32-a101608efb12", "comment": "Malware payload (Mirai)", "value": "4c73da7ae91bce02019f390a939f42fb5cbeb55e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748760377, "uuid": "2cad6e0b-3650-4788-97d8-d5f16b7cdfab", "comment": "Malware payload (Mirai)", "value": "3efc3069555965e199edc9310b1b183d8a15c8c5cc6502a83bde16c4f54306cbfd58a5c8420e5bbcdce909d4ac8ff665", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760377, "uuid": "38858c58-365e-475b-b07f-ff0eee38d86b", "value": "T1D243F1FB833374EDC45F6532A03732C9F58B6B4A5B894B8F1512531E4874D0C8A36E66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760377, "uuid": "87dd287d-966a-42f9-9019-bc676a84b6fb", "value": "1536:j39ZvPWi0gdj2D/EuhNQ/P5CB5JOZ21iSkFqs:jtVWIGEuhi/P5s5JR1ios", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748760377, "uuid": "5a41f0c8-b728-4ccf-92c4-5171df127d59", "value": 60068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748760377, "uuid": "f648bfda-5d4f-48ff-af14-5f6573a8c2e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748760377, "uuid": "31d7d790-4c9d-4cc0-bfee-9db601ff6faf", "value": "neon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac67f53-3f21-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748807266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807266, "uuid": "22697dd2-b4b3-459e-8bbd-21e1bf669f33", "comment": "Malware payload (Mirai)", "value": "ab72d075354a3f215021d2d18e29adc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807266, "uuid": "cc8073f5-0d14-4259-b001-9b9c234be498", "comment": "Malware payload (Mirai)", "value": "ecfd4b23f07e0a6f2a1a4bb47082c282382ac36bf614fd6e2165663da38356ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807266, "uuid": "afdeaeda-9cea-4132-b354-fecb82b05259", "comment": "Malware payload (Mirai)", "value": "19c089bf5f164a5faa45ae4d1d1c433753bab620", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748807266, "uuid": "dec1f46e-22fc-4d37-b801-ff0b4665134f", "comment": "Malware payload (Mirai)", "value": "9837485c59937b77f157f2d0b344b5d3ba23eaec6aca0e0519b074d210654d9d1c9cce37d8d264db050c3cafce7a745d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807266, "uuid": "c5084821-386c-4367-bbe5-c30956f05b7f", "value": "T19873A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807266, "uuid": "ef324ab6-0928-4342-ae85-80c7d40f255a", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStI:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748807266, "uuid": "fe058212-5c10-42b5-901c-df08ef5bfdfd", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748807266, "uuid": "b61e2344-9166-4386-bcb7-5fe9af3dabc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748807266, "uuid": "8f346857-b544-4107-8daa-ebf89360b279", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce76d8e1-3ee5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1748781718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781718, "uuid": "c00ca35b-a657-45dc-88fe-4b9c836815a9", "comment": "Malware payload (Rhadamanthys)", "value": "a9af8da24a0878d4ec63693126452126", "object_relation": "md5", "Tag": [ { "name": "65-109-160-160", "colour": "#72BB3D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781718, "uuid": "2e3f2e3f-ea38-438b-a749-77ddc115eea0", "comment": "Malware payload (Rhadamanthys)", "value": "ed03d68d1696cca4c7e5345f3abbb856762e7c24923bc8f9eb68924c53af1832", "object_relation": "sha256", "Tag": [ { "name": "65-109-160-160", "colour": "#72BB3D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781718, "uuid": "0f09787e-b0f6-4417-9dd1-889208d50832", "comment": "Malware payload (Rhadamanthys)", "value": "f5c48ed53bb79b500a654ee54d96129419a9a13a", "object_relation": "sha1", "Tag": [ { "name": "65-109-160-160", "colour": "#72BB3D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781718, "uuid": "673ba6f6-8e4e-4247-8b64-755172623e68", "comment": "Malware payload (Rhadamanthys)", "value": "0ac29119c6bd702b88655d1ac754b02e1fddb5eea6de64fe080636692039716195c191e129be503d7a5a0fcc4cf99a44", "object_relation": "sha3-384", "Tag": [ { "name": "65-109-160-160", "colour": "#72BB3D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781718, "uuid": "89ff8172-989e-4dbe-84ca-d39f08481e20", "value": "T158E57C21A3D18037D0732F779C2AD6D569297E341E78D84B3FE85A4C1F3AB42A925393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781718, "uuid": "12dd0afa-a639-497b-ad1f-11d047c512a6", "value": "ee34499a62c8c1f492f147723422fd73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781718, "uuid": "eec0e416-498e-42e5-8ca5-59d80cca0af0", "value": "98304:dcOHtB4nctvxG7FhElkk1TRZoueQUM2IUr:zHtB9xKFhElkk1lZD2IUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781718, "uuid": "55ab8c05-2c24-4ed5-bcee-57c920fc42da", "value": 3278984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781718, "uuid": "bfd5c73a-4896-451c-93b7-6dfd2f88949a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781718, "uuid": "fba45027-e927-4635-911e-ca5b1995011d", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12346a7c-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786556, "uuid": "a22eab37-71c0-4254-806e-83fbf2e3d755", "comment": "Malware payload (Mirai)", "value": "4980cfa92e03f54a328bf76365d4073b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786556, "uuid": "d5e21b1b-73b7-491b-8698-0c917f8fc483", "comment": "Malware payload (Mirai)", "value": "ed34c26d99d3837d9a01341f470bb86d4818fe88cdc6fdbc3142aa90c015e842", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786556, "uuid": "72c72e0d-ad88-4242-bd5b-df763334f131", "comment": "Malware payload (Mirai)", "value": "b705d39974a48513011058c7fbcfe64abfba96ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786556, "uuid": "ccd985b0-b052-4046-8b81-c1769b44a9f2", "comment": "Malware payload (Mirai)", "value": "af1ea4f0eeaf3c825bfda509371504024b53274e59e2c8f998f29ea65298e071a459eec3ed15d72166317c684773e682", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786556, "uuid": "b0edc480-d1db-4c59-b7d8-2a57f95a22e9", "value": "T10A03E10FDB2B6AB0E3850B757D759102BA400A7C8AFD20C10516A65C7CBB84BFE799C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786556, "uuid": "0659312b-c738-4943-ba72-4091d98b04c7", "value": "768:vj7ln3odAZo+w6KWRNWM7093e0mHTrmqsrprm8zs0V6jRLy9q3UELjn:vFyYVKK70pPkT8zs0V69rLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786556, "uuid": "5630f001-d548-4c9e-9aca-e0234f14e09c", "value": 39196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786556, "uuid": "8319d8f5-61ab-40be-aaf3-896a21c753be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786556, "uuid": "a118188d-5f43-4303-9681-807cb1c9cfc0", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77d9411-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748800255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800255, "uuid": "fa52fd66-dbba-42b3-b7cb-83f1f8a0528f", "comment": "Malware payload (LummaStealer)", "value": "48567eb7ca3559aff46bdaa3a9e390a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800255, "uuid": "faafbf2d-2b21-4ae0-8ade-752a2defeae0", "comment": "Malware payload (LummaStealer)", "value": "ede8c03821cd860c840bebda0270c7f2c0d689e4307ef961e38d66872dcb5540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800255, "uuid": "b2fc4a0a-9fab-460e-ba41-9142d656fc83", "comment": "Malware payload (LummaStealer)", "value": "8383d5ccb1e93ad9f93025f248040906691db556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800255, "uuid": "f4af2bc8-65e7-4bfd-98d2-c328aaf4f126", "comment": "Malware payload (LummaStealer)", "value": "8473c05a3337d289c4f1980e6ab42ced6b4ad00cad78a68af40f43ea4f966d7fcaa2ebb167af3ba9c7282e1a01fbf2c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800255, "uuid": "a14662ef-957d-41a5-8f72-73f10b103fe8", "value": "T1658533277943603DFD04D6BC306E2B699B229F88FD34C47F6F8A669D4AD7C152628431", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800255, "uuid": "2341edb6-f419-4998-8b1e-737ec4b455ce", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800255, "uuid": "abda30a1-faee-4f61-ad93-5000d833ee5a", "value": "49152:PRSYigG+R5yqVpzcr3AlFqtkneFrp9TECXZps0F6p:PIgG+92WqMknLs0F6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800255, "uuid": "cf18df60-ec8b-44ea-b100-6c8bf3eefe9a", "value": 1860096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800255, "uuid": "a47568b5-f38c-4399-9849-c1265fc360f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800255, "uuid": "788ee3e0-d2a5-47a1-8b39-f4ae592f018f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413a8a82-3ee6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748781910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781910, "uuid": "e199b2ae-f1e4-44b5-ae3d-6b566c3aa7b1", "comment": "Malware payload", "value": "219fff592ecb216f8e6144b425f25f79", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2098", "colour": "#459A23", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781910, "uuid": "072fc09a-ca2a-4fd5-8109-5cb0fd79a73d", "comment": "Malware payload", "value": "ee5f62a7dfae44802ed269382ec69bf4c25a6d906976e6947b36df6ddb5ff2b0", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2098", "colour": "#459A23", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781910, "uuid": "e8b848a5-1008-4884-a93d-1b08b6675c76", "comment": "Malware payload", "value": "2fd04949862948aec75e18ecea0866dd8c7527c7", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2098", "colour": "#459A23", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748781910, "uuid": "439081b6-d2b4-41e8-85e9-9b634d83cb79", "comment": "Malware payload", "value": "e04ef60dccbe336c676147898c37f18dc2451e868e6e08c4a65195e353075f80ec2063fc8a8d1eca46a970a3a2d8bb1f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2098", "colour": "#459A23", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781910, "uuid": "eb8908aa-6ad8-404f-beb5-0975d9bb9e91", "value": "T1153633E45C0B0BBDEA0589A2AFB18529CDF7CD1B985C4D05B0E7E42B34061CE89DFE64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781910, "uuid": "cb034e2d-cacb-41a2-9672-51506cc1bcbb", "value": "98304:tdtLKRm+TNdIRyVYWuXhR1J1qoQQZbIkCoAEMcLf8yZC2FzcX0ABuPvYvJMK:tdtSmMKj5zqoneypFK8viMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748781910, "uuid": "bb905451-c173-41cf-a473-1ec6409223a6", "value": 5200440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748781910, "uuid": "1228c1c5-cb40-4f6c-a91c-9a6baf7e2560", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748781910, "uuid": "1ce9d525-5e5d-4e68-bb8e-3e74e6d75a94", "value": "\ud83d\udcbb\ud835\udd74\ud835\udd93\ud835\udd98\ud835\udd99\ud835\udd86\ud835\udd91\ud835\udd91 \u2758 \ud835\udd3d\ud835\udd66\ud835\udd5d\ud835\udd5d \ud835\udd38\ud835\udd54\ud835\udd54\ud835\udd56\ud835\udd64\ud835\udd64 \u2758 \ud835\udd43@\ud835\udd653\ud835\udd64\ud835\udd65 \u2758 \ud835\udd4a\ud835\udd56\ud835\udd65\ud835\udd66\ud835\udd61 .7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50ca70f-3ea8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748755449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755449, "uuid": "f4581d67-5eef-4210-93ad-ebc6276b6f5b", "comment": "Malware payload (CoinMiner)", "value": "6a8caf67ce017622697da8f086318587", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755449, "uuid": "95aabc61-b009-43fc-8f07-aa367989fe11", "comment": "Malware payload (CoinMiner)", "value": "eec5acc36c84c9e4dbb5b54dc612816aba8188f8ac0e523d9dda8544d5ba6d15", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755449, "uuid": "af3e73fb-95c7-4cc4-b0ec-bf5deb541ae1", "comment": "Malware payload (CoinMiner)", "value": "5a78358b895d20a6771708705501c44603801d36", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748755449, "uuid": "7f25157d-6b47-41d2-b26e-4a6819f9ec92", "comment": "Malware payload (CoinMiner)", "value": "0faf328395ee46744f71de7d7ef483bdcd22dbdb310981bb1039487762633380673c0fa604eafd52d468514fa6af2c47", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nikalopoto-com", "colour": "#063018", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755449, "uuid": "400c82f8-5377-426c-999e-ee9bdb8b3454", "value": "T12CB5B717EBB611D4E0BAC138D553222BFC7134A6833897DBA6C59E4A1B61BE4ED3D340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755449, "uuid": "96b8d7eb-8b72-4d23-849c-181bd05dfdb7", "value": "86373b33412830d721c8c700d3413f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755449, "uuid": "ed5e5cc4-f32f-4972-8c45-e4d2f859847b", "value": "12288:Au8b+mYZElJroePssR9/X26vLr5VBJwLTgyg/RasKhy7JX76iXhNFAcKaHMO3eg6:9EYZeroosc9/XxDlay7JrLFAAsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748755449, "uuid": "94ed34cc-1502-439b-be2b-af320c2749f0", "value": 2423296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748755449, "uuid": "b9388512-f4b5-40b6-b36c-487b537d5a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748755449, "uuid": "1e4dd200-ac8b-4096-ae9e-191af8fbbfae", "value": "DropperV1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd89526-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748744776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744776, "uuid": "b3027038-2cad-47b1-b182-2cc62ca3a4d9", "comment": "Malware payload (Mirai)", "value": "fc03dd7999d53e2acaf26d8f7eb0aff7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744776, "uuid": "991851ea-700d-4fce-9177-80e825e098c9", "comment": "Malware payload (Mirai)", "value": "ef627a310ae3cb8ef20796e3c033edfe9b74b27c92b69ec42c33d38134531410", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744776, "uuid": "fb9bf0ad-443e-414b-b69a-52325a9a378a", "comment": "Malware payload (Mirai)", "value": "80bfe9f2b01d70559f781a2ff485b4f2244e43fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744776, "uuid": "8a17fb40-53e2-401f-a59e-4e6d6ba56bb8", "comment": "Malware payload (Mirai)", "value": "560c0a9f5bd8ea38651dff67a3207a9d4b9b8fbec7d0bda1dd620578e7eff1ff6aea56c3d915f7d77f4db40d05cfe034", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744776, "uuid": "078de7f5-fca3-43c6-aa71-848fbc9b023b", "value": "T115230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744776, "uuid": "ffcca097-28f4-4225-927d-2af8118d2998", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THj:5DmKF7Gxyk8cqoHAmWurAufsG5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744776, "uuid": "133304a1-c138-4d0d-962c-73223cf409f3", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744776, "uuid": "838761ff-2d24-4deb-8bba-b6bfe2b50f06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744776, "uuid": "fb66692c-0107-453b-a992-3a5a102f85ad", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bffa66-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759768, "uuid": "c4d4b92f-cf37-46aa-8a14-c07edcf6d27b", "comment": "Malware payload (Mirai)", "value": "28f540aad14cf3a8078ec71ba9196aba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759768, "uuid": "322df2f6-4f7f-4659-8cb6-4b7922effd51", "comment": "Malware payload (Mirai)", "value": "efb13f47de1e486c91fe28d6b1313fc7cadbe689e10837c1a71c5c4cd54c8d0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759768, "uuid": "dd6489dd-444b-44e8-ad4f-4a1da23afc99", "comment": "Malware payload (Mirai)", "value": "89fc1137aa49e5bd624f62963fe5c08700454c13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759768, "uuid": "656488dd-58ab-4bf0-b688-d4deff08e833", "comment": "Malware payload (Mirai)", "value": "ccc7beb859761fb5225a8e9557afa9fd75285a2eb64ac397728e5e11a893bdc64ee6ce98c0bcb1c435d63f79ce29193c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759768, "uuid": "ec03f329-1195-4ef1-8eb8-c38717559fbe", "value": "T1F9B39DAFF2475691C86247F007CB8F9E3E2323819F57D4E36C1D2A7929762CB5902B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759768, "uuid": "97b22cd4-8099-454e-867f-fcd6055a4a4c", "value": "1536:zkB6UtH3eSw/pRSyPWx3lBiQsCPxxVq4Nk3gX/LWS:z/yuSw/pRx+x3TsCbk3gXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759768, "uuid": "27f515d1-1370-4dab-881c-2bd5b180aa40", "value": 107836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759768, "uuid": "207655a6-1985-4e51-b85b-319bc9bdf6eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759768, "uuid": "6a2fc2df-796d-485e-87f8-85c45baa35c7", "value": "neon.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9422355-3eab-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748756825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756825, "uuid": "e9c58a60-6417-42fc-a312-75376c7ddd0f", "comment": "Malware payload", "value": "44f765b23667891a8db4a6200ff3539a", "object_relation": "md5", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756825, "uuid": "06b44de5-a04b-444d-be1a-ec1085cfa100", "comment": "Malware payload", "value": "f170b9b7d57c277865f99872488f846c92f9fa581c0dd9e1c5f3efd3bc43f2b1", "object_relation": "sha256", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756825, "uuid": "62bc9e99-08b5-417e-b725-81704550eccb", "comment": "Malware payload", "value": "ecb25245a562f7a68c0bfbb41d7bceb24c6b8b5d", "object_relation": "sha1", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748756825, "uuid": "94018cb7-b026-4bd9-ae88-73d8c694ad47", "comment": "Malware payload", "value": "dcaa91a701baa9da3cd8b1c969fdec1725f3e3f80a67cb22926e65d2105977fd7a38baf4f54143cf903b1b6e6a734fe4", "object_relation": "sha3-384", "Tag": [ { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756825, "uuid": "f4db73cd-dc58-4aa7-b5cb-02ab4b6f7c71", "value": "T167835A52ABEA2108B1F6BB88593A05344F277CC96C7DC55E05CC6A4D1BF3EC4D860BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756825, "uuid": "a07199b8-1a07-476b-8333-7864fac3d5e9", "value": "1536:9tDa3LRV0ubIGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDpOAWGPrbrbTDDpj:/DwVJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748756825, "uuid": "3e5c0f2c-c098-4190-8c4d-11690c742f8e", "value": 81700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748756825, "uuid": "2d248edf-62cb-4ac2-85e1-10eaaea0ffcd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748756825, "uuid": "d658a8ec-3e3f-4b1b-9c84-1b9a073a02da", "value": "30000524365985F5PROCESO4H65F4H6G54HH556565451 - Copy (3).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542cdd12-3ebf-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748765192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765192, "uuid": "ae267809-3023-4ccf-96d9-3153669dcd32", "comment": "Malware payload (Gafgyt)", "value": "103da1e4b85ade8e8774d7d2212984b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765192, "uuid": "deb77eb6-d817-4cc3-b406-a2d88ff2c1be", "comment": "Malware payload (Gafgyt)", "value": "f1b01aecb55b5258c79b6bda7eb47bdf65973de12ef02fb800bfb7980b59bdb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765192, "uuid": "fec70a22-34c4-43d7-9b1d-300ab145ffa9", "comment": "Malware payload (Gafgyt)", "value": "af39a0befb9bf97e86c7e9c7e5294159ee35497f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765192, "uuid": "8c79db41-33ea-4aa7-af9c-1758ef056f28", "comment": "Malware payload (Gafgyt)", "value": "3fc86c057e55f3a96dedd6b03a21467bb08b67dd71c6cb4ba37959f24fcee2805fb1ca100a51221c1a9b3af220841319", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765192, "uuid": "4b247e44-6a77-4c86-8dec-e0e3f5ebae95", "value": "T1E4933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765192, "uuid": "b59f68c1-2ed9-4a1c-bc2e-e5daff50b27c", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Nl4umXxVqDrstKfz9e:Q97vk51RcG7Abl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765192, "uuid": "47fe5514-5438-466c-98de-c87a78ec1149", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765192, "uuid": "0dda76d0-2648-4999-82f4-a4538c504b85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765192, "uuid": "25641ce2-85cc-4cd1-ad43-19906e2a51f2", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9735818-3ec0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Akira)", "timestamp": 1748765871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765871, "uuid": "c44f30b7-7914-442b-9af9-3c8ee8f00f1b", "comment": "Malware payload (Akira)", "value": "1846d5e033ab5fb00573300dc8abb992", "object_relation": "md5", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765871, "uuid": "89c003fa-2b20-40af-97e4-6b0a3f66cc79", "comment": "Malware payload (Akira)", "value": "f1b02c1a8b83d1c3be8009577b0c95e71f99b87a1491023357e4ecb9109b2e26", "object_relation": "sha256", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765871, "uuid": "fea94761-fbd0-446e-8fde-aef29c0b8205", "comment": "Malware payload (Akira)", "value": "7c42d5563918402bc0b75b5678cd9f72fc966d00", "object_relation": "sha1", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748765871, "uuid": "9f5be6c1-21fc-4101-b144-9df81b651835", "comment": "Malware payload (Akira)", "value": "b1cd26076d4f26a06b7884125aaa06b616658bb36930c530e55748378452be64ae23624f9834dde1fa11db5fbc2d9496", "object_relation": "sha3-384", "Tag": [ { "name": "akira", "colour": "#B9F756", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765871, "uuid": "c3cdbfb8-30b0-48d6-824e-91a861fa87b7", "value": "T1F884232A5CBE6975D58883B34A12C6AB6C7545DA241EC6A0E773D6DE30303B73F1132A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765871, "uuid": "7f20883a-0a2d-4509-bad6-91f0f246e35d", "value": "dac3ca82d0f2e3741657040eb5964e1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765871, "uuid": "bf55f249-5d82-4f4f-913a-6124f8df83ff", "value": "6144:sPgSkQKLPu02UTsR9/R4jT3WU+Bq8DjVws9nDXybHA0B0W6sP77uvqA1M:sPdkFqEktiuPq8Djl9rOKNvqA1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748765871, "uuid": "67d2ded7-149c-420f-a597-7a2399d72df0", "value": 388672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748765871, "uuid": "ba36596c-3eba-4a18-8251-36c03919dbea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748765871, "uuid": "72ff751a-f7cd-43cc-98b5-d3ca710ab6a3", "value": "f1b02c1a8b83d1c3be8009577b0c95e71f99b87a1491023357e4ecb9109b2e26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200226a9-3f0e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748799034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799034, "uuid": "d138e62a-d1c5-4081-9979-157d6a63b8d5", "comment": "Malware payload (LummaStealer)", "value": "f4fdb91f238c6f46481473da9ef96559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799034, "uuid": "0b039353-6fa2-4da0-a70a-8c91b6846832", "comment": "Malware payload (LummaStealer)", "value": "f1dc644c77caf93b92e4cbcd14996d2102d7084a6392af9147b445d17d205853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799034, "uuid": "ad7b5fb5-d6f2-4ad7-8bd4-2d618f8909a0", "comment": "Malware payload (LummaStealer)", "value": "e29bba5748640323e92e5d87c513890edb7bb694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748799034, "uuid": "ca48d454-6fdc-4777-9461-467b0b6d4d7a", "comment": "Malware payload (LummaStealer)", "value": "ce707c469a125110240c7da6400f33c17f8da9988939b867a82b0ab67427b6c802cef4bbe8fd16a4109bda5838654599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799034, "uuid": "1b82adb8-b375-4dbe-9efe-bb8590980ff2", "value": "T17075BE399152A1DAFC6600BA45B162987422B333C63C2FFF4290E333AE07AD55F6975D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799034, "uuid": "4c63f31b-d477-45d3-a83f-426360eedbe3", "value": "bb36df4412e03dad091fc4f040871a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799034, "uuid": "30c3eb6c-392a-444d-bf1a-242bb1605063", "value": "24576:8S+WKRZXnrzljjjr05TrVIydQCkIcHsaUyXZNKlGVoTXkTjbIfzgJPAZU4AdIfzN:ijAbIy9lcHsaU8VTj7WfQWf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748799034, "uuid": "93be3c40-3861-4208-bf3d-41bcc71a3276", "value": 1649152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748799034, "uuid": "1ee7ce1e-a793-49ed-894f-5fa80fa3d9c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748799034, "uuid": "6dad05d5-c9c9-4605-8c0f-0acb909f825b", "value": "f4fdb91f238c6f46481473da9ef96559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c43e06-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786562, "uuid": "712bc208-c8d3-4f38-ae76-905702eaa0c4", "comment": "Malware payload (Mirai)", "value": "a983e0c97c4bce20430f0cac203c34e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786562, "uuid": "d7fce184-ff25-4443-a7e3-ed28028999e7", "comment": "Malware payload (Mirai)", "value": "f357587e91ada7fe319e4b6d58f18d56b8e21b195909680300c1045dca189f01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786562, "uuid": "df3dd953-83ee-499d-aa81-c912f8875b46", "comment": "Malware payload (Mirai)", "value": "ad43fdea60bab17cc8390bede33b6c96143eecfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786562, "uuid": "bf71e8d9-272a-46c6-8b8c-1ca56934160e", "comment": "Malware payload (Mirai)", "value": "a64068b30c7d9bdb63c4e4b5440d9b021576b5001dbd61f4563a222881899c99bbe2549a7e352a55368523dd195a0185", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786562, "uuid": "9f41e49b-d6f5-47e7-a61b-cef1880a7750", "value": "T1D3B39DDBF2470160C8624AF007CB4BED3E2723815F27C5E76C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786562, "uuid": "c29437dc-55f4-4b7a-9ada-03b052b30838", "value": "1536:xu27gBY25SSpHP9pEFwiLShWnwg1v/LWK:Y9zSyv9HiLShWwg1vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786562, "uuid": "d45649aa-83a3-4b13-9bf1-843c22663feb", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786562, "uuid": "f5d87f0d-46d6-4500-9fbe-d7cffc8925fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786562, "uuid": "3f940e6f-c93b-47e7-a809-8084efe88d7a", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63eccd6e-3f20-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748806879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806879, "uuid": "a44e6628-3b7a-4616-8cbc-27f6a8b632e2", "comment": "Malware payload (Mirai)", "value": "c4b08e078fa102f44f18ea8d136c2224", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806879, "uuid": "022b0fde-1a65-406c-8507-66dda93a33d3", "comment": "Malware payload (Mirai)", "value": "f4ba223e4fd6645fbf85cec88155f5b98d85fd58929e94c0390edb308e6e822d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806879, "uuid": "c48dc97d-bb7a-4543-9329-1ef4bcc1c109", "comment": "Malware payload (Mirai)", "value": "df76dfc0e3b51d629116c3bfc3d035aceb9c7cad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748806879, "uuid": "a4a1b34e-8ff3-4560-bf88-dd2f683b7100", "comment": "Malware payload (Mirai)", "value": "19f3fc37b9566da4841b1d9fd8e770aeafae2e244f57c029e454bd519e481e3a8187e80d334c922b69bf4bcec13b64c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806879, "uuid": "1e87014a-f1cc-4210-a416-b72564da4dea", "value": "T18FC2D1E07726FA31C420AC3DE52B4D893A51067C91FF393764158D399FC1A9B63E44BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806879, "uuid": "9a0f2da1-9bd4-4a7f-9dd2-9cd589b3fc49", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrl9q3UELuC:OKy4qfqoeJdXWg4Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748806879, "uuid": "910dfaa5-80b3-4cb2-8771-b5cdb1d402a2", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748806879, "uuid": "4b2d8c3a-de6a-4630-991c-797adc90c6b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748806879, "uuid": "6b786634-7db5-4e53-a0ee-d8f7deb01c42", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538e9720-3f43-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748821884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748821884, "uuid": "0455b5ce-1443-4071-95d2-2c163c13a3ea", "comment": "Malware payload (Mirai)", "value": "9fb684a57d1fc35bbb1a6c58e67c2eb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748821884, "uuid": "b3e08cdc-1497-4908-9c49-c437f2a3a7c4", "comment": "Malware payload (Mirai)", "value": "f4c365a94b1f4d8f74e2bc11aa63207f530b92e27aeac8cea2f1d7d4cf90bf41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748821884, "uuid": "058ef96f-e589-48fe-9072-853f647e1624", "comment": "Malware payload (Mirai)", "value": "3772d7879530266089a36eedfed6305dd684ac61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748821884, "uuid": "46e6a4d0-400b-462c-8202-ffd59e588acd", "comment": "Malware payload (Mirai)", "value": "f3dd5c993a01c1d76f60f96e3711af52d09461724c55a31c794d486cba2585a7e1214d44ccdfef79998645340aeb248e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748821884, "uuid": "356ad3f4-6046-4156-9fa6-a616dd30a9c8", "value": "T18F232B42722C0A47D1A65EB0393F0BE093BFE99124F4F6886A5F9B468535F371186F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748821884, "uuid": "15fc7edb-3b00-4f88-a508-d05a8e8692af", "value": "768:m0tc4n8iAxt1V+B1cNsG/Res7bfGMmD253nhhVLoxhoXRhed:BvAxt1V+BaaQWu1i+XTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748821884, "uuid": "81986842-58ee-4d5e-94b5-5a1fa761a4ad", "value": 47644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748821884, "uuid": "73fda420-bd98-42c4-bbc4-b5bb0bd00182", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748821884, "uuid": "22804732-3bb7-49b6-bfd4-7b2b59ee0d0d", "value": "hoho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84bd2e1-3e8f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748744851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744851, "uuid": "d7bcd2ba-61e6-4b0c-b05a-b187e67f269d", "comment": "Malware payload", "value": "869d7cb4affa757366fdc7e2eed197b1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744851, "uuid": "22dfb8c9-1bf5-4bbd-8c70-6df2a8a0372f", "comment": "Malware payload", "value": "f5e2be66c6681948fd05033b46a82956232a740ec0b1146176c017ea842bd562", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744851, "uuid": "1e808e20-1a25-4e9c-9a55-2b2ad9708507", "comment": "Malware payload", "value": "8a894023fab1590c0276d5ccdfed055ed8dc29ce", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748744851, "uuid": "5c6efa4b-6c9e-4bc6-acc4-c0a3cf7fcf93", "comment": "Malware payload", "value": "c1650988fe7980e740c9a3feca03c3b69f71313b3d37bf7b8b065d4f28269c25cca2d43b96d9bc8a586b61bee8b4ea91", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744851, "uuid": "6169914a-d147-46b3-8e39-9b05fddf08d7", "value": "T159562242E3D9BC1FDC7386370BAA4A6A514B9D86C116D3178825B29C4DFBAC08F91FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744851, "uuid": "f164f457-9190-4b4d-a846-5f7e45f1c407", "value": "98304:LLY2alAzWOaYlHEufXiCXxUPmPImTPdTsFZFcOCOjUAJutmpx69yG:LLY2alcWOlDfiGxUYNLdAdcOCDAlz6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748744851, "uuid": "3aef89be-e33a-4357-86c6-628ee6953893", "value": 6005856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748744851, "uuid": "e9727f72-487f-46dc-8f48-5a948962a8ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748744851, "uuid": "ecc22b2c-207f-41c9-b5ce-5198653e5238", "value": "pm kishan yojana R14-1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029bd9dc-3ef1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748786530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786530, "uuid": "f6de326a-3b17-4894-846b-628d6577ef28", "comment": "Malware payload (Mirai)", "value": "8beacd2928c835de5ced2ebebdc12f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786530, "uuid": "c65b801c-6ea6-447e-b68a-e5898c130dd8", "comment": "Malware payload (Mirai)", "value": "f8b6e813375dbbb71e7564b3f498f8276658ce142c82c177f3f59dd4d84c5260", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786530, "uuid": "a44868e0-f9b3-4291-85fb-c4848ce53a3d", "comment": "Malware payload (Mirai)", "value": "5de6c6864e01a027fcd9e44cc0ef22e8ef574466", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748786530, "uuid": "c2547012-b432-4ddc-90d0-2a37308cc6c9", "comment": "Malware payload (Mirai)", "value": "0a8d66b032d269892cc258dc2c51fcf1375b3a3fc30a61f3d4958903a182a1826e3f6ba471bdc3b1dd3c2abb8262e1b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786530, "uuid": "2d95cce1-f4c5-4113-a081-347230475dfd", "value": "T14EF2F1110736CAF0D2E016F4B9E68E7B66656AFEC56938256420817DDF96041C9BCCC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786530, "uuid": "50f115b3-c59d-4c40-8d12-3c59a1ca0411", "value": "768:67cUFTgxhS+UOX/dlcPIy7ICUZx+ocvns3Uozv:6TyS+jPiIgUZZkazv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748786530, "uuid": "680d44c5-e27e-4869-bc84-e84d7af37be0", "value": 36316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748786530, "uuid": "3a09c62c-605b-4940-96ca-f13bff1317da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748786530, "uuid": "a72ea8fe-1709-4b49-93e5-22371f9765a3", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1172770-3f40-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748820726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748820726, "uuid": "1094c683-090c-46b6-9a87-0a7e70865277", "comment": "Malware payload", "value": "d7cb7949ea9f5d8e4648fe381bb39e22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748820726, "uuid": "029d1a75-63bf-4acf-940e-720116b6a87e", "comment": "Malware payload", "value": "f99dd1d54a35253968feaf595c780a56b08b4bb73e395449b6f201ef1a5a5ad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748820726, "uuid": "bf5a1b51-21bf-4277-972f-3fd75b506332", "comment": "Malware payload", "value": "bd41ad0d88e925d2118972eaf83c427aabc9446a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748820726, "uuid": "27fcb46e-a417-44c7-9d4a-4e939d9a8613", "comment": "Malware payload", "value": "326d7d8f5b1d7a2a47aacc7a9ccb0186dd30839f379ceebefae341ebd337131f9ad60061ebebbf84f70de1d015c71438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748820726, "uuid": "765253d9-f9bf-4f18-8f88-6e15e398d200", "value": "T1D2A35D20679C9F19EAFD1B74B4B2012043F0E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748820726, "uuid": "878fbe34-602a-40ae-89f5-5eeeb0e7759a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748820726, "uuid": "e3f1117d-4223-47da-9195-8c0742b55510", "value": "1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2O3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzdYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748820726, "uuid": "f56a5591-84ce-4836-bfd8-8575ed4eb3f6", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748820726, "uuid": "7933f137-8225-4865-b6b1-1fe7a0852287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748820726, "uuid": "d422210f-f5be-48cd-b314-980dd26f797c", "value": "Implosions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77473d5b-3e90-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748745064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745064, "uuid": "57c683df-5d13-4202-8085-28de53b3f944", "comment": "Malware payload (Mirai)", "value": "ade84e0b6a5433aacfe65714948ba307", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745064, "uuid": "9673a847-c95e-4ae8-a93d-4cfb34aaca1b", "comment": "Malware payload (Mirai)", "value": "f9e28cf7e0210611db340b3196029bf94e27dd7686a5db08bf5f0d8d239daa48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745064, "uuid": "fed40ba5-dc48-4708-93c1-1704299a25f3", "comment": "Malware payload (Mirai)", "value": "a9dbc5533480f5b41e41dab99d15773d5738fddb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748745064, "uuid": "bd7a83f6-6319-406e-a03e-1b0473a5bb83", "comment": "Malware payload (Mirai)", "value": "0c829fcfdc381eea3b92d471b8cc08b6e1486e6115a4527f22171dacfc699b593aff3616899b55348c1b3446429a2cdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745064, "uuid": "cefcafe1-c615-478f-aafb-086da10dfe38", "value": "T1A3230271850E8EF124303C76DAD5D39376E12AB1C6673023DA280A3C2FB97531E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745064, "uuid": "3bfee8de-5d16-47e8-8749-800e642eff96", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3T9q3UELbUXfi6nVMQHI4vcGpvE:DECFd+A6YHAxSLRQZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748745064, "uuid": "6460f3fb-c727-48b1-a3d8-30ce78e7f989", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748745064, "uuid": "74c08cfd-36a6-488f-8982-8b2b43733039", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748745064, "uuid": "8544aef7-e630-41f1-91df-eccaff5d8d16", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4069f1-3f10-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1748800048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800048, "uuid": "34e72d09-213e-480c-8f2a-e825d70d1302", "comment": "Malware payload (Amadey)", "value": "c1db4d5de8869f1beb76fc6d35037b1b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800048, "uuid": "4e0da43e-8405-43a7-83e1-bc5b1128f67a", "comment": "Malware payload (Amadey)", "value": "fb3f5e041ad3d2ebf299fa9003cc585bab38911dbd414823fc628e40458de532", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800048, "uuid": "7e20571d-29d2-4320-baa8-25fda4ec3cb9", "comment": "Malware payload (Amadey)", "value": "418f0ab1c57f91d90be4c2e3f5b834f3bf6ab554", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748800048, "uuid": "ef298940-eb3b-44c6-a28d-4bc21cca1502", "comment": "Malware payload (Amadey)", "value": "bb3d15603ae9f941cc36519a9a52c23dec2a665e7a7b6c426ed376151d5227d59b211d21adde6d44aa2e6c7518907d04", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800048, "uuid": "382702a2-9ca9-4071-9186-4d994d08a679", "value": "T12EE55DD26A0975CFD08A137C6627CE8269AE43F88B2109C7DD1DB47A7E63CC126F5C25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800048, "uuid": "1d7605fa-780f-4f31-a888-bb2b0d40a47d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800048, "uuid": "5acfdcd7-915b-4799-afb5-ae83fca06ae5", "value": "49152:0/V3HmzL1ImdzVh1KQuFshve2JkV9xZ4CpY7Y7:0/V3Hmn1Imdzrwshve2sCU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748800048, "uuid": "e1535cea-526c-4440-949c-619217672639", "value": 3109888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748800048, "uuid": "92b82d0c-7f06-4eff-91c1-44f5e44b9aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748800048, "uuid": "d875f7a4-5cea-4d56-b85d-033d07e4f7ff", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4e3688-3ead-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748757664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757664, "uuid": "da96c289-c6ea-4713-9357-f86d6252120a", "comment": "Malware payload (Mirai)", "value": "ccb4cd662906d887404c58f9889d720d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757664, "uuid": "46ba7c3e-d493-4093-9c8a-4041e800c74d", "comment": "Malware payload (Mirai)", "value": "fcf5a220f6bb3dcf08ad07441c2a6d49a3e16b126231d22794fe5d55f5fe38cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757664, "uuid": "bac712c4-2577-4455-bd03-6a5882a61dfb", "comment": "Malware payload (Mirai)", "value": "c81ccc28dc820055949a865d1bf5de39b4c01dbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748757664, "uuid": "00ac5c1a-0fbd-4719-9d03-e24440b3a35e", "comment": "Malware payload (Mirai)", "value": "3d8e273aba3a058dec13350509e328ae3855687623e702186609f17af47fdca53dd3e7683e2f69ebe18d17e123d449dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757664, "uuid": "a85f1ba1-78fd-4e92-b133-42d3c165dfff", "value": "T143F2E01760A07E7AC5381832FB3ACDD78A565D78E2E83DB22B305556B1C21087AED393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757664, "uuid": "434cba7a-8e42-4489-a449-87258735d593", "value": "768:/HkvMvhBZKG/amjUNUq7As96GF3dB55ZLI0s3Uoz5:/vBZvy7t7AczFL5nMRz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748757664, "uuid": "225466ec-3f99-4ab6-89d5-2bb219c9f02e", "value": 34452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748757664, "uuid": "e5b18630-81bd-47b1-aec5-4652a90d3b2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748757664, "uuid": "b9b3aa7e-d8ee-4667-bcbf-961da04980be", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5214df-3efe-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748792183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792183, "uuid": "72868da5-4e2a-4bc9-bf7f-cd1f0058b8bf", "comment": "Malware payload (Mirai)", "value": "8b8b4596fc8383cd535d0ddaa0b95d0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792183, "uuid": "2245b604-7f15-41ca-898e-ceba51dc801e", "comment": "Malware payload (Mirai)", "value": "fea83f249a9660ca085aef8b43a63b259ddb2eecb59d7c7c551478996513266e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792183, "uuid": "2ddf7f58-ef9c-42ea-899b-728464616026", "comment": "Malware payload (Mirai)", "value": "f0f4341234b26ff7a8f3b4a7b97069309bb2a37f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748792183, "uuid": "3b47b773-6858-4c93-bce5-88c0459f67da", "comment": "Malware payload (Mirai)", "value": "69623e60b206f51f5dd2fcce57cd9f72b82342fe409d86fa7a56e4caed319503f7d7ab72d8a952102849d61e2dece885", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792183, "uuid": "6b4c6fb6-82b4-4625-8bf4-f687aa266b18", "value": "T196335A31B97A2F17C0D4A5BE62F38324F3F5165E25A8CA2E7C620E4EFF14A4065476B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792183, "uuid": "8dc3f19a-29fe-4ccd-abfb-5d47638a224d", "value": "768:ePoqqFPq9Qr0dn4Hte8KkblF7Co8ofvM0zO+yoveO:eP1qFPSQr0dn4Hs8K07tHNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748792183, "uuid": "1f7916f1-36a6-4cdb-842b-00643daa7ee1", "value": 52668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748792183, "uuid": "7de01aa3-5875-46b5-ae6b-566b64a524be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748792183, "uuid": "430a7a07-d9ab-4174-804c-67474f585580", "value": "hoho.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85d5c05-3eb2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748759776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759776, "uuid": "440b4894-5ed1-494a-900f-463e83b507c4", "comment": "Malware payload (Mirai)", "value": "518d884cc2fea755bb0764259bf9bb1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759776, "uuid": "e8fcd76c-a41e-4f9b-9410-8d6d22155c1e", "comment": "Malware payload (Mirai)", "value": "ff571c4eb73071c6e8c0a43ff1946bb1a8e530d1153d20161d7256344b21d5cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759776, "uuid": "3d8062d2-7d8b-4c55-8230-d70d713ed483", "comment": "Malware payload (Mirai)", "value": "1e5bec3aabfbd8960dbd1ebc248b123869353292", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748759776, "uuid": "7d391662-188c-4f94-aea2-b3ba5c8f829c", "comment": "Malware payload (Mirai)", "value": "3b580e816b210faedfb82647dc7f2466736609763ff958eefbf7ce2fd250f80b6ab0fbd27b431c75f6e70ee7e60802ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759776, "uuid": "545d4745-6539-4228-97e7-6aec5b6bae9f", "value": "T15F03F656B8928F5AC9E022B6FA6E516C335163ECD2DF3313CD145B183BCB41A4E73A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759776, "uuid": "aae52836-449f-4c79-a9b4-2c8af923f3f0", "value": "768:ImwSa1Sc/Zqo9QhnxXdR1VcaBxqC1PYr2bwa1clqAMcxgfcNpZ:ASa1S2Z/QRxXdR1JB4C9E2bBelI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748759776, "uuid": "fab73967-cedc-453a-9a5c-34da48815c99", "value": 38112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748759776, "uuid": "62c94302-8752-4b1e-ac78-7d05e3ad8f67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748759776, "uuid": "5a8e247b-f1a4-41e0-be60-37351cacf772", "value": "owari.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }