{ "Event": { "published": true, "date": "2026-05-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-27", "timestamp": 1779926582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2ef828b7-bce3-44e1-a293-94ab06dedd84", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb8e24c-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913575, "uuid": "93111bb2-61b8-4429-91fb-4ebf9dceebb5", "comment": "Malware payload (Mirai)", "value": "edc6d341d35bed72ec7ee165f7c48d07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913575, "uuid": "4b1d61f2-2f1c-497e-a148-e5b9dcadebb1", "comment": "Malware payload (Mirai)", "value": "004a70976dc1dbf5cdefdf10d6ca8c1f4b22c2403ed2c2e4a8d543f964e017d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913575, "uuid": "d8309f06-3d95-4dc6-9b76-9bb5c8064ec4", "comment": "Malware payload (Mirai)", "value": "04fe4092c1019d9bcc0f0b6ed4fb5a6a069b8de4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913575, "uuid": "0663a83f-7ecf-4ed3-b7a6-8e6565e06d3b", "comment": "Malware payload (Mirai)", "value": "7d5034b86dfc442742df1633225e2a976077d91fe09ba5bffcf2c29f1aa0e5e459f246d01359b56f02e987dcbfa4b6a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913575, "uuid": "6b069af3-2c31-4d8b-85b0-d70d1bdf0433", "value": "T1E421F104F21D1423F6E13EB073372B619BA98F03276945089B9FF69ED8B9C20598D09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913575, "uuid": "73dbe777-8489-4b95-970e-eb654f91d6e5", "value": "24:3WUpWS9nSWZ6S4/KSwISBd6oTKP5tAFlF+f7lqzktqKcvy5MaaTo0YGN2epz6JJ:GVgZVbXGARO7Uz2qKcvy5Ml08WJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913575, "uuid": "dd308df1-0e72-40f9-9e99-484cca6e7d47", "value": 1412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913575, "uuid": "c3c2889f-5803-4337-adf9-825575ae93c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913575, "uuid": "32c66103-40a1-42ea-a190-d864b74d139f", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a654c8-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880699, "uuid": "9063dbd6-b6f2-4884-b29f-c077fb3c79bd", "comment": "Malware payload (Mirai)", "value": "ee4b1fccf8cd55e3e141e6f68917b75e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880699, "uuid": "ebdf5765-fac3-4f4f-b2c3-31ce83452bcc", "comment": "Malware payload (Mirai)", "value": "0068fd44256b2837c2f48529007fad155b43e5e589438bade77e6e9ce4378484", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880699, "uuid": "674f6a82-a99c-4fd6-9bd3-82961c34cd0c", "comment": "Malware payload (Mirai)", "value": "520ee42c6534d46aa9ccb6b60b5d7972b9a89b45", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880699, "uuid": "5e1b9520-79c6-4da5-b5d0-b8164dfdfc93", "comment": "Malware payload (Mirai)", "value": "5577251767ab4c8e8365eb724332e3ef85fe33fe1db2bee33ae4b99940e3c62a7ec0b407073b9cf5bdbf208a39ae310b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880699, "uuid": "55af5bc2-751b-4916-a733-32d8421d195b", "value": "T1A5330256C3D83C93D3AF8D34DC5B42C237F05BA9A7D21B2A815487A637109DA0687FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880699, "uuid": "8bcdaa13-9716-4163-acdb-f91a9b09b571", "value": "1536:KzGcwIEieymEceQTGnOFG9beLEpBJQfVZkeTs4u+qgw09X:ROmEceQT2Oc9b3BJQfi4u+qgwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880699, "uuid": "98141ede-34e7-4a6f-a2fc-de035e798694", "value": 54636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880699, "uuid": "ee44f3c8-be2b-45b0-a606-8a60c3500128", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880699, "uuid": "fc1a481a-6df3-44ce-8d71-8ab52b7786b0", "value": "micro.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bea786f-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924709, "uuid": "36e1cb60-d378-4d95-a979-922cd0c373dd", "comment": "Malware payload (Mirai)", "value": "4bf7d2847aa3e35acf5b81b1b037ccb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924709, "uuid": "e42e2eb0-ebd1-4c39-9ec1-bc62dcf0888b", "comment": "Malware payload (Mirai)", "value": "01dba553cc7f5be141c21c526af78f26c59e60bddefc89f12bf71c818a1d2b63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924709, "uuid": "7c20f077-7d3e-4722-99e0-cb5200428cd1", "comment": "Malware payload (Mirai)", "value": "013ca87505ed0e9e394836699b1435db5587abe2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924709, "uuid": "2584c78b-75d1-4415-8770-e86dd099d7d8", "comment": "Malware payload (Mirai)", "value": "6433a68ecf5e0a1c3f007cdb94b00957b13e72cfcef57602a65360424c37821740c46c10463d66c26b351a1dcc8046f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924709, "uuid": "6dbdd69b-1777-4ac5-b69b-d5f4c3734847", "value": "T103B35BB3CC26AF98C655D074B0B18FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924709, "uuid": "77ece8ad-6c5f-42ed-9972-07016a8e55d4", "value": "1536:OTW/VCxsHZusN2Li62C87mKjR5fvPVWARouW8j3W+gJH79:OytCxsNx62NVjzVWxuWM3byJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924709, "uuid": "6df72477-6536-4596-ad55-61372f98516c", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924709, "uuid": "ba78a5ea-23b8-4c59-bdae-32dacb7e4ea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924709, "uuid": "4e68c44b-b557-4397-8b14-ec2cfe144fa2", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3692c7d1-59c9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779885616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885616, "uuid": "59df5044-afe4-4faa-8bc9-138463e67986", "comment": "Malware payload (RemcosRAT)", "value": "e8408a211ade214e5a80cc310d63e347", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885616, "uuid": "23ec427b-0e81-46c0-b0f3-43cd8e7b2d9b", "comment": "Malware payload (RemcosRAT)", "value": "022a8f905615a6a98f5a9d8ea96e2a0d08b79512dd75c574699af0db9a731150", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885616, "uuid": "041a49de-63e7-4b3c-9f8e-aa1339a6160d", "comment": "Malware payload (RemcosRAT)", "value": "853da8240ad3eb6f99743dd686dc98872fa06e86", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885616, "uuid": "4d1bfe4b-5e2c-4bc5-978d-6cbb19e73b88", "comment": "Malware payload (RemcosRAT)", "value": "85e4a8c1dee5663bdc0d7444693a590930945ba777c12c31526c6d5f4cd782734d30bb60b7f56ed016f833f16e476346", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885616, "uuid": "4b882b37-5bc4-42dc-800d-d2f901a55d04", "value": "T1ED93D813FA4AD0B2E42591F145426F32CEBCBC3636492173D38FCA41AD79892D456EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885616, "uuid": "49c63989-9a14-425a-9c1f-b0384494265b", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885616, "uuid": "7a4e74f5-d5f9-4919-bc43-d424cf3133d0", "value": "1536:IhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6Urw:OhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779885616, "uuid": "ca8d7d53-7f9b-441e-a1df-29d7f36052ce", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779885616, "uuid": "5d6fe723-6c3f-4291-bc8b-a4838cd6dd5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885616, "uuid": "b9a58ddd-7edb-483d-afab-22a07edbafda", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8488d33-59da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779893135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893135, "uuid": "2d55a536-f66a-4b6b-ba8e-60e970d78e0a", "comment": "Malware payload", "value": "bdede47213346f1986922e05ffffb623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893135, "uuid": "b206505d-9620-4c50-b7e9-9816c0319fe1", "comment": "Malware payload", "value": "02da37c3491fe7de822724a98738563f905ad0fddf2a11abb347946af9631496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893135, "uuid": "ea05e8a9-7da6-412b-bc55-691bf0a0b6e4", "comment": "Malware payload", "value": "0de257a633e68be4015752dcffab498528d0d7a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893135, "uuid": "8dcbc675-a433-4f34-8504-7af627910586", "comment": "Malware payload", "value": "536b7aaeaae50708400e2ed641698fbc7c45d1ffec69ff14455fa91727fd87dba6dba7b8659a264dec665518d8050302", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893135, "uuid": "bc84a9d1-d34c-4582-9f81-fe5f0add8210", "value": "T17525BE05E3E416B4E63BC278CBA64633EAB6B8450770ADCF0659D6152F33ED42B3A315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893135, "uuid": "973f2f03-41fe-48c7-8b25-ab70b7a9ff51", "value": "af126b3b309d1099ea59031ea9a02232", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893135, "uuid": "3d291422-7672-43e8-a0e0-4f3ebae08cec", "value": "24576:0O7/6uoLUQyJxvVN2MRpmLVnfOHpn/K/HkwrIoIWTrNWj:0O7/6uiryfpmxnfOCJ3Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779893135, "uuid": "515fabc1-a0cc-4e9c-90f1-c874a7589ea7", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779893135, "uuid": "abb51206-9527-4794-9873-39d510f26222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893135, "uuid": "05e9737c-552d-457d-8f87-88044942dac2", "value": "PO-20260527.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b31193a-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924708, "uuid": "133877be-bc46-45f4-afc8-91a56b2dfb88", "comment": "Malware payload (Mirai)", "value": "9914e47eb38bc7daf201ea13d6932279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924708, "uuid": "995acf17-ce61-4ae3-ad9d-3572c825f353", "comment": "Malware payload (Mirai)", "value": "0330d11d77c6be187207d8ceebaad9ed86bf57fdbef78c69030034294c3f265a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924708, "uuid": "e47c191e-9f3c-422e-97ee-562661404fe8", "comment": "Malware payload (Mirai)", "value": "26fe8d9099e43d76caf9002c3d58017e30c72250", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924708, "uuid": "3a20f670-636a-4ee3-9cfd-f5d6d105bb5d", "comment": "Malware payload (Mirai)", "value": "4cf5543668ff8721c492fb083c865cde7a26f389f0c203d38ddff1afe9c2cb0d560c62f437bca6d37d5278ffd29379e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924708, "uuid": "201c7cd3-9e48-4ad3-a68f-f0a8ea1db56d", "value": "T12453F1D01D0903D3EA96DC3F7D3F829A6A911E762CB84C43FE66D92E2B7010E6B0595D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924708, "uuid": "3e8c9875-16bc-48c1-a3c9-80ebc24a553a", "value": "1536:pmIMUrCN934I/DousUCZ6IY/x4OhYViv0IISBIlyVPwq7sI9PBcE:uUrCL/Uu2ZvYJ4O5ZISBIAVXr9PBcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924708, "uuid": "8683a2e7-e379-4c9c-b001-ac0b97a816fc", "value": 62648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924708, "uuid": "1c037226-3ef1-4174-87d1-3f1d7454092f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924708, "uuid": "fc83e74b-4a5b-40d4-9c9e-a3e01e8d2332", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacc2d71-59fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779908145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908145, "uuid": "8b0a13a2-27db-4b93-a43f-dc8a29ac4aa7", "comment": "Malware payload", "value": "86f9fafd02e6bf1b9c0d78c13cafcff6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908145, "uuid": "31497940-3e1b-4434-9312-c0fdfdc9691b", "comment": "Malware payload", "value": "03bf6ff8b23f176a2089039336d08c26b895e2ba6e963f4ed158df27cc91b1bd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908145, "uuid": "988e8fd3-388d-47d4-a34d-e98eae5a5ae7", "comment": "Malware payload", "value": "ae10acad3a9cac6ed6365e84e512e817c657ec2d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908145, "uuid": "8af8f2f3-81d0-4fe3-a820-32a918254d78", "comment": "Malware payload", "value": "86ab9a44aaef4f26822550971e79b6ffdc6ee33ec967106c43f652d53e154679a6c5c925764bca5ab9c1505f7b0aa06e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908145, "uuid": "33aa8bc0-b8d8-434f-a5a1-42a730c8b029", "value": "T1A9D02B8CD41A4C73B41688DA7BD7385D310E900045422C4567A91D06B8A4C24A5D15A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908145, "uuid": "155fef68-5159-4de6-8d15-ecfb5ecd6ceb", "value": "6:/VJ+pUKUF2RVYTeinYEDneUo3FoFGmUVKAOXeGvPGDmgAhub:/VJ+jRPEYEzRFMgAsecsnAhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779908145, "uuid": "c0ba6f91-e411-4ee1-8e7d-ffe3838b6e82", "value": 279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779908145, "uuid": "e3031766-84e5-4f14-8cb6-50d0cc17d369", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908145, "uuid": "85a6d2de-ef92-4b17-8992-51e95ac5b31b", "value": "res", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199f00a4-59ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779879125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879125, "uuid": "fdf8cfe7-fb8b-4f46-bc65-1de60efba9e3", "comment": "Malware payload", "value": "0b07f40f995194ad4db405778a4f5df7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879125, "uuid": "cd54f868-367b-4d75-95ef-68fb9cfbef9d", "comment": "Malware payload", "value": "04182538d940c58320e1faefdf6f8645e3270e498f8f41f073959a33e5e22559", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879125, "uuid": "54913de1-5a28-45fe-92a6-2f45945e62cf", "comment": "Malware payload", "value": "333330680689f32e579816849f054b116849a0e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879125, "uuid": "08e9996f-87cb-4985-bc0b-f5ce7e965fa6", "comment": "Malware payload", "value": "e63e79ae4418cd9ed6370371158d5a0c7d9843cd2e73971de4c816465f7b54a1f883f450700609ed25b0220d885cd055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879125, "uuid": "425ebfff-3db4-44bc-adf1-055e4daa2371", "value": "T1CA653A8F4A7414D1DC6532B290DABA0DDA25ACAEDDAD51FE1E122F18E93CC09CD1F136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879125, "uuid": "82360636-14dc-4bc3-950a-eaa57c7d0b92", "value": "24576:vk1+ew8a27FR7xdOyxdZ75HKboz0oaJuWTuYVMBKi/pGnrWhf2zOqZS6vlPzwPA9:xM7XgM1kyaoo1a2g0wnKx4M3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879125, "uuid": "57605aec-e4d6-47b9-8155-9758422ac19a", "value": 1494224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879125, "uuid": "6c641804-153a-4159-ad9b-7fa8d1b4c1d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879125, "uuid": "89f9dac1-69fd-4eba-b19d-676b8a8e40a6", "value": "04182538d940c58320e1faefdf6f8645e3270e498f8f41f073959a33e5e22559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0a453e-59a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779871720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871720, "uuid": "54ac6f9a-d21e-4cfa-b721-f7c0753c3757", "comment": "Malware payload", "value": "6b10e89353feb114abfde502ba613929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871720, "uuid": "be10391f-ef7d-48f6-b470-468a9bb09893", "comment": "Malware payload", "value": "043c2fcb9ffd393b89584bb511ee30ca30692b80860499a9b45e6d62a19009b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871720, "uuid": "5b9aa2fe-4c23-48d8-b568-7276f06863e7", "comment": "Malware payload", "value": "dbc9838457ea7438b28fe7ab0ce49d8c336f9739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871720, "uuid": "52271530-651e-4e51-9d51-0a1f59a693f3", "comment": "Malware payload", "value": "a5b444794a9351a86bc52870083879778474ca6d5783c4d8696a2ae3a0c91f192ecc79445a6c94a52c6a17247493ac8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XAgent", "colour": "#B84B35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871720, "uuid": "631cc99f-bb12-4c63-a8ae-53fa4b65d648", "value": "T116469D0BA3E446E1D127D634CAA68333DB717C611738CA4F1596E60A2F33A909F6F365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871720, "uuid": "2437e887-409f-48c7-9774-8e074e0d97dd", "value": "c941741b2df2e417e6644d049501200c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871720, "uuid": "4a5d2a33-affb-49bb-a1d2-cbe09547155a", "value": "49152:2kJ6a/87XkhnJFX0dHPyv72Tvmn+1rN4YiTXoiYbFyx5G1L+ZUKOUCin6hyfE7o0:22dYdN4YqYiYngvwPEGepuvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779871720, "uuid": "5783c354-3ce8-4e3d-8ad7-89df28e87e8f", "value": 5516800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779871720, "uuid": "6e39214d-9a20-4802-903f-c4145a8562db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871720, "uuid": "6eebeb92-ecad-435b-a1bf-360d9dc4c6cb", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390f1947-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924704, "uuid": "7217b2d5-d398-4175-b79d-18b256c0b891", "comment": "Malware payload (Mirai)", "value": "c6fcbc2d933b5bcef342c11721ab7dba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924704, "uuid": "8f1fcbbd-a09d-4601-821e-e6d8b9d7eafb", "comment": "Malware payload (Mirai)", "value": "046364d81c7b0fbbf6da6b2d8cb3dc6dd53dec437c6d64ae951f086c3aae848a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924704, "uuid": "c980a2c8-da87-4e52-9da5-c7910044b10f", "comment": "Malware payload (Mirai)", "value": "a19443d23aacf7cdc22b0f847b97aba209bba1a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924704, "uuid": "4241da33-d9d5-4823-a5c3-364364d7c1a8", "comment": "Malware payload (Mirai)", "value": "c87bd40312ddd9cc31111c158ae47c878a2619d192f50e39f6f1aa243feb5a92b42ae42d6d946095970154e1d16af56f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924704, "uuid": "e413abf7-9705-4c34-8f6d-94ac62f9e6b8", "value": "T19141DAF40082437C7DF69B3ABFE9444D77E5A29BA8C2DFC154F438A5914DCB02E9069A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924704, "uuid": "9d76194f-ea5e-4448-aaff-37a106f7354d", "value": "48:iEFsM9yso2ssjjNbs09sgusQPscMs6eschsKI:iEFsM9yso2sMRs09sgusQPscMs6esch8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924704, "uuid": "7b593a79-e4ea-48a2-9370-82fe0790d6ed", "value": 2056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924704, "uuid": "5625f643-2862-4d28-903c-293baf6f530c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924704, "uuid": "3d291c03-acf6-4df3-810a-a0d3fd4d107e", "value": "shcript.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4985178-59e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779898712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "0da292b9-096e-4ffb-9dbb-ec2ab3f17974", "comment": "Malware payload (Mirai)", "value": "4c2edc2b7b97f60462f08712821bab47", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "bf1d16c9-7b79-4f87-8b85-3a23217d65e4", "comment": "Malware payload (Mirai)", "value": "04aadabd5cdb2c9099ed0373c406afebd1f6b8bedcfbf2f14b23f9ec1d392359", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "64db214f-aa97-4c1c-8847-1ebf959223f8", "comment": "Malware payload (Mirai)", "value": "2bdc020f906acaf76925b041d4ccf8cd8742df96", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "7b0f3342-98dd-4060-aee7-36ba689f4f4f", "comment": "Malware payload (Mirai)", "value": "aa5ce284d7cfdfa43f1748439ff585a73c2f16440709f8df0879ca6970e6e41ac8f509694e406c39712b6e9148c81415", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898712, "uuid": "06c06058-a97a-4e1c-bdc2-9d4ef056f73d", "value": "T150C32981FB43CAF7DC4705F051E76E3ADA30FD2A8832D486EB547EE1C6565C2A606368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898712, "uuid": "06921549-9add-453e-8cd8-49155efb3fed", "value": "1536:cY1zvhBMKDkvQWptjNbkcHgMeumRJVSCJiKOmK9O0Axh7Zz3DWW4Rnqn1EjzGoZ/:XDkI2qVnNh1Gjwn1Ejz8maAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779898712, "uuid": "581a9e58-1ed9-4d3d-a049-3fd3f7891820", "value": 125652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779898712, "uuid": "ba03af28-e58e-4ceb-a7a9-750782b89f3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898712, "uuid": "cc8b45e7-dca7-4907-b8f5-0a9863f45bea", "value": "nova.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1f5963-59ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873093, "uuid": "141c478d-f752-4d11-80ce-306445073189", "comment": "Malware payload", "value": "b80c854083d202d91949d2e3afe904ed", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873093, "uuid": "1cb7b0b1-bebd-4e7c-98ed-82f189580f8f", "comment": "Malware payload", "value": "05721f01e73d16294e95e6862256ded639c7362ced012d0b1252e68335ada465", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873093, "uuid": "4a2bd121-b554-4761-b0e1-9b805bed9536", "comment": "Malware payload", "value": "21ffc0ee268641271e9eee94433484c95c2af2a3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873093, "uuid": "d1c4ec46-e08f-4dd4-846d-59cb6e0ce60b", "comment": "Malware payload", "value": "80f0d3e07db3cd9b2096d6b2cea5f294fd16bffdecb14fe2fdbfee3f63ed7deadc50488fa32c8f585528711b1474fdbc", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873093, "uuid": "6bcaee8b-84fb-496a-afb6-71d68b8a60b3", "value": "T1F9217B456A6383C87DB12A64C27D9206B0D24217A4D0FD54F7DCE002BF25653EF0A2F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873093, "uuid": "258bd44b-0035-4b17-9015-380e03fbc4c7", "value": "24:k42cLLhJwYgTjMTGqoLldp6XlH0RY5lTlqh9TAKUZFBKG4Kj0qslESjLBKuYjxf3:k4lL7wbTzBMXva4Z7o9y8hNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873093, "uuid": "cff0ff6d-0b8d-48b2-9541-448b9e9b37d4", "value": 1319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873093, "uuid": "12a99b9e-0e1f-4bdc-b70b-54687a06b42c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873093, "uuid": "e858441b-b903-4297-b680-1ac2eb1020e9", "value": "file-BLHVOA.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13e16e5-599b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779866065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779866065, "uuid": "cb11bd36-732a-4752-95de-61269fbc3311", "comment": "Malware payload", "value": "7301d5a65978f4a829e1fa270152dfa0", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779866065, "uuid": "d6ef4b08-38ae-4f41-a77a-0a178db46da1", "comment": "Malware payload", "value": "0594e2c11ee83e2a22559def773ffa8b0ad0a7d86a1433fb345cfc6522900b98", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779866065, "uuid": "f9b70043-3f10-450c-8c6f-51b6456f1f90", "comment": "Malware payload", "value": "652ad482fa1869ee400389337db01b8915f4e76a", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779866065, "uuid": "40588d71-fb10-4f33-9a22-0779b324ea4c", "comment": "Malware payload", "value": "c5fdc46b125309e4131044f6c883dfc6803ed1b32881c803d10a62761cd77b0ec1579b836436873c6f70d6fc21549963", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779866065, "uuid": "69389f03-df05-44c7-9eb9-1dafdc0df524", "value": "T1497623BA65A6F870E88366B7C10D736BCA653C91F3C5F35B2B5B23A24ED05839115233", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779866065, "uuid": "57d8a7c6-f617-4087-9177-00b471dc97f6", "value": "98304:dW7pgA2dW1vW1wnWzFFzEStPD2BhytSW1z22t1EoMtrV2trnHGtpTDpIP1GJ7cZn:u+A1cXpb2B4LEe70p8MJVuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779866065, "uuid": "52cadb5a-7542-4a74-8267-7d000ec154e0", "value": 7237481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779866065, "uuid": "4ebc3fcc-d370-4e56-9b36-f6d0e7f3355c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779866065, "uuid": "914b06bc-7995-487c-b302-ed6d2d33f571", "value": "3506-VNPT Net-KT.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6ca894-59bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779880123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880123, "uuid": "502a3ee3-71d5-4949-92df-71633c9f87cd", "comment": "Malware payload", "value": "8e1b28b74a701ab9fe8890cf64b63dfc", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880123, "uuid": "40b64447-0796-4e03-b251-bb95a4c87aa8", "comment": "Malware payload", "value": "05aed8fa1453a78c1e771b1a9789ed469f32706a21fd1f542f7e5f4a99351896", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880123, "uuid": "246407c6-9a36-49b8-9ed2-4fa5c0f5c576", "comment": "Malware payload", "value": "f00f2ebdd6841a6d7d31c49b4a193031a7d6b638", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880123, "uuid": "ec944bf8-5f5c-4423-b864-6293c57ab401", "comment": "Malware payload", "value": "4db4bda7f8d4b7277f71f1b1fa1bae12a561f7fb443a12eb412822d0d297c212fd8225f16bcbf65ad9ec4fa4832128d0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880123, "uuid": "2a6e5595-3465-4f48-a385-055c4fb1e900", "value": "T177C3F1A3EED4819DE31B4A3A295CCD97144C73AA99C1DDAF53E81A405C318BF274378E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880123, "uuid": "d432c8d4-b96d-45ec-9396-8d2ab1e3cbd0", "value": "3072:bvFQLMWVm/0DbelCnN/3CttVLwV1gG9bS7:bsMWVmMDbeINvAcV3bS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880123, "uuid": "895ec714-c231-4571-8b79-2bfa8b685233", "value": 122387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880123, "uuid": "b6b06e18-08cd-4792-a0b6-86dcd6d4de13", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880123, "uuid": "f6657ff1-63fb-407d-9884-01e46fb4c23f", "value": "ApiBR11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56e5149-59cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779886795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886795, "uuid": "b6ccbd6b-2cef-4c48-96ca-6e74587e013b", "comment": "Malware payload (Mirai)", "value": "48d44a96946e07594379d4938a689bf1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886795, "uuid": "e63fca45-5852-4430-ad3d-3145059cbe92", "comment": "Malware payload (Mirai)", "value": "05c2a2f9c52b57515972fb1ac75d7c07b5d8ced082752eb554e8a319a351a017", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886795, "uuid": "63edc7fc-2142-45b9-886f-10e28feedf5c", "comment": "Malware payload (Mirai)", "value": "b82f1c2533a1842e4983629eab4561de50af71b8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886795, "uuid": "b3ba0565-e6fe-475f-866a-af505c1168cf", "comment": "Malware payload (Mirai)", "value": "fe4e0814a80a66a1d3778d80d69b17a05a01395e11a3d8e2b39573153442754d52530b954832734484a0f7858d868505", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886795, "uuid": "8c13e273-0a70-40c4-8572-415d3927af82", "value": "T1C9317FEB62A0A0B3C46DED45FB9184C5D04846C3D1E6EFBCFDB85526489814CF1B6B74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886795, "uuid": "0f4df242-1f63-4a42-959a-4d2a80aba270", "value": "24:sQAOJcQLrQkQPQJIQ3QvBpQ88QCNI4QSNI/Q7KPpQrKP8Q5nQIqQuHpQ+8QRXQw:sEccrBioISGp3836KKPp8KP8+0BHpp8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779886795, "uuid": "d3e926c9-ba58-4866-b8ff-60f4632642f1", "value": 1450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779886795, "uuid": "3bd7b94e-1723-4d03-89f1-50ad8c17d608", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886795, "uuid": "2e3a482e-25d7-4e52-8423-338b190cf4e2", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e22308-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878852, "uuid": "6a063172-2b7c-4c7a-8dc0-ab1d0f8fb98f", "comment": "Malware payload (LummaStealer)", "value": "e1f5d2eaa2f50cc2648cc85e73b58544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878852, "uuid": "e888a55f-d876-4b50-b2cb-ee9761283047", "comment": "Malware payload (LummaStealer)", "value": "06876a07ce515a8f4f5cc59c15faf585b676d8898bdd95e79f6d3e4b187c9ce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878852, "uuid": "c9dd3e38-0d01-4e92-8a98-ba140bcfa944", "comment": "Malware payload (LummaStealer)", "value": "8e1b18ff81b754d2a9a2c133adf64b38b842e441", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878852, "uuid": "59c5b72a-4a74-422b-acbb-ba9103f7a0c6", "comment": "Malware payload (LummaStealer)", "value": "c20918e9b64fec8be79e4594442da498e4da21bc135236a7eeecbdd00451c6c776c61fee09386498285675b4450ef360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878852, "uuid": "92b9771c-dfa8-497d-acf2-7d243a8da5e7", "value": "T14C748D4AE7B748B1E5470975229FB33F9B2416144328CDDBDFE0CB447A33AE26539A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878852, "uuid": "7f1c499f-465f-484d-9ac2-1f1f57371986", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878852, "uuid": "dab885fa-da22-451e-8671-88f9a85d468c", "value": "6144:oRLI6zZvCw5/8m5RtUHD2zSnK90dK7KDhAoK4Yeh9bDvJFeDs1WX:QTj50mhUCzSKGPlAoK4YehVvJFe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878852, "uuid": "cf1a6f6a-356b-4cc6-9d0e-25ae06b17b4e", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878852, "uuid": "3309cd4a-bd24-4a80-8e02-a5d37c3f7b4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878852, "uuid": "cad18844-0606-4991-9b85-2dcb04b07c2f", "value": "06876a07ce515a8f4f5cc59c15faf585b676d8898bdd95e79f6d3e4b187c9ce5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a82f908-5967-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779843666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779843666, "uuid": "f5b73059-2040-49d2-b446-59209c618ec9", "comment": "Malware payload (Mirai)", "value": "77ab193feab84daf47476dc6198090e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779843666, "uuid": "a4a2c08c-236e-4ce7-85ac-f889865e03e8", "comment": "Malware payload (Mirai)", "value": "06ad53d2aaab6b416594537875f9104c4b3dfeae24b35b0cc5f799d2482afa21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779843666, "uuid": "124d6677-05d6-4ebe-9cba-62de81ba19e7", "comment": "Malware payload (Mirai)", "value": "7653364906e40b7251831df8089b9f56dad4f584", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779843666, "uuid": "b6ed9319-33d9-419e-a097-f534782c3990", "comment": "Malware payload (Mirai)", "value": "383000c721045d42341ea2a9b5658c4cef433f1bf12f2f3b39cf31dc7d9509de4259c710200f98023480c58286817a7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779843666, "uuid": "a13aa5bd-9d00-43aa-91b8-b016df04f829", "value": "T13A732981BC929A07C6C5137BFA0E42CE37267798E3DE3212CE259F2137CA96B0D67151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779843666, "uuid": "c236e4e1-2e2e-4634-96b5-6081f0a46fc7", "value": "1536:b0ah2q91WIzLCbxqfd1auygegk8S5PXwTX:Qa/C8LCbY2gkZPsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779843666, "uuid": "d4b664e6-70c7-412a-8955-8af350220627", "value": 79668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779843666, "uuid": "2d794f69-5624-4c86-9866-4d623a646c68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779843666, "uuid": "e99a8dce-fb8e-4688-9933-2a06d250a2f9", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba98555a-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913755, "uuid": "ddd52aa9-608c-49ad-a6a0-aec45581bf83", "comment": "Malware payload (Mirai)", "value": "69a3882c87763758755926f245de0226", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913755, "uuid": "8a21368f-0dad-4bdf-8201-e0c79d75424e", "comment": "Malware payload (Mirai)", "value": "06d2e7e59f24dbebc2c7da9db2f5bf6c8f932152614e6bf5610991813e03425b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913755, "uuid": "cd4a3f11-d175-4ef9-be89-9c99006e786b", "comment": "Malware payload (Mirai)", "value": "1cc0c26c218024bb954b10412a8696876c5ae953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913755, "uuid": "8c25a097-65ef-48e8-97c1-0ca015ed59b1", "comment": "Malware payload (Mirai)", "value": "34e311cab992f6daecadbf904caaee9efacd51fd9a7d375c0bb578fde3e6a97b7047e5208c947a897d7dda2d88c5bcb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913755, "uuid": "99cb0baa-5958-4640-a5e2-c70600a6d85f", "value": "T1F631DFD9E7D15EBEC8E451BE9E5B030073799F04E1CB7223820C73696D1AE3C6D26446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913755, "uuid": "0ca7eb02-26a2-403f-8b55-2876cd260b01", "value": "24:ug1KGpa7Urz/jlfXXK1hH9Vev3gRGaJ9ilBBuLlCV9gCe:ug1KGpa7UrLZsI+JGBu4Vte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913755, "uuid": "c81ad3c5-feab-4c0d-b55b-197ff507607e", "value": 1508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913755, "uuid": "46d3e38e-b8e5-4575-b217-5f1c5aefbcbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913755, "uuid": "75a50ff4-1ec8-4e38-901b-4078fff72fa6", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38ff270-5a04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779911193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911193, "uuid": "f8844eaf-e3f4-4554-b728-2cd6797582f6", "comment": "Malware payload", "value": "048553490a76df09225fea327dcd1e22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911193, "uuid": "2d4fe847-495b-4524-8366-fcba2f0afd42", "comment": "Malware payload", "value": "07acc952bf1fdb30a6a6f9538d16d03d20f0bfa789738a79955af80e1a3a4e2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911193, "uuid": "de24d578-d3aa-48b9-aaf7-568440df768a", "comment": "Malware payload", "value": "9044db40d2f44ba23ac870e76510a31bdccd8670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911193, "uuid": "c24ab7c9-6cec-437c-8382-301cf340c238", "comment": "Malware payload", "value": "8538fb7dd562a6031be5feea8be5e1318381dc6bb1846fc4f6a2679b8f6697cff2f3c988934eff34b41596d13f3acb4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911193, "uuid": "1b29b67a-5932-42bc-a7aa-893efeda3e35", "value": "T13BA4017F65D723FCE8B7D13A66933061F8AB38E05B205EE7A34491642437AE4192EF05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911193, "uuid": "2ab9e05d-e529-4ef1-9652-948e7d50eeb5", "value": "101e9da62927c83ffbe9363e7b60b054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911193, "uuid": "d75a4a9a-402a-4c08-859f-cb7b2e2d9611", "value": "12288:AVKy7lT9ZC3sMgU2gb0BCm6ZGZ+emkmTOOL:AVKklms69O1cGZ+emkzOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911193, "uuid": "2c9a75b9-d028-4de1-9077-e3d933614467", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911193, "uuid": "e2fc966a-dd4d-4224-a2aa-80449be09e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911193, "uuid": "9b660711-6c96-43cd-bb55-6b35ce03fe6b", "value": "learning_deploy.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578761ab-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913588, "uuid": "c49845db-e66d-4caf-8cac-27164e7f4d0b", "comment": "Malware payload (Mirai)", "value": "5f645cb3b93f8c20803f0fa0eae22e60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913588, "uuid": "854daac8-1db6-47e2-9f25-f6f5767fe837", "comment": "Malware payload (Mirai)", "value": "07bf820574e1e860b9b3a5f3eabe5cc23bf29ae63acb3824a91e6a28b928d223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913588, "uuid": "96237b5c-9af9-4b98-9124-1bfa235bf732", "comment": "Malware payload (Mirai)", "value": "90c0f59081e3ed86c24ed5c2573ff9f33764e212", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913588, "uuid": "3bcca046-d3c6-4f52-92f1-aaf6a23f270a", "comment": "Malware payload (Mirai)", "value": "854c5070ccc034c18948d62c4066df40bc4cdee5990d615af0fbb47805a5d87e6a7f12fc90b55357a6e612ce77d3c180", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913588, "uuid": "c545f764-aba6-465c-86e6-1dde76e96285", "value": "T15F430781B881AA25C7C053B7FE5F008D33159B98D0EE33478C255FA57A8AD1F0D6B79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913588, "uuid": "84ad8d3f-2797-42ad-8047-2ca0f82f51af", "value": "768:jN8dcdPJfnJI0xr58G3lG6VFj/I+fogz05lzhznISYphtwYnLwCVy/rCxHghW1/o:edMJfJLzE+fsISY7tXmhWc5Iy0ssY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913588, "uuid": "f080b5e9-2a9d-41b1-9246-aa1a163e072d", "value": 60092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913588, "uuid": "7fbd666f-2fca-4c9e-a4dc-7e92ddd80156", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913588, "uuid": "ecbb0da7-b4ef-4611-81bf-4e72ec62aafa", "value": "Akiru.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb90cee-59e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779895751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779895751, "uuid": "a8925092-637a-4a20-a074-a810f7c17e03", "comment": "Malware payload", "value": "900aa882146baf495cc06ed1cc3c6679", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779895751, "uuid": "92c46c19-b321-41e7-ab7e-630cd71c2cfb", "comment": "Malware payload", "value": "083f4fa8246555786f3cbdeeeeba2c77bec81c01eb756a38be71c79144d14898", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779895751, "uuid": "73a71c4f-4758-4947-854e-c91d28abb02c", "comment": "Malware payload", "value": "6fc580b123580079f644415146c46724d937b2fa", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779895751, "uuid": "1c45d356-11b0-45b8-8395-83188d14714c", "comment": "Malware payload", "value": "a341591daa89e231ed9cd1d2ecbdc2c0907426ab698dca87d899ef8cc131377a6ae793d3554a0a9b30868bd06bfcfad5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779895751, "uuid": "cc37146a-0aba-4a43-9951-1b98b778019b", "value": "T1165733DED4721E47C93B983AE8A5993EC9603E187952C50FD49273A318BB6C273FD448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779895751, "uuid": "dc451b88-a126-4875-862c-cd61ad4c94b3", "value": "786432:z5oTt3srpAT+U7WvS0FYxI8xg+GoRkIC:loTt4pGnsVYz1Go/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779895751, "uuid": "7cd8a637-e8d9-4270-a7f5-e7c668873edc", "value": 29130752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779895751, "uuid": "f01a9071-2082-4859-b5e9-ff0e7c4251ce", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779895751, "uuid": "21eaaf9f-7500-4c03-b2a7-8674e8dadb92", "value": "setu\u0440.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1417ab9c-5a0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779914334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914334, "uuid": "e1b95dc0-7e51-4c4d-8aaa-238488abac29", "comment": "Malware payload", "value": "8b3beab86b109ede8c930ef73c15f200", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914334, "uuid": "3a0ca92e-d437-44db-8d38-e1fe165f66c1", "comment": "Malware payload", "value": "09e35ba6d5f8619d913903fc514e38e7bfe6ffbbcbe978d061845558e2f97557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914334, "uuid": "a3c1428b-cc17-4af5-9789-cb8e77b2be08", "comment": "Malware payload", "value": "578bafd5d2ae047d923c9f32a4f5ce03533cd229", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914334, "uuid": "2893f593-f231-4adc-84bf-346a3e0b314e", "comment": "Malware payload", "value": "a68067f046c7b71e9212b3cb784baffcaf7d7ca9cdbc7142c925bd335701b141c06c9c74920d66eae9cb4c0b91035ad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914334, "uuid": "6f96d442-cb39-401f-a5b8-dcc003bd0c1f", "value": "T1AE7559077CC425B6D9FA923288B55291BB31F89A0B2127C72B51A3B93F777D40E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914334, "uuid": "feda4f4c-2393-4e31-a48e-9bb547486c6a", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914334, "uuid": "8463631a-a6f3-4089-8137-4fa7a37d9abf", "value": "24576:FBQ5ZEqSm3Q7ez7AsUY9bd0URPC5LRPJheSgk0HoswqD1cI:FBEZbSm3K2f9SRPOSgk06qD1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779914334, "uuid": "f20ca8e8-2fad-4a61-af24-02d21a79c5b3", "value": 1634504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779914334, "uuid": "468ddadf-b85c-4c18-bcd4-4713636f79c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914334, "uuid": "e79865d1-54df-4e53-bf3b-7e0493475ad3", "value": "S\u0435t_U\u0440 [U\u0420D!].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c6b338-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911656, "uuid": "8843f8d9-7428-43d2-a380-b38e9e01e80e", "comment": "Malware payload (Mirai)", "value": "cf7a2e427cfac0aeade84436e36bcf5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911656, "uuid": "03e4b6cc-83d4-4fdc-9974-a040d3cc655f", "comment": "Malware payload (Mirai)", "value": "0a007cf0bd048655587a5523e665a4fecc9b3b5f61cba3be7474dbcd8a63dcdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911656, "uuid": "674b9fbe-eabd-4cab-934d-35876fd32f54", "comment": "Malware payload (Mirai)", "value": "97c52b40ed7e9a3b7a50fa209371e501b676d5de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911656, "uuid": "0d95055a-a616-4f1a-a45e-9b9368fad810", "comment": "Malware payload (Mirai)", "value": "5da2140aa1f0d1337e0f312989c30f432ffd030659d749e7183f74fe24a459167feabda47a704f0f3615511bf9ee6559", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911656, "uuid": "9d1320ac-e796-4726-a4f3-0762741ccc4b", "value": "T181230216DBF0507DF6FE303C1FFB97ED5489EA1A83000EB9ACD055ED118ABE45A28885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911656, "uuid": "22ac0622-504c-4bdf-8200-e5dd427d45df", "value": "768:8essG0aMqhhZuiRf+TaE3FM/L+JIE55SQyIL0DwkSppyJwWQa5d2QnbcuyD7UoQP:8essLhSNsyIawzuq0nouy8oyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911656, "uuid": "75ca58b2-c03b-43a5-9799-ccbf4380e34c", "value": 46732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911656, "uuid": "6e6be86a-643d-4cb3-a1c2-1fa786db7f72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911656, "uuid": "3c3e8cfb-8c0d-46dc-be85-2bb579d59a75", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0b4883-59da-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779893146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893146, "uuid": "9bb5436c-7fb5-4961-abb1-a14cb646a923", "comment": "Malware payload (Prometei)", "value": "6feda86d10ed979a059aed9f84233631", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893146, "uuid": "50f9651c-157b-49f2-9fe8-3c4ab15a15a0", "comment": "Malware payload (Prometei)", "value": "0a731d26eeb377a3f101bd4941e700ab87076cc7a50a0bb99f2b683b6266d351", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893146, "uuid": "df9a27ea-8452-4ffe-863b-cf5cc1538a5c", "comment": "Malware payload (Prometei)", "value": "a9b94682e7dbd3836e9cd719f8535204a3f098ce", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893146, "uuid": "8f0befb9-4c44-4dba-905a-e1ce0abe24d7", "comment": "Malware payload (Prometei)", "value": "d0e78bf36a67e9676b7e611840b5888d73f86c1c0245d7adf01cdb630ce06ffa187a8042c0267af7a660fc17ceb9e7ae", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893146, "uuid": "8276513d-f5a0-4c62-8f3e-f926bba0dd48", "value": "T17A315CCE24A26752054B9E44F3774FE9542ACEC020589FBDA88C5C33A9DCA14B235F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893146, "uuid": "9481da9f-8c70-4b89-b0a2-90a5c64b9ca0", "value": "24:Ef8LiXKNI7ViKta26kgql5gtg0AO5td8LEtKNI7LiKTMPDolwtaefy:3I4+a2IU0fCqOEMbeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779893146, "uuid": "698a9ff1-4728-465b-a819-870abd5b1758", "value": 1702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779893146, "uuid": "68586c2e-7248-4656-aabf-e8e10195683e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893146, "uuid": "a86ca915-6640-4749-8b42-2ce975b86682", "value": "0a731d26eeb377a3f101bd4941e700ab87076cc7a50a0bb99f2b683b6266d351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c757d785-5982-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779855365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855365, "uuid": "67e11508-9bfd-4664-9a37-fe6df5d3da2b", "comment": "Malware payload (Prometei)", "value": "73d378d78a737be75754ae27697c9075", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855365, "uuid": "fe876a1d-45d3-429c-964c-37112f42db00", "comment": "Malware payload (Prometei)", "value": "0ab9a5703d797646e0d3d4d660d7a816bf0f8d720802183b82d99544c6f9b95a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855365, "uuid": "38c28495-120d-420b-ac13-36c40eb2a71c", "comment": "Malware payload (Prometei)", "value": "9de3238f99d71046f79a507abf7c44f4fb417537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855365, "uuid": "624a4d6d-5813-4eed-8aa0-3efed5a5ec94", "comment": "Malware payload (Prometei)", "value": "2e2e8f1b1a0b6e38f2a0f3a0d02f6eb04631808141815220e73a0be8afcd92906d88ec0ab27ad2f3d4fc91c37a7c4aa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855365, "uuid": "b3ad1e3e-a2dd-45c3-b095-b88a502a1fa9", "value": "T1A034AE73A4BCEB9FDDD82F779C8B850713A62FD98890203E0D94751EFD2A5082E35616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855365, "uuid": "d60dc03b-05b0-45e2-8719-ed8abf1b86d7", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855365, "uuid": "54ac8ed8-1caa-4040-959c-80f45e2ff623", "value": "3072:caZcM3pgOPBdu/XkI8KCcMrnfaoaGmK8K7AzZIl/7Z0NWehnLCW9IPkPduwXFo31:xWO6fPkhKCDahM90ZGyNhLCW9IMPdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779855365, "uuid": "546b10ad-c656-4eee-8525-9bd6d91d98e4", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779855365, "uuid": "904c7d31-4d86-4b72-839a-3d73d2fcde42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855365, "uuid": "bae186c8-2d85-413e-828c-5ec526308aa3", "value": "0ab9a5703d797646e0d3d4d660d7a816bf0f8d720802183b82d99544c6f9b95a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f84799-59dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779894260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779894260, "uuid": "e57f4241-5c95-4e08-b386-23bed510f6a5", "comment": "Malware payload", "value": "e035f41680761ab9e18c787fb421e6c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779894260, "uuid": "1dd6f5b5-e367-4310-aa95-e3c2cf1f3443", "comment": "Malware payload", "value": "0b839fc7c31163b315c74c53e3e86cb997397ba4ea756e839b4fd053fd947420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779894260, "uuid": "30af99eb-dbc8-4a05-bcac-7870a64c52b6", "comment": "Malware payload", "value": "791eb0ec3045faae8bf7b8f99cddb68dace59741", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779894260, "uuid": "865cac93-24e6-4f5f-a67b-bd20b760c508", "comment": "Malware payload", "value": "c4c72ad5086dbef748436fc0aee82beea3c1598c7a92587a99a1682ed5451aebd047fc1586c78b80ae35688903fbcd51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779894260, "uuid": "50f8af64-6346-4768-82db-88c698658133", "value": "T14116224129E219BEC452C7B1C2C928BEF15FBE454D72CC57FF8B6A105E32910E8B1E59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779894260, "uuid": "5f341347-f1ca-46ae-b05a-0b1b0fca53d8", "value": "66e4622a2560a497065719058a0b3263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779894260, "uuid": "10174435-14df-45e6-b471-860bd41a021f", "value": "98304:wJtkHJJZ+H4lc2XJpnyeEEKABTxxRGizyu9OfBixvCZvja:wJtIJL/JKABTDRXV8yMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779894260, "uuid": "e3196389-744f-4653-86dd-edb3e6ce4f3e", "value": 4327424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779894260, "uuid": "af286a03-3a9c-4c09-b083-d38de740fcc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779894260, "uuid": "edf934e6-a8ba-4c26-9bbd-1767c794e9e5", "value": "new_agrm_19_may_timo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69809c55-59be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779880977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880977, "uuid": "bdffc553-636a-4e9e-a1f7-8b836e37a09b", "comment": "Malware payload", "value": "2d20f7a6854af43e5b1ebc8b44f0f8d6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880977, "uuid": "6212cb6b-7d5f-4bb9-a5d7-1802591a8686", "comment": "Malware payload", "value": "0b8af196cedf8528e113dffc2c15f2c0e70439f5f885c33d38f380d7af94fea2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880977, "uuid": "dfae8fcc-d20f-457c-bd9d-c926e56610a5", "comment": "Malware payload", "value": "46ec8621ff61235825c364059172f28cd2d43c33", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880977, "uuid": "399e6377-a038-44a7-8d04-c1d760e13810", "comment": "Malware payload", "value": "eec8d53faf5bc12be9855f656f30f746af432dd28d7d407385356d27382e64241f58ab8c054d124d08532a1f1b0529e9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880977, "uuid": "43b18ac0-5cdf-42d1-8381-82ae3ca0dfe0", "value": "T19E673398B7CE48B5F9A9917FD8904663A2A2787503B4C6CB8BF4491307D70CADF79324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880977, "uuid": "76cc6c52-99a5-4b11-b1f3-618031f6ca2b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880977, "uuid": "d658b8f0-832a-456c-af64-1810f0d5bda8", "value": "786432:CquyW8mZW+e5RY2j6+s7LWB75zuPN/9Mk5thNTm:9uyW7W+eHY2qHWB75iVGkNNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880977, "uuid": "9bd99d84-c31c-4354-82df-38db2f0bc6f8", "value": 29760737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880977, "uuid": "4756b70b-2599-4b6d-9873-21bc53693fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880977, "uuid": "4a980914-12a7-4665-8369-bf3ffbaa02e9", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ae7ae9-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913584, "uuid": "c22a5560-d3e6-4ba2-9dcb-2bb2ff034f19", "comment": "Malware payload (Mirai)", "value": "dcf6d6cdd4a32b7e2853c60b2bca3303", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913584, "uuid": "04de8b33-8c75-40e7-ba99-9eb488df06d1", "comment": "Malware payload (Mirai)", "value": "0c0affe24d8abdc0d916a771e4ad2b6edb3c535671d01a6f6ea978841efad028", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913584, "uuid": "a33368ee-bfa8-4bf6-afb6-0ca950f98466", "comment": "Malware payload (Mirai)", "value": "7ea6c6f47a0e16c00d7ed69b26d7a65363fcce5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913584, "uuid": "c7f86553-c8ee-419f-92b9-8ae36840c4ad", "comment": "Malware payload (Mirai)", "value": "dc06868347ccb39843f7db9c89187b7b45a88a203b74fcdde66e6af3c05ca163b5b07aaa0123ea828fefc4c0f584f68d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913584, "uuid": "473020dd-3923-4af5-82ac-4b06f01e0de4", "value": "T10C339E65C0ADEDE8D2508AB4BD1486788713E40485A73EFACB84C6A79047EFCF5983F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913584, "uuid": "e122f5e4-b09b-4226-b5f1-fdc6e96ad349", "value": "768:5P7acDerwt7A5pyAzAROVeobdXVAKZ6BTrjo/s34j2lYj8jCIGohfiC9fjX:5jaDrwtsx7dln6BDo/s3BYjOJZdiC9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913584, "uuid": "1ea62b56-e1c2-442d-8fda-a279df8d05f3", "value": 54812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913584, "uuid": "8f93a8c0-4e8b-44c1-a1e5-7e8f3ba69f73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913584, "uuid": "fb54f463-1eed-4fc8-a6bf-95954d737e12", "value": "Akiru.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ed171d-59a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779869380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779869380, "uuid": "c0935ad2-3288-4d0b-a33f-9a1be7ce8727", "comment": "Malware payload", "value": "5b30a611cb7438d2ed12b8015aaa8329", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779869380, "uuid": "7bb0060f-b7ae-4cfd-b991-3b8b0ebd9386", "comment": "Malware payload", "value": "0c61fbc0a222b88b8095923d9ea8bf93e12b2ee00b1782379ce368224f0bc02f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779869380, "uuid": "9daf7540-2d3b-490a-85eb-ab2304c40c53", "comment": "Malware payload", "value": "b09ab1369672f03cf8654d9543b0d2f03aa6a886", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779869380, "uuid": "af769d6d-a240-4fd3-831a-c7f3b5cb2c47", "comment": "Malware payload", "value": "fec3a478796bcc69ce0b074feb5e47c76093baa6fde69acf6cf005846da683c3d1ebfe94458fa08de994eeabd95b3411", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779869380, "uuid": "67da94bc-2434-40c2-9a18-ba645923933b", "value": "T1878312E7D45822E3C6BE8F7727BB440456ABE30401FCDA0EC537C206557428176B66BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779869380, "uuid": "51b4e835-17ac-41bd-a8b7-d4736e0b2725", "value": "1536:4Wc5TD9TklJBhmFhBrkSKV0/KbmrH27ysfC7u0cz5HuItbG:uBxTSJGjBr417tC7fcdHBtbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779869380, "uuid": "29173a53-0bec-452b-8366-4a18dc87aa27", "value": 81059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779869380, "uuid": "7203e23a-7a4e-4acc-932e-4b57280e694e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779869380, "uuid": "2032740c-66a7-4500-8fb7-32ce878ad1fa", "value": "Dobrovolska_IO_PFU_trudova_25.05.2026.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6993a376-5a27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779926074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926074, "uuid": "f588854c-7590-45a1-b4fe-204a7c4bb4bd", "comment": "Malware payload (Mirai)", "value": "2f84921aa2b66ad3dc83d74a887b3d5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926074, "uuid": "af2b1d66-6701-4dde-8280-c69d5f13f7c5", "comment": "Malware payload (Mirai)", "value": "0d3a1d192ea75da438a6ec46e007fb53e028b8df10abd6dc9ba5d69196bf7f92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926074, "uuid": "0fdfbd3c-86f0-4164-8993-3c21a5cc3dbf", "comment": "Malware payload (Mirai)", "value": "f77442585f951f8ef393012946732a3e2565b06f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926074, "uuid": "b6d0874f-ac5c-4588-8bc0-a1cc4cab1483", "comment": "Malware payload (Mirai)", "value": "3ebc0f68c984923ef5412be64509172b91d5033043503af1d8b9c2712f16cc14f66f99919d3c2fbfb493ca7051af426d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926074, "uuid": "2b21875a-f0de-4054-bda1-728c437d6b5f", "value": "T158F32B52F8414F16C5D211BAFA2D128E37131BB8E3DF7212AD245F603B8A96F0E3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926074, "uuid": "4271748f-f8d9-473b-9726-bb7dd51d2331", "value": "3072:fkpJOeNeJg9b5wBaQzsAHIX9aeNSgXOKlThkRlRMP6hh1nPv:fkJdNeJg9b5wQQFoX9aJgXORlRMSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779926074, "uuid": "2807a3ae-ab05-4636-baaa-c703420ff28c", "value": 171004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779926074, "uuid": "b7de5412-27b9-4781-8137-4735d7dde1f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926074, "uuid": "ece3aa38-7bcf-47db-a9d6-3303c3af720a", "value": "SecuriteInfo.com.Linux.Mirai.9816.20108.20123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d054eaad-59f4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779904342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779904342, "uuid": "c21713c6-d90e-44e0-bd1d-773c90bb4a6b", "comment": "Malware payload (AgentTesla)", "value": "30ab21b85a091cc5bdf859d6db28dac6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779904342, "uuid": "c2b6ce3c-5eb0-4e08-a649-8efd851213ee", "comment": "Malware payload (AgentTesla)", "value": "0d83c628410771e9c37d16b83b3fca649732b5d7fc756939af9974a285c62f59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779904342, "uuid": "e947425d-bcac-432e-8eed-f160eb4c476b", "comment": "Malware payload (AgentTesla)", "value": "7a0dcb3b3012f5e7928d7b1779c498b18bf67e6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779904342, "uuid": "9a2c6aaf-27d6-4278-8a49-b575455b1374", "comment": "Malware payload (AgentTesla)", "value": "9eb25cae7771ac93eee10229e1c2103e385c353c9527e06d7cacedbeaf5c3de3c9f49278311924f0e8230dfdb06c9095", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779904342, "uuid": "c515bdae-dd6e-43ea-8d65-affc0f8fd103", "value": "T14025122527039014CA5667315F7F1FD9D333DE28063A824B8BA32AADDE37769E1E0E45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779904342, "uuid": "47e74b51-5151-4cc3-974b-42704d065005", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779904342, "uuid": "66e41105-fee2-48ad-a626-d61c7f6958f4", "value": "12288:No60FLB/bBNTiwX7aeiEbgNjaz0+HyaCuVdyrxvD9w15ZNR3O/WoGYdyQoN:N2FJz7c5a8uGrxk73O/WoGYdTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779904342, "uuid": "195f6e7a-ca89-4c03-b4c5-73e0c398b27b", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779904342, "uuid": "495289c3-b649-4bbb-8ae3-ec7ef6d6e5e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779904342, "uuid": "e89074bc-2854-4e5b-93f2-95a6f58207bc", "value": "Pedidos anteriores.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddaebbd-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880689, "uuid": "7999a7d7-7f13-4347-82c7-7be8bafe2c9c", "comment": "Malware payload (Mirai)", "value": "75224fe600b5c99b2635c285dda7357c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880689, "uuid": "26c69efd-c4cd-4036-9799-cd5a9b96663c", "comment": "Malware payload (Mirai)", "value": "0df0e95b3abc9ac7eb67ce298cb023950480386fec7810eecd2e6d7276539b9e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880689, "uuid": "a57b2a3c-7b79-4050-b634-6b47cde4d86a", "comment": "Malware payload (Mirai)", "value": "881f5640540da550552af105f9150fc8c18f42dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880689, "uuid": "3e0ed2ce-26bf-4921-9fe1-6c7198869de8", "comment": "Malware payload (Mirai)", "value": "11528ae41943f5132c1c7ffe16733438a5de3eecb894cce207df8d7ba5c6468d2ed0d73c12968ba106abcb845b793e02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880689, "uuid": "64e68b8e-ffa3-496c-a616-837a859c11c2", "value": "T173C30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880689, "uuid": "8f921b0c-b04f-4c34-9f07-ee3e85a03b2f", "value": "3072:fOD7YhjFMX+maR8TcDeRqQV3tNQYciYTG12:fOD76aX9aKTcRQVnoiYq12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880689, "uuid": "eeb212f6-4aa9-4f19-8848-d83c8b06695f", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880689, "uuid": "42598d09-6dce-47d3-b437-9a6b51cec8a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880689, "uuid": "9d4b64a4-8629-48b5-a199-f1d4cfb6314a", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a990eedb-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880655, "uuid": "a9a956d3-913d-4c3e-aa80-8c5960f18780", "comment": "Malware payload (Mirai)", "value": "db82d193b0a37d93d2863ba374a77d91", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880655, "uuid": "b1d2dd29-8bc0-4082-9b8a-0311fe43bdf7", "comment": "Malware payload (Mirai)", "value": "0dff0b43dd1504165b76535c45b75a08e921801fd1745e29474d9e33fab1e6db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880655, "uuid": "e8df72a1-adca-4efe-9493-9ba46a5f77e8", "comment": "Malware payload (Mirai)", "value": "9e3b669ad2ece811275bfbf4b4d0b785c5240f2b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880655, "uuid": "4cdbfd70-0355-4641-8b9c-0af8a5cef202", "comment": "Malware payload (Mirai)", "value": "bbab69f443cbd9fe4d410bb75e69a225c32f2504e420f28e9e74f1369ec62ac300df067854805509faf46865778c3565", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880655, "uuid": "131d5005-52e6-4e49-b859-f04ac3f10c50", "value": "T14E930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880655, "uuid": "d03e1231-5f3f-4501-af81-dd8f4fe0d5f2", "value": "1536:wqnZy8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Yhn:68NUv5nTacgzafVAwe4BNRIbT2gXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880655, "uuid": "6e66434a-2a82-40d7-8405-d38d8ba38644", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880655, "uuid": "5aaccef6-26e6-4a15-ab1d-910f5fe601fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880655, "uuid": "073a1ecf-8a16-45cd-99aa-27856621fd48", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4964c1-59b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779877760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877760, "uuid": "82158dba-a540-4aa8-b57e-daa70e7e3d9d", "comment": "Malware payload (Mirai)", "value": "7a399e3c2dc1b215d8c8936317a3a1db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877760, "uuid": "cde8f48b-ac49-4947-9023-21eb4f243129", "comment": "Malware payload (Mirai)", "value": "0e090208dcd17a35698b5894edfd9ed7e7222af9ad1b2776c3fd72b936fd5abd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877760, "uuid": "674ae97d-b3ce-441a-a329-f32136f3bbf1", "comment": "Malware payload (Mirai)", "value": "58e124c185191c2a9c676b99c23c5f68424746c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877760, "uuid": "31fbbd0c-bed7-4256-be5e-85188f71fdf7", "comment": "Malware payload (Mirai)", "value": "391258a72389efade412d2665a161f976c669c070e0248de5339762aabe36672d6c8d05e8ee5c15804dae88eb6bc2c0a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877760, "uuid": "42e0c3b1-7ae5-4c91-9419-580149e7315c", "value": "T16023F1F7C33CC5BCD5BE44B22B356A9AE05754927512CE470E943BB89D37D3122236A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877760, "uuid": "cb2e2eb7-26b5-4611-94fc-e87fbc5757f8", "value": "768:h+s/ibOxDYfCRNEwfpXeKELOg9udL0VaRHVtfUJwVHxpyPk/blFcTX8D4H:5gsEfB6xWLOGkR1pVHbycpFcTXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779877760, "uuid": "54d7d76a-3afa-494c-9362-be5d719b359d", "value": 47720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779877760, "uuid": "6e8cc8ce-9b3c-43da-8ba3-1caf52c47bb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877760, "uuid": "6af934a2-38ad-47c3-9bc3-3e28adbd1e69", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f973abc-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924769, "uuid": "aa51ef5d-6f60-42ef-a355-30609e594daf", "comment": "Malware payload (Mirai)", "value": "82cb077aaf7f266c8c10a96e9e875a65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924769, "uuid": "da0c6af4-84bb-4350-921b-dc68bc76a0c3", "comment": "Malware payload (Mirai)", "value": "0e25a754e1d2ec7c56796111a1f732727c25e995f127db5f01e9794ba04e365c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924769, "uuid": "7d6b1a18-01c8-44da-be48-ddb5fe4df9d5", "comment": "Malware payload (Mirai)", "value": "10b260f57d02577fa1f1d95ed8aea0db7db12512", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924769, "uuid": "f235bc4a-16aa-49de-9c44-e8b804ad70c9", "comment": "Malware payload (Mirai)", "value": "8a6e424327ad94b5a8bf8b8df05033ede463909316d2a67ee4918d9ec78ae4632cdbf4364da5a652b3f89df52c7f7043", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924769, "uuid": "ee73a07e-a736-4188-ad05-5d2a36364de7", "value": "T1DF04881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924769, "uuid": "71a2735a-76e7-44ea-8ad9-007292320cf0", "value": "3072:jg57Rj7LHZwbq1YSBan1yvbysxr1uGSwI:jglRj7LHZ0Bqyy1BSwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924769, "uuid": "9fe8913e-0931-4be3-a7d8-0fb6bd0a26ce", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924769, "uuid": "96c4a2da-8818-4b6e-842a-2d7d0128ef55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924769, "uuid": "c0d242c3-1331-4657-8ac4-4b85edd556f4", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49eb1bd4-59ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873622, "uuid": "795f9236-91a4-4a77-85da-456d72e1fa35", "comment": "Malware payload", "value": "d2eef178829c2274db850d6524a5ce1a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873622, "uuid": "fb9fc7d4-c968-45b7-ab14-2f1a74f81a13", "comment": "Malware payload", "value": "1054722d2834036a18e60061bb17c2b11753e81b86eecf1855528886aa88ff7d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873622, "uuid": "20f22556-3a19-4a21-8ad8-fe65e7a54da6", "comment": "Malware payload", "value": "3561e969ccf8e7c0b72d2176dc69aa520bf1045c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873622, "uuid": "5d923c87-c2be-40c1-b672-9e2dd4346e90", "comment": "Malware payload", "value": "0706f65b94559e8fb6682f49b56a8c7f5b7e6637deaf54042e4e14d230bc5460ba94706c8083f6ea9f348673c2a7d027", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873622, "uuid": "a80fc6b2-0dce-45be-87ac-26e0233b6865", "value": "T1C5E07DAFD13C7443D003D175465F8B26C39DB00A55C93E092D92DB083464D41DF237A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873622, "uuid": "6faa43df-f5ec-45f6-bb48-bdf9b854e0d1", "value": "6:5jH+AhCCIxf0PP8pyxqDKb6Kr7PpCdXNDuMhM87CzTxy7cttgojCCIxy/+lE:5jnhCCMf2P8piqKDr7PpKikM87CnxyIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873622, "uuid": "fd2af9de-2164-4707-9d8e-4312e1a0c2e4", "value": 358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873622, "uuid": "1fb9d6f8-ec3f-4287-b2c9-689a95e2147d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873622, "uuid": "d3d38698-25e3-4b8e-9bfb-a58fd54d8620", "value": "1054722d2834036a18e60061bb17c2b11753e81b86eecf1855528886aa88ff7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd306a28-5995-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779863535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863535, "uuid": "073ce48f-f143-47d6-835d-76d6caf9f482", "comment": "Malware payload (QuasarRAT)", "value": "7b32f0f0d83b8f20d5e8673263968a78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863535, "uuid": "19ddbc99-80e7-4710-a6e8-ae4c947f3b67", "comment": "Malware payload (QuasarRAT)", "value": "1059c634050e3695bd7a7cf3c2fe3c0ed47ebd80d6e45d0a0c0a9dedabc2aa09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863535, "uuid": "6d0fa749-007e-470f-b03c-73400021fea9", "comment": "Malware payload (QuasarRAT)", "value": "0bf18c4a4ae7e9bce04c66cf32b79acd90a0ded8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863535, "uuid": "ca6e1e47-d84f-4503-99c2-61daf7388d65", "comment": "Malware payload (QuasarRAT)", "value": "478ce14921f6eec6e97eaf76bca5272b029da6f86308abbd4f3c9702768194006e0d9d63a0c44b587f6c657f758f6b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863535, "uuid": "f8795898-4b30-476c-b0c3-0820f2684d52", "value": "T1417623D9B0C3C348CB747A7593CA797823DAA9E69F311700DE78BBB01A904896D8F54D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863535, "uuid": "a9f330e4-cc87-482f-8f91-4756fdc1f10e", "value": "98304:8QDlx5wgdkYbTA9blfioJ7fg8UomCe1xwrOB7WI3SfvnA1hNS58NDtwwgTCKwoVd:8QFwgju5ioFfg89gH7PCf4bNDtiTr0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779863535, "uuid": "95300e1e-3e3d-4105-984e-2e8ceb1e002d", "value": 7144448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779863535, "uuid": "b3c88fd5-8635-4043-9616-54c8bcdb87db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863535, "uuid": "a25015af-fd6d-4da4-a5ec-640d77adc1e0", "value": "1059c634050e3695bd7a7cf3c2fe3c0ed47ebd80d6e45d0a0c0a9dedabc2aa09(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fc632f-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913583, "uuid": "8322bcc8-c66d-40d4-b6ef-c6d7b8197922", "comment": "Malware payload (Mirai)", "value": "1e93f0ed547b2c3027a7bdf91bba9fdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913583, "uuid": "4bc341c7-fe91-46c8-ba28-673171df5a5e", "comment": "Malware payload (Mirai)", "value": "10646c46601b3649ed9bac961ba2544ae8f796ff88c3eac02f976926503a5875", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913583, "uuid": "3e35c5dc-d824-4d01-9162-3d322b75a8a9", "comment": "Malware payload (Mirai)", "value": "cf547f41d6be234dec9c95f5296a1ae58c2b8a41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913583, "uuid": "f8859fde-7cdf-4aee-806f-0a6ff89ac5fe", "comment": "Malware payload (Mirai)", "value": "e246055bf7f2105b34ce3c0b9377f96128ce0c8a3236e8511e3045d2cfffaf3a9f5a005ab474629847902afab0511f41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913583, "uuid": "6e7be8d1-eb17-416b-82fd-ed41ad447ffd", "value": "T1142116BEFBBB8B16C45450390E6B23103760CC5C0125D269BF717A1EDC42611BE951F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913583, "uuid": "60058c2d-872e-4793-89f3-0f650812a96a", "value": "24:3bNlDq3N0yTK+59kNFq8MAQOlhCrjSkvF6J9lnndzNTawqNs:XWVT3OFq8M5DvW95nFNuns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913583, "uuid": "737a6f62-129e-4226-9953-a2c29130fbcd", "value": 1280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913583, "uuid": "3efe5b9f-5007-4a40-81ee-068369404cba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913583, "uuid": "44d086a8-0fdd-4e28-bc0b-3749f1049ad0", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae79b586-59e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779896554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896554, "uuid": "403f4812-63c3-4356-9acd-b2286ff8fb27", "comment": "Malware payload (Mirai)", "value": "0787c023a1eebdb3add82f5b2ea7db69", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896554, "uuid": "1032a20f-413f-41c5-adcf-fe2ee74f0a7d", "comment": "Malware payload (Mirai)", "value": "10ade06e1bdf6fa72698fb424f9721c114d2c4045c66e3abdba54deea88c817c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896554, "uuid": "5f69b4e1-727f-4e70-ba67-dfb11e7836f7", "comment": "Malware payload (Mirai)", "value": "0ec81e26ddc4f6aa8a3932a0a6ef4c45e55e790e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896554, "uuid": "4fe876b6-f993-4287-b484-d42e20864595", "comment": "Malware payload (Mirai)", "value": "6e02190644c2fb23d10243890cfa22f6752ef255ac4a4fc7e2afff9e715480cd4722ef195e360376d4f49583419da5c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896554, "uuid": "5dd4809a-c9ec-478d-b26f-ea9a0b66b6d9", "value": "T1B5534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896554, "uuid": "5e5be7dc-7816-43bc-b26e-425a2b4b1ddb", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQOLiKimfFoktCe3fYRMe:WShU3q7cEDlCK/0Dm9i8Fok06fYRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779896554, "uuid": "7702a23f-e2e1-4156-889f-9c4c47f36f1d", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779896554, "uuid": "91a7ddd7-2a3b-40fb-ae54-fa9a43c36558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896554, "uuid": "c0cbff51-d104-45f8-991d-6f27e3218dc0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d512f44-59be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779881037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881037, "uuid": "161cccd3-bbd6-4f9e-aafa-3a494316000c", "comment": "Malware payload", "value": "1ffbbbe114842eeeb2702baea1465326", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881037, "uuid": "9124c944-4f7f-4561-a240-9fe929a525e3", "comment": "Malware payload", "value": "11e7d072d327b1dbeb7ea037479dfdda249f70cd71279a79f459d3047223b23e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881037, "uuid": "aafec063-1047-4684-bc16-4d0ffe6aa1ff", "comment": "Malware payload", "value": "d5a092eb52db6ac3250aa8fd7d7319f613feead1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881037, "uuid": "ee4f1d95-a846-4488-820a-7de434c47331", "comment": "Malware payload", "value": "4f34925eaabfb97c1087babaaca3b904f1455a030fee87a5300632084217feb082adba0167fe1bc1496f2368c5410306", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881037, "uuid": "1a1ddbe5-4666-4b7f-8b2b-f17df79b5b9b", "value": "T198158D46F2F334FDC067C030835BDB626936F46551222E7B21C4DA392E96E741B2AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881037, "uuid": "206c7193-d3f4-4032-b66c-eb0d5bdd5149", "value": "12288:0vFcHOuAJuYp2nByuLG/fqfQ9UQmyI0cbrSp5k/O2PX1dbn:0vFcHOuAJv2nByuLGXR9vKSX6X1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881037, "uuid": "85893015-cb56-4e23-8d29-0fb0099f79ee", "value": 925520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881037, "uuid": "2bfaff9a-63da-407f-871d-93b9ff959bbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881037, "uuid": "4e301a63-ee19-481e-90fa-caab1400e92e", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06af1c59-5a06-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779911735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911735, "uuid": "ef26ee05-030c-4f7f-b45c-e661666c941c", "comment": "Malware payload", "value": "36c9a5dc3a4852ab0781e3ac2cdc44dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911735, "uuid": "25ad71b1-3971-4094-a2f4-1932ce299643", "comment": "Malware payload", "value": "1274fa660aed04a7c66a18456116f158b7fa5160e4dfd17c53d6f0defcd190f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911735, "uuid": "294a188f-9c86-4196-8a00-233380c42be2", "comment": "Malware payload", "value": "46cee3f7e7ee014b2a39b2d201ad7fb9e009d124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911735, "uuid": "c74301c0-1205-4b7c-871d-c4db2feaafbc", "comment": "Malware payload", "value": "01a465a53ebb66e7580abca4967f3174fea1570f498d22ae587ba1c6f75df579e060cea0be15c83ab4ad2fe3acca0601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911735, "uuid": "6e10cb17-f3da-42cf-a3a8-22ec513964c6", "value": "T193357ED73829F6ABF3512F3AB06B711261F13563AE86A4066BE487434A3C4D1193EF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911735, "uuid": "8a83c566-208c-4d58-9992-f406c1a35e38", "value": "0c0ed4f38294fad568fbbc8de070d14a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911735, "uuid": "56af2d39-b17f-44fd-afff-741e78216e62", "value": "12288:AZ2NHBQGHWqOc16mJyXCEnGjs5yVKEUlfWA/+Dz5j91YBDg+VC+q5/koWtKDGkKO:Jh1r2RjEpv2RVvSQFMENDbXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911735, "uuid": "0029473a-9d39-4053-a6e7-f7be15ca12e2", "value": 1157904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911735, "uuid": "60f4759e-9251-4a96-959a-71b64e7f0bfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911735, "uuid": "3f8b2f21-45c8-40e3-81d6-3fb3f4863220", "value": "library_categorizer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e3cad7-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911660, "uuid": "5676b14a-4940-4506-9d30-16f901ee24b4", "comment": "Malware payload (Mirai)", "value": "b1c56780950fb48b9c8df296234d2463", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911660, "uuid": "05a3b10a-c895-4025-aa2b-fc655529b436", "comment": "Malware payload (Mirai)", "value": "138c2ea01746be7ae284ec1e342b601143b3f9216a96195847c0d7694b254b27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911660, "uuid": "c47484bb-51be-4a6a-bb8f-d83bc4351da7", "comment": "Malware payload (Mirai)", "value": "221ac8d5daf4adaea40922f47a2f5bf9cc54aaf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911660, "uuid": "60aaa764-4e78-4e60-ab5e-cd6c60a6f1c3", "comment": "Malware payload (Mirai)", "value": "8f1c41c3fb16a15bbdce3d6b8e062c48a1c896934284ecea108e2d37292d4ddda643f2610c0f34e4053cb5583dd5e0fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911660, "uuid": "23473ccb-1a2f-46fc-baa5-034902e72aca", "value": "T122430264A31602B1E91809300BA74B9C235E0FBD5297B831A15BFF9B9C151FACD13EBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911660, "uuid": "bdd0d5c8-5fbe-4d5a-9d20-4a0b81f74faa", "value": "1536:k4kKad2CGj1NUqIpaBotfHathOWSQEbY8WpJHVJuQ:Jyqxt5B77CopJHVQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911660, "uuid": "aa164062-abb0-4b16-9a51-bb043e15993f", "value": 58232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911660, "uuid": "928aebb6-696e-4d1a-b60b-b7cd012c99b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911660, "uuid": "04587470-28ff-4e23-954d-5de904083b02", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881b5b8f-59c5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779884035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779884035, "uuid": "8b389952-9ce0-4644-899f-67515e81726d", "comment": "Malware payload (AgentTesla)", "value": "f66775b7fa033ee4906fe67b40dd55a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779884035, "uuid": "bee5f899-8486-48be-99a6-5fb9abba9d4e", "comment": "Malware payload (AgentTesla)", "value": "145512ad0ee1ebe7ca3e4298be88ffa7cdb984b535128430a65acccc9d19ff14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779884035, "uuid": "644d10a6-5a90-4f02-b7b8-346e5d3001ad", "comment": "Malware payload (AgentTesla)", "value": "c3835c0534fecb3b8456755dacc59a4b0d5f878e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779884035, "uuid": "2de79df0-8cca-486e-9fe5-c911c0ac49ae", "comment": "Malware payload (AgentTesla)", "value": "c30ffecdfce3640db434b3070422861edc4791edd2842408055b3f8cbf852b069621d1622ca9ad5c63d1a5d598b9761b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779884035, "uuid": "72fcced5-9454-4be1-820e-5eec7e22a321", "value": "T11355842597F9020DF8F34B14AE79505FA836BE16193CD85F2154194F0E32E48EBA9B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779884035, "uuid": "0f799976-abc3-4fb0-94d0-46abe2bb351a", "value": "6144:Sw7fGxQHldbGgcJ8dBN3QSI/qBMBK25aB+06aqQSV938oAqIy:HzGghB1In82S+ha43rB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779884035, "uuid": "6c9f2e2d-f429-491d-aa53-2bfbb42d62c3", "value": 1305678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779884035, "uuid": "c5541f32-7088-428f-b8dc-6e8105fe3dd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779884035, "uuid": "0394af0d-b5a8-4cbb-96e0-5eb73c763a36", "value": "Quotation Request.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629a9f7c-5961-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779841022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779841022, "uuid": "fd56b182-c4a5-4f8e-a1db-1d4bc4b2a0cb", "comment": "Malware payload", "value": "db37f1d04ada140969b06841f4cc94a3", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779841022, "uuid": "63dd4216-a5c3-441a-b319-9734f16c4144", "comment": "Malware payload", "value": "149e406467ee8bb435bf7e898bad00b01a8f5e663c9d11080f25f18dcfb3ae41", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779841022, "uuid": "809bcb87-7733-4302-bbf0-cb00e52cf346", "comment": "Malware payload", "value": "f2cbf205cd15bb26f4363558ee81c46e91141384", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779841022, "uuid": "cfe0a3e3-d2be-4f26-a6c5-cfebe986e1dc", "comment": "Malware payload", "value": "285bdf2ed57be321e414c8bce1c441346ac8cd82a40cc131533b4fe3f573a5f9bbf6a87b2b7cca39651cb85952e29c0c", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779841022, "uuid": "96c92763-fd27-483e-b490-548c25c951eb", "value": "T10408337741369493CF513E38F8F946C9BE3AB4009222D10CB659518FF982F942E5A6EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779841022, "uuid": "cae2fdc9-12f6-4771-839b-ec3da3d395f3", "value": "1572864:fKNF/+FnEIrs5Vro8y14BrGJK/jVgB36eZ7Hp1rdA6azk7S8il:yLbes5724BrG8/mH9A6mkvil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779841022, "uuid": "a33d4ff9-6117-4a11-804c-de15b0d59522", "value": 84232502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779841022, "uuid": "bb2d3e90-573c-4d7a-99dc-b343d1002b54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779841022, "uuid": "91cb7a4f-fad3-4511-99d5-3298283029a7", "value": "Voltrix.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4043de-5998-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779864818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864818, "uuid": "d840a0a3-b73a-4e0d-8ddd-7d796b7b797b", "comment": "Malware payload (Mirai)", "value": "d1fbacacc5fe7111b741bc30d1e23f5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864818, "uuid": "314208e7-d585-4775-a54b-6c1ff274ba8a", "comment": "Malware payload (Mirai)", "value": "14eb149c2bb55324ddef103f3ddec69167a4f20d00417c2f009cab3f9cfb2a48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864818, "uuid": "255f7e47-50f8-48fb-ae2f-9defd0486e40", "comment": "Malware payload (Mirai)", "value": "cfa4bda01cd57d1036ce9dae037346b7469d7305", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864818, "uuid": "68cd31a9-4ca7-4ffd-a043-a5b46cd1182f", "comment": "Malware payload (Mirai)", "value": "da5a3b296448e001e1256c2343c8c557d6c19cd7cb9081c9b6e7ccb5036be2bb3036142f0de2c4eea627a5629391e12a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864818, "uuid": "c5e59cdb-b585-432c-92ce-f0c6b5c5687a", "value": "T11F243A03B5D08DFFC4C69BB81BDB91258973F8291B36620AB798FDA52F0DE946D0C614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864818, "uuid": "caafb8ab-eff2-4e09-9337-41255279541a", "value": "6144:ovE3PMr6LOp+EYNiS2csysZJY17nSIrwxxu:oc/MrAwYp2csysZJY17nSIrwxxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779864818, "uuid": "4387ac73-e38a-42be-b87a-0254ac3b495d", "value": 214043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779864818, "uuid": "a6b4b88c-7b76-4edb-8b51-bfb7aa7b49c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864818, "uuid": "b1d5a1c5-80b1-436d-806f-1825aecce706", "value": "bot-7040216d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb8aa87-59d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779890997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779890997, "uuid": "2c4ea5a9-1e10-40f8-ab19-2c3c1ad3f3dd", "comment": "Malware payload", "value": "d0f0f7ec82a950d03dd36d5001edf360", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779890997, "uuid": "f16634d5-d277-4910-8c91-4d8efe4baad3", "comment": "Malware payload", "value": "1514b1268e9dc6d2f37137aa38c756cb4bf8186ac9235d6863b78e7f8bbbe976", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779890997, "uuid": "08123bed-1bd5-4265-a967-5042552b7748", "comment": "Malware payload", "value": "4642d3242cbb8f2bdcfbe7ea52f0d309f45afbdc", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779890997, "uuid": "c07404d4-0f0a-456e-a2ed-bd339cda8e43", "comment": "Malware payload", "value": "26bd789615cf18bf2965c9e16d78de59f3a5454987050ee91fb6cff487bdd630092cd5cca1895ba0846cf4b103f32634", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779890997, "uuid": "6cd00e99-b4ee-4127-bfdb-f678510c2f35", "value": "T1264733C0F1DF96C9CA0748F5020AD9F5DC4C8639B5092476EE4F263639CF9EA72E8295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779890997, "uuid": "fcbee157-dd87-48a9-8ac1-8c2131366290", "value": "786432:K/SmuJ6u7hKO26ZeWhmtrhC+OjO4LUJIXjsTMzMHDZgM:AoFKOfZqZhC+NwsToMHD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779890997, "uuid": "37d33f43-0c7f-421e-a015-893dd4135176", "value": 26555757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779890997, "uuid": "179fb92d-f0d8-40de-aa01-e69013875b4c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779890997, "uuid": "a0ea54db-3c63-4923-bf9f-3119dbe4e6eb", "value": "check", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c458b0-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880655, "uuid": "70428b8a-56fd-441f-b1cf-d36daf8a276a", "comment": "Malware payload (Mirai)", "value": "561eae58a24ecc785e5b4b16f741b735", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880655, "uuid": "55583123-d693-40e4-a702-1cc715d5dc53", "comment": "Malware payload (Mirai)", "value": "189964d8a7c20670d27069905393935a9043e89ba48e68457721ce6cdb52e3db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880655, "uuid": "e9fe8fa9-109f-4191-ad56-36c1e1facad7", "comment": "Malware payload (Mirai)", "value": "2a1da6799a76aeb10b7394fc79cecfc6c8eede9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880655, "uuid": "ced61952-b52f-4847-9f4b-8c176f91b6e1", "comment": "Malware payload (Mirai)", "value": "f4bd664dc5b30929ed424345d1ecd6788e3ea9a1e2cccbc8080bde8ef26087ca0fba0a5bc4a7693956567b544c9f12c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880655, "uuid": "f7732de6-c23c-4c8b-9088-96dedbafbc86", "value": "T119C39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880655, "uuid": "6a8c5591-6e5c-46e1-927b-71e27245fe70", "value": "3072:+f0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU42qe:+f0tJBR4NSALD7rnCrheilqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880655, "uuid": "807ceaa4-c94e-47cf-af78-1ef5d126a6b5", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880655, "uuid": "80abcf37-704a-44cb-a0a4-5457d16dc78d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880655, "uuid": "f6581877-d381-4dbb-9825-cf7845b985bb", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad53ec3f-59e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779896553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896553, "uuid": "e39b55b4-6dd5-405c-9aec-a8f98fe36277", "comment": "Malware payload (Mirai)", "value": "73319c71123b0cbb71827b44ffaebf13", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896553, "uuid": "05d3dbe5-86f1-4eac-8924-9f50fe760e53", "comment": "Malware payload (Mirai)", "value": "1a6f98f604b264e41a31499a990986522f049a56ae3b97e23e3178e43ada8c2a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896553, "uuid": "7bd93066-92d1-4890-96f0-42cf5355210e", "comment": "Malware payload (Mirai)", "value": "ebaebadebd9819948c979997aaad8eadf8f6ed92", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896553, "uuid": "3d0c3f3a-f27f-4a06-8d1f-c29c18add417", "comment": "Malware payload (Mirai)", "value": "7b0adfceb0ab40fa2e24a6803dbee55399e1f3049fb0a07a94b569fd2b5f7a57bc7251134a1ae616a4355e628c4661a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896553, "uuid": "78761c89-a0e9-462a-bdc3-29dc589c1e2f", "value": "T14183D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896553, "uuid": "6b01a737-7067-4669-be99-1c795e96b7e0", "value": "1536:iVLyu95KZtkj752dCexuV/8UZlDwfkJ4MYfW1:iVLyMgKFezxu5VD1e4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779896553, "uuid": "318d58f9-6e08-4904-98a3-0efa6983115b", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779896553, "uuid": "ac751014-2633-4a8a-a7cc-bb3f0d6e1a54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896553, "uuid": "f6998c77-1e9c-4990-8c8a-deeb40034ca4", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fcb5a4-59c8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779885474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885474, "uuid": "50423a8d-d735-4cb8-9680-f781017905d2", "comment": "Malware payload (RemcosRAT)", "value": "4ce519251ceff1dc3719e22d8ba51faf", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885474, "uuid": "f4cce6a1-121a-4fae-9451-5f344171fba9", "comment": "Malware payload (RemcosRAT)", "value": "1ba5cd4efe4e3ea5751e2ae04bb37c4858bc286f1a3adf2d5c76b44348a14708", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885474, "uuid": "a7d30d7b-fe95-46f4-9a2b-438590508dfb", "comment": "Malware payload (RemcosRAT)", "value": "36882ec6df27839fe7f4a50dd4e25ab6c00e691b", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885474, "uuid": "e4cfc3bd-8793-4966-95ce-8218849a4d45", "comment": "Malware payload (RemcosRAT)", "value": "c4acdd31ec0310fc4242ee85b2abe285447bc0ccdcec0720bfa6c2300343f22f5ac1086a1cad222fb61da409b09d20a4", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885474, "uuid": "bec61752-11f6-48b4-99aa-28c8bc8c3dcc", "value": "T1DFA3D717BA4BD0B3E42191F186826BA18FBC7C333646213BD74FC9419DB8486D456EFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885474, "uuid": "f8a372e5-2d59-4acd-9a53-dc992cf697eb", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885474, "uuid": "c90f169a-3d50-48a8-ae22-707a5f8cd606", "value": "1536:AhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6Gr2:GhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779885474, "uuid": "cfcc1e9c-41e4-4ded-864b-6541c6cadb5e", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779885474, "uuid": "ff4f3898-6ef7-4c59-83df-4358beb38efa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885474, "uuid": "65bbc331-731c-4436-8f5a-cd7c83c361d1", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d8fd5b-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878795, "uuid": "e2fb46a8-0f17-49af-a45d-86b74320ef6b", "comment": "Malware payload (LummaStealer)", "value": "bdea7d4600362f81dfd904fcc39a1497", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878795, "uuid": "b0821530-15ce-4913-bcc2-da74baa307a9", "comment": "Malware payload (LummaStealer)", "value": "1be00853158d3cec8b0dbcdfc82c96b70c8d50dd4c74c1e6ea9923ea63ff18df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878795, "uuid": "ff8ab9ea-972f-4139-b2b7-b546246f8f5c", "comment": "Malware payload (LummaStealer)", "value": "9e23d8a5128b2329d3234f7922c66c0dccc8eee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878795, "uuid": "756cf6d6-5cd3-4b8f-b662-44b5f6e58e52", "comment": "Malware payload (LummaStealer)", "value": "a7bec6f63d1597f761da0b0a419d7bcb5fde7baec23e1ffbff0af28c5daafbbe62e65f873468ead26d964935bacfb998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878795, "uuid": "1a0f1dea-d7e6-4a1a-8608-40a9c1cd5ee3", "value": "T1F4748D4AE7B748B1E5470975229FB33F9B2416144328CDDBDFE0CB447A33AE26539A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878795, "uuid": "89e671eb-f4bd-4e44-bb11-87912ad179d4", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878795, "uuid": "1de32441-f7b9-4f4d-a554-fc1f18e7cec1", "value": "6144:sRLI6zZvCw5/8m5RtUHD2zSnK90dK7KDhAoK4Yeh9bDvJFeBs1WX:0Tj50mhUCzSKGPlAoK4YehVvJFeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878795, "uuid": "580ea085-74bf-45c3-9b0d-4b0ef0602f24", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878795, "uuid": "e92702ce-09a2-4a4a-9ddd-abdbfe516a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878795, "uuid": "9d79906f-f73a-45ff-acc5-1e63a2d2284a", "value": "1be00853158d3cec8b0dbcdfc82c96b70c8d50dd4c74c1e6ea9923ea63ff18df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58a6be3-59b7-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779878098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878098, "uuid": "24aa9bae-6b30-4fc7-9c29-2bcd76fa52eb", "comment": "Malware payload (NetSupport)", "value": "e407232ae9ff10716bb01c167fd8aff5", "object_relation": "md5", "Tag": [ { "name": "5-252-177-201", "colour": "#6D7D18", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878098, "uuid": "bd04eea4-1047-483b-bb04-036111d33a3b", "comment": "Malware payload (NetSupport)", "value": "1c3d96278c93ded0c6b8030c9f2f3f779188c8a599d65fb030311a388e2094b2", "object_relation": "sha256", "Tag": [ { "name": "5-252-177-201", "colour": "#6D7D18", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878098, "uuid": "640b8466-070d-4981-a9fa-9afebaa729ce", "comment": "Malware payload (NetSupport)", "value": "a04bf62bc8f8ea2f9860f32e9c5a3fadfaa96fb5", "object_relation": "sha1", "Tag": [ { "name": "5-252-177-201", "colour": "#6D7D18", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878098, "uuid": "35d87a97-e93f-4410-bb2b-1bd9d3db26e6", "comment": "Malware payload (NetSupport)", "value": "38bdd8586144ea98a24833a5fa99ccded6fff9edb3a664fc3d5000cdf862e07b04e15daf2f0179fdbda3bbd732d1d199", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-177-201", "colour": "#6D7D18", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878098, "uuid": "e13eaa08-1bb0-4dc7-b25e-4e8d4446865e", "value": "T1E5A533C6640BEC9ACB44CB30C05FDF225BBE2F158F963581F39A159CAC8D9184B2D967", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878098, "uuid": "627c1b61-06a0-4f0e-b4e3-19a7eff78d68", "value": "49152:HGWKcquayYrp7mnpVhEBNO9GAeuAGW4XpY2F8cMUCFQOJK02h1N9U:H5quJSiZENOzeuAGrXnF6uolcVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878098, "uuid": "6eaf9aa6-bfb6-462a-a7ae-66e0e07807ee", "value": 2235597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878098, "uuid": "9b7d499f-fe13-4822-a9c4-fdab6908c84b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878098, "uuid": "cf68657a-f55a-46e6-9e7c-956b7156ce9f", "value": "1c3d96278c93ded0c6b8030c9f2f3f779188c8a599d65fb030311a388e2094b2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6315e2a0-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924775, "uuid": "fa783fe6-bd9e-4b4d-ae38-b158866eeb27", "comment": "Malware payload (Mirai)", "value": "070d718fe8433b60db4d045386bc49b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924775, "uuid": "fb0d4875-bcf5-4318-bdc5-52150905c176", "comment": "Malware payload (Mirai)", "value": "1d748fa241e103392dcef743f0fe47299313182fcf4efa6e785249455dc82535", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924775, "uuid": "4c4aefd2-cf37-448f-9ac4-4a8165d3154c", "comment": "Malware payload (Mirai)", "value": "a646bb13caf24c25feb2144f87a5114578678375", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924775, "uuid": "dfe5e3ff-b2bd-42cd-8c7c-747580ec0164", "comment": "Malware payload (Mirai)", "value": "df7c8ae68091709ad628985f3712d3977a00b3a49fb140f87668797d5648ba5bce9057c286bfe40bfe442c656a0a7efa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924775, "uuid": "a072c033-ba37-46bf-9203-d97b22550bbc", "value": "T14404B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924775, "uuid": "c46dd0c6-bb57-4b4d-a49f-dad4b56248ab", "value": "3072:nKpzGeeNkSfcQqmav8SqaRVlnYz65GVt:nKYeeNYQqmeqavlg65G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924775, "uuid": "48d05cd2-3fbb-4604-8163-ddd795e55545", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924775, "uuid": "2ec4bcd0-4435-48ff-84fa-d175dc70a5d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924775, "uuid": "30c118b6-962a-4751-87c5-2d46375874b2", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45b3cf7-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878928, "uuid": "85b2eeaa-11c1-4c61-a23c-b4ee5dcc5705", "comment": "Malware payload (LummaStealer)", "value": "1d65eac6e0accd8d5b26867d46c877bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878928, "uuid": "68691c52-7eee-4cb9-9850-a53eec34b202", "comment": "Malware payload (LummaStealer)", "value": "1df4691de5b6b58dc99baece242d3683b93d3ee214b2e523de061088b7c5d882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878928, "uuid": "ad0816ac-7838-4ea0-9104-8acc63510e2a", "comment": "Malware payload (LummaStealer)", "value": "c1ea061c409b55676c399f9b4df3546806421646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878928, "uuid": "e5e811aa-2c89-417f-8975-6bf0e65133cd", "comment": "Malware payload (LummaStealer)", "value": "f685b08a1b834b98455e8d76170479c48457c84687b5c63e9b259ffd43d2322ac2cac2fd528bf2a6701fa18cf6123d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878928, "uuid": "767bbea2-478c-4572-a5e0-2316202e5a7d", "value": "T100748C99E7FB58B1D5470938215FB33FDB3426158728CE8BCBE0DB00752B6E26639606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878928, "uuid": "b30e7345-0bc8-44d0-8a9f-dbf523cb1f51", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878928, "uuid": "785c90de-18a4-4046-81e1-5ab8030dfba4", "value": "6144:Jq59DxVbJnraQYg/MqPUZ52LJlEfsX/quQhqQmWWuI40ANKwywe9IHyaQvRegS2m:gPDx5JnfvU2l5sWuG4Kwywe9IHyaQvRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878928, "uuid": "cca2f1a2-5a1f-41c5-b8ce-207410897d31", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878928, "uuid": "7e8c0f8f-3594-4ba6-9cf2-ee6833de3cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878928, "uuid": "dad9a1cf-6a95-42c9-92fc-6c5021469c04", "value": "1df4691de5b6b58dc99baece242d3683b93d3ee214b2e523de061088b7c5d882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7e8395-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779881012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881012, "uuid": "916e5c61-4576-4825-a5b3-87eca10ddea5", "comment": "Malware payload (Mirai)", "value": "12db6b1ceb3b2889b182b5efc7dd780e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881012, "uuid": "dd4ead4f-f264-4183-b5a6-42494591654c", "comment": "Malware payload (Mirai)", "value": "1f7550f0acdd8f0328fb712cd2c4c295306d9bd09677eb00a047d42d902998eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881012, "uuid": "efe88a60-5c9a-488e-afdf-c7f3544ae8fa", "comment": "Malware payload (Mirai)", "value": "20aafe8ed89fba18c074f2efb0f87421a846b63c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881012, "uuid": "83a39b55-536a-4d27-a222-a4d10fbfe487", "comment": "Malware payload (Mirai)", "value": "39e50c38e8fd9de93a1fbac4fb4d6995afbf18ebdd46874640dfc1e23289aaa79166d1f92bc623590c61c0ad9d26d421", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881012, "uuid": "ed98940c-a774-4488-bbca-3b8a4b2a99da", "value": "T1D8B43949F8409F61CAD639BAFB4E429C735B4BB9D3EA710699101B3437CB85B0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881012, "uuid": "73fbf9d1-8e4f-4161-9409-c60fb814d20b", "value": "12288:fkvjeFvozDfgbaKppS0Xaj/w1jKqE5xXMjPAQf2IlfZpuJr2e:fkviFvoXffXjmexXvG2Ila5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881012, "uuid": "d6150c48-0d8d-4465-8977-e32cc2e5ffc9", "value": 529616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881012, "uuid": "ae3a8126-989f-485f-b603-6527a2871d4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881012, "uuid": "102d00e7-8192-42e8-a556-bff1b61ac411", "value": "bot_armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add0319a-59e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779896553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896553, "uuid": "a4283baa-36c4-401e-83af-6678a060af88", "comment": "Malware payload (Mirai)", "value": "2e8200fe95ce83ef3cb6c93b6f871f22", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896553, "uuid": "60559cf3-2e92-4f09-9f2c-c6279381e322", "comment": "Malware payload (Mirai)", "value": "20503e09da260625289f39d252879767b805b3fd1282932f42e95fa7d239ae0b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896553, "uuid": "80e52922-c474-40f0-973b-305485abdcaf", "comment": "Malware payload (Mirai)", "value": "346efe0ffc7af9733bf3af60966a591df31ae8b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896553, "uuid": "c064ad62-e64e-4e9f-804f-ba0a79408875", "comment": "Malware payload (Mirai)", "value": "f11b45a3fe67ad733b31173f42e4ffa631f2330f177155097d7a097417cab87363694c7199c1468ea92058c99a078c8a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896553, "uuid": "4aa3dff8-7e99-4aab-82fa-3b7697e14f29", "value": "T198534B02B31C0A07D1A31AB0253F5BD197BBEAD022F4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896553, "uuid": "766037db-f421-4f5f-b6f6-07f30a371b7b", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/UGV8+BCpEMsm/J9KCrMvuBxANUr6FV+tMiwWyIC:MvolWm+phBgd1KCAWBxANee++bWyvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779896553, "uuid": "599c752a-779c-4933-9405-930a4846ddf8", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779896553, "uuid": "31512963-5791-438c-8242-16e00cec0877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896553, "uuid": "fa04a228-1d20-4268-8d36-9e59a351bcfa", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8226cd91-59be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779881018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881018, "uuid": "6acf6368-b431-4f28-ad0d-0facb34044ba", "comment": "Malware payload", "value": "c4ecff806a7769a2f976fc4baafb8836", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881018, "uuid": "ed1ea5ab-5004-4eea-b991-f416ccc4bc9d", "comment": "Malware payload", "value": "2100ca1103613dd3d7bfac58a047758123ef5b30a2e068885658dbcca845f91d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881018, "uuid": "fcaca79b-c623-4c0c-997f-a0d99cd39e7c", "comment": "Malware payload", "value": "e27342ebedf276a6091f98ae85d12a01303c3eb2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881018, "uuid": "e4a5022d-6d65-4c73-809d-2e96fb993e0a", "comment": "Malware payload", "value": "384c0613c416f6010881ced05317246c1044372d2ef33567e28fb1475e110ce15bd3a214a023e23d7a403803952c2c6c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881018, "uuid": "8b3932c9-b7cc-43d4-b0e3-33becbbe607a", "value": "T10F658D9BB7B674AEC567C13247ABCB211637F07A01015E3F25D4D1342E92EA41F0AE6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881018, "uuid": "a5b26b3e-f76b-4de3-bcf7-1c7bfe4b035f", "value": "24576:ZwFkAkMk4wHRXmOgS0VXnBYZhTsBKnfsjLX:ZwFkAkMk4wxW6TsBKnfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881018, "uuid": "942a34e0-6176-416e-a2ba-d66fca3d1393", "value": 1516536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881018, "uuid": "8b9ef3a4-e5c2-4934-ad18-c9a581a7385b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881018, "uuid": "f917286f-3a4c-49d4-ab12-6de120a98235", "value": "nig.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e43b03e-59e5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779897708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897708, "uuid": "7b9757c4-4994-4dd5-b8d4-f8331ac7c306", "comment": "Malware payload (RemcosRAT)", "value": "d01c8cc1330525ca49dc04a16d43626e", "object_relation": "md5", "Tag": [ { "name": "89-40-206-73", "colour": "#29C15B", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897708, "uuid": "b8d7431e-d937-4050-922c-f79456a5cca9", "comment": "Malware payload (RemcosRAT)", "value": "2103139d2a4fc3964956f7f3e83077d0769c7fa28d7a127ff057550df79d025e", "object_relation": "sha256", "Tag": [ { "name": "89-40-206-73", "colour": "#29C15B", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897708, "uuid": "1a8da069-0f2c-4b02-aae0-93e444402b91", "comment": "Malware payload (RemcosRAT)", "value": "1590cf6ee89a589de33a7904a72ee701a874de98", "object_relation": "sha1", "Tag": [ { "name": "89-40-206-73", "colour": "#29C15B", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897708, "uuid": "421ad8c7-19dc-484e-a9a9-1db4a93e1f80", "comment": "Malware payload (RemcosRAT)", "value": "23cb93486ea052610112020d0b808be5ed8a8d993ca9e00f214a6d4ad8c21b573ebef32a2f19231116148433bef9ecd5", "object_relation": "sha3-384", "Tag": [ { "name": "89-40-206-73", "colour": "#29C15B", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897708, "uuid": "fcc099c7-ec68-4fdc-914b-5029f40e8238", "value": "T19AB5E1B6144371FB4765890997823A04BF796D8B2D62A80B7DEC30D6DBDDC60CB2D4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897708, "uuid": "f131ab73-f838-4894-807b-297498282daa", "value": "24576:b3C+c5vT3u0hdSSF4tINPMcvltbkNFH+ZcABYW+QGSJg2hudrzqqY8XcQW4OlUyv:b3qvF4t54BWtGzudqOXcQiHQmWPcRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779897708, "uuid": "57b3fd02-9b73-4aaf-9e17-50b49de109c7", "value": 2412170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779897708, "uuid": "801cc796-a06d-4ef3-96f0-74b00dbfa3fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897708, "uuid": "e3474261-6b0b-4e41-b4e1-14cf85e342f0", "value": "SCAN-1107_L0904-5265Z500.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a70a7a-59c9-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1779885859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885859, "uuid": "59479575-88ae-486e-b6f0-845581314318", "comment": "Malware payload (SnakeKeylogger)", "value": "e8b6d9aabd8f04ae399c37557092e465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885859, "uuid": "a7223730-3be1-4274-867f-44cec949c43f", "comment": "Malware payload (SnakeKeylogger)", "value": "2263046083f6f559100f194783e989d27b1a854977324c939734e877aa75a842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885859, "uuid": "2be84cf5-9413-424b-8eb2-f65e5126d2be", "comment": "Malware payload (SnakeKeylogger)", "value": "f2a20ad875677df03894417ed9e5a7fcb3438b5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885859, "uuid": "20f6b6ef-0790-4a26-b2dc-ad5b5398befb", "comment": "Malware payload (SnakeKeylogger)", "value": "d904d2ac927bf8b7da25abf76ce31145a16d0ac3eb0184bee5b07daad88f45e9bb29817f02a73512db4928185efddd7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885859, "uuid": "22aa396f-a4be-40a1-bc3f-5b711aa1b355", "value": "T16925F1143229CD46D4BA0BB81961E3B467B45E5DF426E2079FD1BFDBBC7A7A02C00693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885859, "uuid": "a1925482-1bf8-4b3c-b3ee-ee1ebbc45a90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885859, "uuid": "efcf49e5-cb47-4d5e-8aa1-3b1cad2a01ac", "value": "12288:n/4arm3h1fAJRkVj8GirD1+oN5DDk30Y1MNKIZM8cU3YhBGcr6CIu2B7nBPpAsm9:nA3nAEFT0DEoU3BqXeincDIuWTBPW0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779885859, "uuid": "5fcb6784-fa38-4eec-9db0-4adfbd2efb17", "value": 1039360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779885859, "uuid": "e7bfcc4c-a427-4919-b915-9b928abce266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885859, "uuid": "3dcd8a55-4914-4e8f-ae8f-a4fb8d7f57b2", "value": "SWIFT_35469.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729c7f7a-59bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779880133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880133, "uuid": "b085bc70-c6b7-473e-9c25-f22048ebe494", "comment": "Malware payload", "value": "17f160d3e129e7f3f8767cb15717c8a4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880133, "uuid": "463f8ff5-3ff4-4004-8c47-0d05edc06a9f", "comment": "Malware payload", "value": "22d53a7cb32c066d82bfe91b44116b331b6c46042988f78c846b7ebb94bff6c3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880133, "uuid": "aed3bd32-8170-422a-8128-e3cad71d5765", "comment": "Malware payload", "value": "f5c3bf7c411a36ba1870d7c3d71aedd39c3f615b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880133, "uuid": "5006c100-0e9b-491c-b01e-e16a816b40c5", "comment": "Malware payload", "value": "b854542e53c9d7eeb5f59e9b4a9cdbac65e86af3ade538a264fc9b82808d96f888b8e3a18990adbd1c1de9d473469e9a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880133, "uuid": "b0721af5-a5dd-46a7-92e4-2b384f2b7a11", "value": "T1DA21A3AF52A0B1F3445D8EB2F76024E2E04CC1D2A6E1CFFC706C46A2455A34C72A5F24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880133, "uuid": "4aa8a929-b418-4d91-a254-33dd9a9e8292", "value": "12:bf2Gie7WeXZR87sZRWsdBNpENIh2rNIhmDu6aNaDu6ayw7qG:bOJpX8BbENI8NIEKPgKPnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880133, "uuid": "267d8c9d-3835-4926-9c46-a3297d2b9563", "value": 1162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880133, "uuid": "74a75ae3-c8b8-4e6f-ad34-4b05d36e436a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880133, "uuid": "0ec37169-87e8-492e-8afb-9e933a03c9b6", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3807429c-5a00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779909241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909241, "uuid": "39920a24-2798-4b6e-a2d6-5bfd193bfff7", "comment": "Malware payload", "value": "7c162caaa14633cb025e42aa4be2f37e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909241, "uuid": "e4c9bd8c-25f9-4c31-83d6-31f893e2976e", "comment": "Malware payload", "value": "22de370310e5cb4d825f81687315d07c630359ef93d2061da12b379bf25cfedd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909241, "uuid": "1943add4-b13d-4d50-ab28-87fdfb21d88b", "comment": "Malware payload", "value": "7e15f1eadc02e182606178ad9c036bd8858ab6bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909241, "uuid": "8fef29bc-f4c0-4059-8706-fdffc7083d19", "comment": "Malware payload", "value": "bc62173c83ff75e0d34520c4eb1e915601fec7c93ebfe1fe31d9493073467a81e2c4b238fa5e8f07baa16ec1adef12c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909241, "uuid": "4cbce81d-51b0-42b9-981a-05a34bdf725b", "value": "T172D30845FD448F17C6C265BBFB4E438D772A17A8D2FE720399256F20378B95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909241, "uuid": "a544f3dd-2cd4-4220-9cbb-2ff2a2d380d4", "value": "3072:RH+1XBZqOaQQq7awyFpQ0UIFvBqbonAO1:RcxIr9q7awspQ0UC5qbonB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779909241, "uuid": "30810bbd-8863-439b-bf45-8ca0a18fa9a5", "value": 132920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779909241, "uuid": "1d04a80b-362c-42c1-ae7d-0b362d805c7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909241, "uuid": "156c2c8e-1857-44d8-bf44-c4db4a05f0c7", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7f2250-5a04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779911178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911178, "uuid": "8ee6e4f8-a23b-4053-8a3b-7c8e3a835518", "comment": "Malware payload", "value": "ec1a016a36d47fb92cd6e332bc532d9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911178, "uuid": "8afe56a8-eb29-466f-be78-6be93af9e7f6", "comment": "Malware payload", "value": "256debe5a342de9bf02e049fa3c4c25fd57f4f7ca4d33de19c6fce64d0becc23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911178, "uuid": "6b039ce0-a9f5-40cf-bf1e-79359034694f", "comment": "Malware payload", "value": "0be514864f8543bdf8c1c3e185ee9a2d35efc3b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911178, "uuid": "b729d6dc-45f9-4e23-ab32-36122a98b786", "comment": "Malware payload", "value": "81a72e8688599e8707fcfbeed4daff50265827cdee6f2bc14235e446272c3d203c3959ef005e123653211f88cf9065e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911178, "uuid": "deed3a8c-04eb-4a38-a048-612129c2836b", "value": "T120A402BD71E333FCD8FAD138A6432091B9A770904A745EA7E794912530B1AE8297DF24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911178, "uuid": "a99b4315-7807-400d-8c43-fe25d9559bc5", "value": "101e9da62927c83ffbe9363e7b60b054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911178, "uuid": "844a47de-fa1c-451c-a5b9-8b7f67f4e996", "value": "12288:gtHHk0JtmWuSPJg+Wa8kTe1gtiS5vmAI56:gtHHk4uSPJ9WqDt7vU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911178, "uuid": "4016c50a-82da-4ac8-991d-856478623022", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911178, "uuid": "39dc7c28-d41d-4919-b0d2-fe42ada2f95b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911178, "uuid": "94de3873-60d4-449a-b2b5-ff95da828690", "value": "filter_pressure.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8210e4-5996-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1779863827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863827, "uuid": "62b20672-786c-4f8a-8ba0-f631224c5ded", "comment": "Malware payload (BlankGrabber)", "value": "13b1003c07ee01ef590fbab110a5fcc8", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX12.file", "colour": "#DCEA0E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863827, "uuid": "2590eaa4-e730-4a12-b13b-e732dab7ac82", "comment": "Malware payload (BlankGrabber)", "value": "25b046e0b0898c177cf05aca75154935cdcd615775d62d425b90b9ea09c7d497", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX12.file", "colour": "#DCEA0E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863827, "uuid": "6b0fd260-9fe1-4dd6-bc9b-99ca7c004257", "comment": "Malware payload (BlankGrabber)", "value": "0f64d1defc66420f4ff8a06004d7ed0bae7c61aa", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX12.file", "colour": "#DCEA0E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863827, "uuid": "776398e2-c061-4605-a68f-536244f79e63", "comment": "Malware payload (BlankGrabber)", "value": "dcb51ad384e16f76bb2fbb294192fb502edf9b19b45cc2a4078eaee2629220f86205f05d3bb2da0875691f977a7e3e90", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX12.file", "colour": "#DCEA0E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863827, "uuid": "aadf5a54-bcba-4311-949c-faafd79c51c4", "value": "T1C77733A47A51AEF8D873BC36D8014F8176AE74013343D6874E96DD81EC4A9F42E3BA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863827, "uuid": "5b7cd5c3-3b3d-406f-8d1e-e455269efb41", "value": "ad510aa4318530074af11ba8249f6938", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863827, "uuid": "4da360dd-a0e2-420c-9e73-c5cd43d17be0", "value": "786432:JfZm2TY+2BXSzMnG4pIqnZm5GTQmx38h+3QNXECWbIpFK8:JyX4f4NZUGT5x3iAQZfWbIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779863827, "uuid": "673fac58-65a2-4323-bd68-3c00337279aa", "value": 34312096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779863827, "uuid": "fcc77c8c-56f1-497e-8e6f-5e5564eda639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863827, "uuid": "56cc5b74-480c-4837-a133-f4d890eec244", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935ab00d-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911541, "uuid": "5ffe38b8-7717-4e50-861d-1ab1e387a819", "comment": "Malware payload (Mirai)", "value": "6376f2f15d937c71ffef99f1981e2cb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911541, "uuid": "357036cf-c6c9-4193-93e2-f9c3ffac72f1", "comment": "Malware payload (Mirai)", "value": "2604520be1dbe1f3d7840aff034c0ce1b162b7bc042fdbfc4a6360b9fffe08e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911541, "uuid": "e0458bad-fc16-4bd9-a711-ebd8f826dfca", "comment": "Malware payload (Mirai)", "value": "39a99bcf758c29bf506402b8d9e5b0eb00434177", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911541, "uuid": "430e7665-804c-46e2-91fc-3c21a6e2459f", "comment": "Malware payload (Mirai)", "value": "5e90180303ef52f8e1e0fa9b5b5ed3f6b1d2bdb4a888be460bea145fbf4ff455d6129afbf24f48d09587d55d5111937b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911541, "uuid": "792d2388-c77a-4349-abac-85b5f0f0cd93", "value": "T1AFE6E805ADC52BE6C82D4A3480EDCAA602B05D145BF14A7A51A4FEADBC772397F47CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911541, "uuid": "7164009e-1ce4-4336-8025-29333d900491", "value": "49152:rRmDN8hq5SDODkp4W0EXZKpWxrMxzN4Jwe8GDAcquqbu++91nz+SGrxQ5RehiCUm:6kp4W0EXIUaUDATk++91nz+SG8dJ4DEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911541, "uuid": "99170788-641f-4762-ace7-abd9ba6da51a", "value": 13893825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911541, "uuid": "3855befa-26b6-4240-9a21-3f72df510565", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911541, "uuid": "e3c3232a-c270-4ef7-a9ba-7866a2f0525a", "value": "wife.mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35592dc0-5999-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779864998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864998, "uuid": "efe208f1-ccb4-4e6b-bbc6-45ed1306a9f5", "comment": "Malware payload (Mirai)", "value": "5628d428d868d36157dd4695ef215145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864998, "uuid": "f514b2e3-3642-47aa-9f24-8dc4ba5dbb96", "comment": "Malware payload (Mirai)", "value": "26fc16079f94c53a658bc75b7bd7bc9344a86d6eb2000bdd259d126af45ce1ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864998, "uuid": "3ba6b09a-068a-40ae-9395-b0f896948052", "comment": "Malware payload (Mirai)", "value": "7892c26b66faaa8f34a1a01946f81a1631e650e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864998, "uuid": "43fbdc2b-59f1-4f05-abd4-7b22d1292cfa", "comment": "Malware payload (Mirai)", "value": "8eae32abcaf21383807c93cf445c43fd5972dc2a95bdc7f24a0bb5c87aff111614d15bb543c98363bb218c8bfa737389", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864998, "uuid": "02978870-6132-40fd-8f23-73f9429b1560", "value": "T1EE4302FBD976AB95EF3D2E745A55C8EF3BA505EFEE04DEC2509263821301D36A402C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864998, "uuid": "c5c8180e-8ee0-45a2-ad04-0e8328f3da85", "value": "1536:mmGrJVJGZvrcqCw9FDwFB7shoaGPTdRBFyM6T4u+qgw0zs:mpJGZvjX0Ps/GBm4u+qgwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779864998, "uuid": "06684d02-ceba-425d-8600-8bcd63f4cba7", "value": 60056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779864998, "uuid": "165c7211-9dd0-4b96-baa6-52207c1fdc45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864998, "uuid": "a31e9884-544f-4ca7-8c93-59fb75701f06", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8df126-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911530, "uuid": "2d693052-f7b8-4db0-b918-e81e8d25ae9c", "comment": "Malware payload (Mirai)", "value": "da7dbd42c186d29e3162745edb34120a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911530, "uuid": "facbc338-dec2-450b-b8b1-36ceb299812c", "comment": "Malware payload (Mirai)", "value": "27e3127f68baec36ef51532d41780a3c1d3b5d32fdc47385edcba20e2f608e50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911530, "uuid": "0887a1db-7788-40f1-9b10-75642bf496f8", "comment": "Malware payload (Mirai)", "value": "59f7a7c1bf61c6630d2295b8faac5a692a729768", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911530, "uuid": "bc7a55e1-e2c3-40a4-b304-223c5806a7a6", "comment": "Malware payload (Mirai)", "value": "47501a9c951cbaa65d4387c97ea32a63ee46ff05a7a52f8f7d2468df4f971824831ca961d949b119b68647e91b24e9e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911530, "uuid": "e317b2bd-123d-4b8c-ad1c-ed91bc6d4e75", "value": "T105D65A47EC5695E8C5AEC134CA7696237B317C495B3123D31BA0F6283F72BE06AB9350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911530, "uuid": "ae77dcc8-e96c-4be6-80b6-0e918e45029c", "value": "98304:pOfj9VjsuXAXnbYnVKFbayhA++91nz+SGT8uQHGzHLtXEx:pYPjsgQ6++91nz+SGTD1Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911530, "uuid": "a0642a0d-5062-41d8-9b14-88aa1eafa758", "value": 12767394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911530, "uuid": "c445e56f-619a-4e2a-a5f8-9781db4775e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911530, "uuid": "53198bfe-85b2-46bb-a665-458f43e95508", "value": "wife.amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f08e983-5963-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779841956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779841956, "uuid": "cf9c6905-cb0d-4c08-b284-0cf1bb89a78a", "comment": "Malware payload (Mirai)", "value": "5ef6cfd8a51889d8e94df9aefbf6f4ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779841956, "uuid": "d2230460-61e7-4b02-b0fb-3e29608e3e96", "comment": "Malware payload (Mirai)", "value": "283878b622d6838d8bed8df3fc16b94eec9ea301bd8082027d4ec03be96d8a26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779841956, "uuid": "0b714fa4-2644-49af-a81b-c9fe6cabcca4", "comment": "Malware payload (Mirai)", "value": "7370e9b907b3facddb2d6f2cdd113b31a106fc39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779841956, "uuid": "2ba1c4b4-508b-41ce-a26b-b278cd04e047", "comment": "Malware payload (Mirai)", "value": "3242b85354795665ac09a873ea262e11fc1f63ac18ac36f8b45bb860e2136d28c70dbd5e8a0fe38c2a7c1fcfbf3e15f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779841956, "uuid": "366efa23-86a7-4eac-9084-52d5625ec486", "value": "T1E8637CC5AB43D0F0FDA71278003BA3529E76D5364638EB86D7A52E369C13B019E1B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779841956, "uuid": "425b9554-4518-40f0-a98c-28a251a1ed67", "value": "1536:WUQYmTQXE3a46zz5+BJLloQ2TiqB94kWSMwF7Y76yCMkBSjsgutR:tQYjU3OzzUKQ2T37WPwF7LyPkMsgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779841956, "uuid": "8966d1d8-39c4-4681-b434-82391f63216c", "value": 67600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779841956, "uuid": "30f3644f-e58f-4c6c-9bc5-b8ece7598c6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779841956, "uuid": "b524b780-2e1b-4572-8a2e-1b7c656e7ca9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c434177b-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779911623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911623, "uuid": "364defd6-dd0d-4656-ada9-c41ec15b766c", "comment": "Malware payload", "value": "dc2ae4d85ebdc51a7cdef3c766812812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911623, "uuid": "2ed84255-ea25-4143-a33f-be1a2bcdf97e", "comment": "Malware payload", "value": "293422c19a189eb87b7be4e7eaec24d692a6ad00424bb051f316fca657502dae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911623, "uuid": "2bc76374-e949-433e-b549-6a91f308e480", "comment": "Malware payload", "value": "86060f2a993f5ae03669734dd54c605d518b4338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911623, "uuid": "dfe597bb-9890-49b2-b53e-47055056901a", "comment": "Malware payload", "value": "952faa09f20373e523857c1de76ce2637642b7ee14cf69e414bfea0f7e6b6f6befc8efdeb8ac0f30180fa43dc1fcfbc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911623, "uuid": "8d009e43-2174-440a-b46a-948b35f7ae1a", "value": "T14135AFC19BD45A3EE379323C051A2E51AB5E3DD04185A66FC2C75EA3FEBD1E4A063348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911623, "uuid": "ee05bc2e-1207-4a88-add4-327b56f1258e", "value": "796580ed73f770e6a33579a434fcd6c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911623, "uuid": "8fc8c744-a426-40c2-90fa-7b2d7e554cc9", "value": "12288:WuUWv0dL/lDhZpSiKqdcU9oNjMpgYOo29rP9A1YS7I0vIUFCmtg9/Gg2dgdUi2fj:WuUWvgfa4dIo9OmT7gfVNDE/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911623, "uuid": "84da666c-2c97-4db0-bca0-0041e075dd32", "value": 1137452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911623, "uuid": "3534c306-163e-4021-a253-ec1dc9b65c06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911623, "uuid": "381b96f9-6e2f-4762-829c-e27fd8e53084", "value": "pixelmove.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982c7466-5a08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779912838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779912838, "uuid": "9549c3a6-6971-4860-bbec-e3b34d34c08d", "comment": "Malware payload", "value": "29677374a1a35b8826a52280e6fd32e4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779912838, "uuid": "e2cf7515-27a3-4576-8e24-5887d5e940dc", "comment": "Malware payload", "value": "29ef831ad2d93bf09b88a2996f4cdef19d0ae34d7e4ebbdd53d6ca7a096a5bde", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779912838, "uuid": "3bd37dec-ade0-4db2-a93c-aa4379522e96", "comment": "Malware payload", "value": "8a0e954743759cf9fd68ceeb729c8d33c9a34a06", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779912838, "uuid": "6cf845f9-391f-4590-883e-06e048e1a068", "comment": "Malware payload", "value": "27c3a0971e6d4e80090b8041dc5f834b11355ce789283a62369525ce598fdc4c5fd020ca04a946109d2b6e12a6f2ed0e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779912838, "uuid": "73e533f6-c911-412d-82dd-1062f122e590", "value": "T106137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C19B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779912838, "uuid": "bedf5dc1-bace-48cc-9cda-e00741cedac6", "value": "768:C4+w9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:C4+Ncy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779912838, "uuid": "369c85a4-2bd5-4a8a-8dae-400fa5ad7d63", "value": 45526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779912838, "uuid": "0461e675-6ae2-4b7a-80e2-2bbe6107f2e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779912838, "uuid": "2938797b-e21b-4841-ab12-2c7f423444e1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f632e337-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880783, "uuid": "89fbe36a-5c1f-4539-8c39-642f9e451e22", "comment": "Malware payload (Mirai)", "value": "fc5af3c2332f02244d267184768e106f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880783, "uuid": "bbb7f081-3f9d-48c6-8926-a808fe961b69", "comment": "Malware payload (Mirai)", "value": "2a6b901388bc11a9189e19f4535b67edf611277f0d446e61bdad1412513504d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880783, "uuid": "cf659f60-5560-40ef-b395-b20eeccd4559", "comment": "Malware payload (Mirai)", "value": "e6bf7ede53dc3f841ba230470042ad69b61c2774", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880783, "uuid": "42d4d135-6eaf-4451-b969-554dc75bc838", "comment": "Malware payload (Mirai)", "value": "18038aacc1e8e7df8197424e30c1e86e287c9b4ae611939cfb81f8bb3300757ff2c41f82ab20cd6ffa6825a9260ecc8e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880783, "uuid": "ce5ef074-088f-47f7-8b4f-7695ac963182", "value": "T107B2D0A25D483550C3360D3AE8ECC4C1CBA99AF4D0AF3A2656048725E6CBE4D6DF37C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880783, "uuid": "4a7a1ac1-22ca-4bea-b23d-ea8e6b580e59", "value": "768:JkvQNjl3QtO+r8iDBE4dLMXc487E+s3UozLT:JkvQZqgiDBpt2cT7EjzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880783, "uuid": "96f4a147-bbd0-4920-beee-2200a694cc4d", "value": 24684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880783, "uuid": "28d8e2a7-b75d-4a03-8a04-61d1ee332f32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880783, "uuid": "f3d2e417-58da-42cd-8ccc-f32dace9c652", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4d3343-599b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779866137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779866137, "uuid": "73cbbebb-3947-4eb4-8886-bc1fbaca0e56", "comment": "Malware payload", "value": "ea5746e5d0aadbafca4f8c7327be2151", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779866137, "uuid": "35b04176-8fdb-4524-8652-1d5913c9539e", "comment": "Malware payload", "value": "2c132f6be7d33439a4926d044901478baa0ca9d12e2d8af2142712e892e1494e", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779866137, "uuid": "57aedda7-dd6f-46db-a1a6-eb6a50028623", "comment": "Malware payload", "value": "20028346be0d1cacafa10fa8d028b288e4bcaf75", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779866137, "uuid": "a6e334ac-c7ba-4f4a-9a93-db62de754ef3", "comment": "Malware payload", "value": "1d772989ca86fe3ec984f104b4ace9bb569f87bd6797cd450a5fc857436e1885ff65a1123d11d65f7ee3e64746c6b3f2", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779866137, "uuid": "27ded290-6619-432b-81cb-e596130cfd15", "value": "T13D14209725B36EC2E42D1C37859F11003B92B10F3D0BA691389FE7843F7A4949ABA7D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779866137, "uuid": "197fb7ee-a648-491b-abc3-e73c3c4e9c6a", "value": "1536:vSC9Xh/mYRSpysrbkZemZyJEVeFzYrHMXTXxmrYYj/trzq+eNhfuNV70HjWQIRu2:vS6gZMlqWtMRBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779866137, "uuid": "327c797b-d9ec-47c8-be77-029d4a83a244", "value": 195118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779866137, "uuid": "99c66709-9233-440a-b0ab-ce2342f11ef0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779866137, "uuid": "5fe177ed-5529-46b6-91cc-583820381210", "value": "Berlin_Template_Daily_40.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c4a697-59be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779880835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880835, "uuid": "b3a11e22-439a-46d3-b3ae-2e847a5078be", "comment": "Malware payload", "value": "e05c1de31d581b17c9eadad4a0a376a0", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880835, "uuid": "5d70fabf-eda0-42d0-b0ee-29db23bc888f", "comment": "Malware payload", "value": "2d02047d0b4147701f33a09c4d54ca01bd5e6db0adfb2cc490c3e1212bda0aaa", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880835, "uuid": "ecd306a1-9cb2-44b5-b23c-1211a8d0df72", "comment": "Malware payload", "value": "7c922697260a5e105a1e3957de456fe64d85e1c1", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880835, "uuid": "e71a97b3-a307-4239-a1f6-ff5e182b20d4", "comment": "Malware payload", "value": "be9c562a36048aa8c531f8068511249709681bcfe68ca9452652fe1536bcf24befad706c2782149485523c17f1c3ab8d", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880835, "uuid": "f6c7e209-57a1-443a-b978-cf8695354e0d", "value": "T15ED565B9CFD523118D45ABC76E668B7FA3256C7188332DC877A4A3CC47963AA570301E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880835, "uuid": "59f6242f-62ee-46b9-a75f-b8b0c6c1d79d", "value": "49152:Qiz91Jr13vD+Lc2d1uCRN8ed9U8o3EQQHeVxVn26Df8Phg44BHY2gSL/PqKkYLX4:Qiz9rrVvYc6keN8eFWxQ+VxPDrfHY7cO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880835, "uuid": "6b364f98-966d-4c6c-a992-543a305d6fcb", "value": 2847378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880835, "uuid": "9e6bc0aa-7a23-4e8b-918a-2375f1c27a0c", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880835, "uuid": "829add75-d429-463b-820f-286b1f65e0e3", "value": "cac.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca1d547-59a5-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779870459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870459, "uuid": "8f1273b6-576d-4328-87c1-703501deb17d", "comment": "Malware payload (LummaStealer)", "value": "3b8d7692966df16dde1da2887378e062", "object_relation": "md5", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870459, "uuid": "21be6d1f-f410-43c9-adab-21167f36c5cb", "comment": "Malware payload (LummaStealer)", "value": "2d2544b3ea1903043aa259015c7c3853387589d79d5c9aa227765bb7fc2bacfd", "object_relation": "sha256", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870459, "uuid": "a1d283f5-2e4c-48a2-9ce3-628e565361c0", "comment": "Malware payload (LummaStealer)", "value": "407c52dab085f2acc0e587e096b92f960ed42e61", "object_relation": "sha1", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870459, "uuid": "71e6291e-cd07-440a-a905-971a083b68e7", "comment": "Malware payload (LummaStealer)", "value": "984999d9be553a605aaf5f753fa3491f53f0d1fd78973faff240368ea8dfe81103607bacd1bf645deaf6764483dae83e", "object_relation": "sha3-384", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870459, "uuid": "756331a8-e644-40a8-920c-42adef865b72", "value": "T13CF4220235C280F2DD2A5A306660AE7A9FFCF8B64F116BEB67941036DF745C0967643B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870459, "uuid": "81d35d50-4225-40de-b958-1dd49c6ed99b", "value": "21f765297fa9653ef21199b37f81eeb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870459, "uuid": "b588a2de-fbb2-4e88-9936-85042239fd1a", "value": "12288:SZOOIkzlNMiUwu8eDexo7oplIGF+cRVyCEI5bjrUwu8eDexo7oplIGF+cRVyCEIK:jOIkTM7T8eD626nsOMLT8eD626nsOMbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779870459, "uuid": "758742b5-b32c-4e86-9f9c-923b3524c8b1", "value": 730752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779870459, "uuid": "1b14a8a4-d3b1-49de-aca3-5a4a751e6ff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870459, "uuid": "f71ad1b3-00dd-49d8-a9cf-99b8f962b1d0", "value": "2d2544b3ea1903043aa259015c7c3853387589d79d5c9aa227765bb7fc2bacfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088351c0-59ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779879096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879096, "uuid": "c0ba5174-a17d-4854-abd4-13a3ed56fca8", "comment": "Malware payload", "value": "b1ebffe7dbdc664553066170f62d63b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879096, "uuid": "7d787b8b-e289-460a-a0e6-0f1d735a7ce8", "comment": "Malware payload", "value": "2db0a305f1eab0dbba2317c24a27b45734703a70c5b8c3519c1b576cdd8f3d1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879096, "uuid": "13498060-ab4f-4423-9bc2-0b2df58d95d4", "comment": "Malware payload", "value": "fa568b1314d315807f6c829f921e5f00b888158f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879096, "uuid": "87cf4d3a-46da-450b-adef-82363774e4e3", "comment": "Malware payload", "value": "e309663b04cc7546746b832867d6603f4b4789a641626893def6629caf700911b8d8803f529734bb1164b5d6817e7070", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879096, "uuid": "33cb4a88-9838-49e6-a354-08bd786079ac", "value": "T1BB257D1AA96C01F4E0A7D278DD560512E7F27C8A53319FDF03E08E651F67AE06A3E319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879096, "uuid": "d949ccad-5795-4ca4-a01f-7948ec556c57", "value": "9a0e9663f96cbb6d92a119e6e2d7e760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879096, "uuid": "367a5865-8d91-45ab-8daf-e492cfcaf9a1", "value": "24576:3iqfYMmMKsmsCMmMaMmMCsmswVMmMCsmsRI6XZj9OBs3iIGDVj/GjDWNFI:3RRJZOK3i9DVja6NF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879096, "uuid": "9e8c25e6-f59a-4c19-8130-f5b448517e90", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879096, "uuid": "910878e9-2b3e-4e3a-b4a9-a183c79c3d6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879096, "uuid": "28d9006d-97bc-4bf7-a0ee-c10f14019670", "value": "2db0a305f1eab0dbba2317c24a27b45734703a70c5b8c3519c1b576cdd8f3d1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80bb124-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878934, "uuid": "3880d5f6-ead1-4a18-a510-ae700a3244e6", "comment": "Malware payload (LummaStealer)", "value": "95fc102591760764cf5ab29bdc0737cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878934, "uuid": "f616d9a6-b686-4aef-9967-8a64b43ffa4b", "comment": "Malware payload (LummaStealer)", "value": "2e45c8dadcc1f857926efb02edac7643eae5632357259ef7a86cdd95ecc6d042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878934, "uuid": "791914c8-1455-4747-95c2-53d28793dea0", "comment": "Malware payload (LummaStealer)", "value": "fa00f9876b746797d544b4086ce93f35229349ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878934, "uuid": "a80e5808-bfbd-47b0-8fc5-1373b3f25579", "comment": "Malware payload (LummaStealer)", "value": "2cd55c38e8a3b98a6a8efb4070d8e72480dc2dce30b2c7427a30a805440fbcd793e77e4a600b345b1d2a2a7e75e472a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878934, "uuid": "2e251447-be57-49ff-a939-d98cf406fb60", "value": "T19C748C99E7F758B1D5470938215FB33FDB3426158628CE8BCBF0DB00752B6E26639606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878934, "uuid": "b1ed0c30-5304-4ddd-b8c0-032b33128561", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878934, "uuid": "7191d898-c80c-4893-bca4-18c484cefc49", "value": "6144:Jq59DxVbJnraQYg/MqPUZ52LJlEfsX/quQhqQmWWuI40ANKwywe9IHyaQvRegSsL:gPDx5JnfvU2l5sWuG4Kwywe9IHyaQvR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878934, "uuid": "69be7849-9f2b-486a-b248-7c0844eefc6c", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878934, "uuid": "9bd84273-3cf6-45bc-8b9d-7e2965c3a532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878934, "uuid": "e22ce2ba-c9b6-4240-ba28-f634d80d0cf6", "value": "2e45c8dadcc1f857926efb02edac7643eae5632357259ef7a86cdd95ecc6d042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf7b7eb-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779881035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881035, "uuid": "f3d63ec9-ddba-45b2-a0fa-dfda574090a9", "comment": "Malware payload (Mirai)", "value": "457989170b9ea2b93eff4493c0db9d94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881035, "uuid": "bac8c4e7-e96a-4257-ba7b-f93fd19204df", "comment": "Malware payload (Mirai)", "value": "2f6a598654d7f8f8d6d1cd37ac8e54efd8a320b473e343f17cd7d3b75a6ded13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881035, "uuid": "28fc29b4-3365-4103-a215-af5aaf6feaf6", "comment": "Malware payload (Mirai)", "value": "7630885ff8184a03809a39b9573abce8926bfc00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881035, "uuid": "2c08e17b-2394-47f2-9bea-91810626caf0", "comment": "Malware payload (Mirai)", "value": "75ebd1085502cc353a2c84457251b36a6a6b38fd400b2599bddfa6ef2a7f42d24c619f4c50a2137cc3c92575fac19f6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881035, "uuid": "d6884f26-b51d-4a5a-ad37-7ed1bcaf83f7", "value": "T100D47C9BFE6E3C47D2D7E33E9B4AC3B0622B71A1D21351637581022C99C6ADCCFA1651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881035, "uuid": "80419772-780d-4601-a8b2-d88c9a8913de", "value": "12288:YCvqTeQytTkB9w+p7diXdzxYe7qs5CZBOp3Agv7wtAH6s:YCvqTBPw+p74nYeeIw+7CAH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881035, "uuid": "b474b147-ebaa-4918-bcbf-82808591b9c3", "value": 631136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881035, "uuid": "d942654e-6550-4e49-8000-2ed0ed363c47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881035, "uuid": "39b58a52-b0fc-4366-aaef-771076853d0b", "value": "dlr.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2b8e43-596b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779845464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779845464, "uuid": "ea757536-e48c-4f04-a521-7a096de2b08f", "comment": "Malware payload", "value": "403f227a0abc2c3c07fce6198e1f0fc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779845464, "uuid": "d049d820-6c31-4d8b-9fcf-883630aecc79", "comment": "Malware payload", "value": "2f9030391b7a35f891d2b9e099facae79e290dc9c0c41c86bc6af6cea9c8c204", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779845464, "uuid": "7343d58f-e30e-4061-b3db-a3448d21f4ee", "comment": "Malware payload", "value": "015ba373d5083a1367d53b7c6277ad98f5ac727b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779845464, "uuid": "fcf3ce74-0711-4c12-b848-902eddb81700", "comment": "Malware payload", "value": "5b67b06826a464a592241423b8d8a3e9ea1d76e34cab0b158d0ad7f814628ef83a81883d940d79cf16f78b1ec9662611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779845464, "uuid": "29f67476-376c-41e3-a545-341b6be83798", "value": "T10857CF7792067CEDE9B94DB4C41015816DA878874778E3C7BAC870E6A6EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779845464, "uuid": "a8714f28-4747-44e6-b09a-f93f540b6a78", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQc:cqYUQuVDt0TZEAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779845464, "uuid": "15a2b5d6-4740-4bf8-9e06-ddde856facbe", "value": 29294592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779845464, "uuid": "95715941-2db9-42a2-b701-404ba057a512", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779845464, "uuid": "d5831379-1338-4572-91ce-e779cb81739f", "value": "2f9030391b7a35f891d2b9e099facae79e290dc9c0c41c86bc6af6cea9c8c204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b0e2de-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880945, "uuid": "d6a3524b-430c-4611-a109-25afedb88c8a", "comment": "Malware payload (Mirai)", "value": "f8b1f483345d28d3f7e9d0b2e8846da1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880945, "uuid": "3776a8bf-0955-4976-a9d3-7fd26a8e41db", "comment": "Malware payload (Mirai)", "value": "2ff823e7283faa23015b312a4c17deccfbfcfaf92445654000bada973036b809", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880945, "uuid": "704be9d1-76aa-4484-b56d-799693447a13", "comment": "Malware payload (Mirai)", "value": "d40f8b899f3b0be59bfb43cb836d241dcdaefee2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880945, "uuid": "ad9ab636-e3bf-4feb-b64e-03d3e9797a03", "comment": "Malware payload (Mirai)", "value": "d98951141aa37aeef2adaad9439a0b24cc5b8ce594e8a89f5ef9a3697a261248c2902c4ab06eb37c8804fd8f839535af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880945, "uuid": "2a3f4730-7b50-4627-9c89-7b7f7ce8b7c8", "value": "T172E30945FC918E17C6D522BBFB5E42CD372A5768D2EE31038D255F21378A9AB0D3B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880945, "uuid": "bad929dd-5df2-4386-ad3f-8489ad5c6543", "value": "1536:Qt54i/5Ma3kr8NI9+MtVqF7WvWnySVy4VDxh76AwZ+oCXBgP2rSlEuwywh9w08wY:Qt5z3kwpMtVu7WvWs4xuARxbNOMt07Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880945, "uuid": "a2bc94fa-cee4-4b9a-a594-a3ab21177237", "value": 149580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880945, "uuid": "d5c1d56c-a72f-4a60-a3bc-34fb412695f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880945, "uuid": "57973713-ded5-4b62-b58e-654fde5c17d5", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71510c3-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911655, "uuid": "cde66837-f8a8-49e7-9fc1-cbe607f7cca3", "comment": "Malware payload (Mirai)", "value": "6175ecc8abbe35ec61549759acb6dbad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911655, "uuid": "2195d577-d728-412f-b7e1-9a0ad438809f", "comment": "Malware payload (Mirai)", "value": "30d988b2092ea1f1992c5a89bb37c3edbb55a267df66c3dfe49e1bf4e6be7aae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911655, "uuid": "9b25481d-d831-4a5b-b8c7-b8801e88f64d", "comment": "Malware payload (Mirai)", "value": "f412ed64577f94c04711b206816c457e4e880351", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911655, "uuid": "9a9529de-1a68-4171-9a0e-31acd2dbc405", "comment": "Malware payload (Mirai)", "value": "d6e7cd91dfcc97e76e28280a849041eeb334cc0eed9e59a0851c7b4705458ffa704e1aa9a68f1d045f94e5663a96f95a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911655, "uuid": "fcdfb2fc-65d3-4e8f-bc2b-9f95d8b9b445", "value": "T19043F160FA601AC7CCA98CB4819E35715F1D722536DF87DD6B170A81A31D11FB5A833A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911655, "uuid": "b25c7c71-f7f2-40f7-8a08-83cc0665c0c4", "value": "1536:tIrRD0gn1aEVi15uooQJpP8LIYUK5xUStCXK5ns:OdUEiOdWF8KK3kas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911655, "uuid": "5da91d6f-0221-42b8-a606-10b6fab0678f", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911655, "uuid": "d69cfe8f-6285-41d8-ad4e-9f71f32c8be7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911655, "uuid": "cc5d46d7-c252-417f-9aa6-41e6e4304992", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16afb27-5961-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779841154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779841154, "uuid": "ff58908c-987e-40a5-a4b1-76d3ecd09222", "comment": "Malware payload", "value": "da245985dccd8d0d31aa0d8539462d22", "object_relation": "md5", "Tag": [ { "name": "atualizanavegador-online", "colour": "#18B94E", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779841154, "uuid": "b03b0742-628b-49ed-9f5c-e7a797e69b17", "comment": "Malware payload", "value": "31b43a3f7c15b25f7066983d9d3fb0361681de5c4d8bf0c2e5f64a1ae91e7cfa", "object_relation": "sha256", "Tag": [ { "name": "atualizanavegador-online", "colour": "#18B94E", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779841154, "uuid": "75edadbe-eb7f-4f24-9c79-f74539e5e25d", "comment": "Malware payload", "value": "7146a0e270baddd2323691ceedd2ffdff2b72745", "object_relation": "sha1", "Tag": [ { "name": "atualizanavegador-online", "colour": "#18B94E", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779841154, "uuid": "09070f19-08b2-4e2c-bbc6-d158977cd11b", "comment": "Malware payload", "value": "51cc4980c6752b05013379a835ea7669bfba5aec8bd89b7048d9386938f30522dc5c2419c74d81e8a3d2e97448d788c0", "object_relation": "sha3-384", "Tag": [ { "name": "atualizanavegador-online", "colour": "#18B94E", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779841154, "uuid": "737beaa5-f1f1-40a8-b2e1-7adef2335d34", "value": "T13E2144456A6283D87DB12A64C27E9106B0D6821BA5C0FD58F7DCA112BF21653EF0A1F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779841154, "uuid": "9d91ebac-74fd-48cc-8a9f-226938c752c7", "value": "24:k42cLLhJwYgTjMTGqoLldp6XlH0RY5lTlqh9TAKUZFBKG422UClESjLBKuYjxfSa:k4lL7wbTzBMXva4Znno9y8hNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779841154, "uuid": "971b1464-8cf6-4f62-9072-f7e01757932a", "value": 1330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779841154, "uuid": "df5536d6-1d76-47ef-b8e6-87a0fbc03570", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779841154, "uuid": "5ae56493-fbce-4c46-a738-293aa8c75f18", "value": "31b43a3f7c15b25f7066983d9d3fb0361681de5c4d8bf0c2e5f64a1ae91e7cfa.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b90602-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911653, "uuid": "2a3bf2b7-b8bc-4d43-b0cf-04879136907e", "comment": "Malware payload (Mirai)", "value": "c3f9363ddca2df6fb6b47bd07423dce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911653, "uuid": "547c658a-a7e7-47cc-8070-c6023001a8f5", "comment": "Malware payload (Mirai)", "value": "3250303de37e8399a540ff0a67b945b5c4123d3763289cebf3925fa8a17e377a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911653, "uuid": "f370b34b-5267-47d9-b217-11813a9d5a4b", "comment": "Malware payload (Mirai)", "value": "f1fec933ee967d8d28e1bad81ea447d05d572b46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911653, "uuid": "db2ba689-9124-46fd-b95f-98c3ac4d0beb", "comment": "Malware payload (Mirai)", "value": "51fab2baea89937a6c5cf0333cd216a1e1f20799d2ead04db53bcd9340aebf03a12a1bcf9d66a845aca92265c583ec08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911653, "uuid": "cc487cfe-fd31-428a-adfb-b325bb112a11", "value": "T13DA2E1A6E3D3D671C6508936EB7C84A26DD0CBB9F7FB30B3102182D521C1E960AF95C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911653, "uuid": "1cce3fc0-1161-4cc9-b522-6148c99d45f4", "value": "384:MOTec4Qq28dNSrGxwmI+mCsOWbckgtUdyismYi2jvNhymdGUop5hXi:MOizQq28CrGxKCP/ky68ls3UozJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911653, "uuid": "c743330b-0406-43b5-813e-a7c4a0199ceb", "value": 22244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911653, "uuid": "d198b206-7f16-4501-8290-ce57c09c8e21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911653, "uuid": "2e75184f-e19d-4e99-9d8e-e182f8044950", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a0f1ea-59ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779888049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888049, "uuid": "7a30fdcd-362f-49a6-895f-f6e2f86311b3", "comment": "Malware payload (Mirai)", "value": "aaad58669e51dd6bad7a783642639a1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888049, "uuid": "923d8c7c-906d-436a-805d-d604bafd16ff", "comment": "Malware payload (Mirai)", "value": "327010f5796cbe7f5963c291eba9945b83cfb17041b6edb99b51c33bf5c679c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888049, "uuid": "c5d3a52e-3839-4a2f-b183-2e47bebb8d3b", "comment": "Malware payload (Mirai)", "value": "c2c5a8ebff40e0efb7674abc32f24888f98354fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888049, "uuid": "3529fad2-d4c4-4ec0-9e8d-fd72f5eb1ee5", "comment": "Malware payload (Mirai)", "value": "e43e01da55b669bed260d217c5746a8f2192f30e594c0c45b7245c94822a0bb0507fb05efc9949b178eef99d4fe0f5ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888049, "uuid": "6d570efb-a541-4af7-8b54-dd05d055e58f", "value": "T1F1D36C07B5C0D0FDC8E9C2B48BAAE226DA73B4291138B25E27D46F275E5DE205F5D710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888049, "uuid": "6e8ebcee-e47c-419e-8791-642c29a3a79a", "value": "3072:dbAFuxlqcUZNpexv1LXgPaAyrXmI3azs9iY0L/x8:AliNTg22Zzd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779888049, "uuid": "89ef4253-7be2-4209-8978-13e58015cd76", "value": 138696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779888049, "uuid": "4086e43d-e401-4f16-ba1a-26931eb02b65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888049, "uuid": "f0d59464-d862-48c4-89ba-6b2941cc171a", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d57ae2f-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924711, "uuid": "4c5a7149-1884-464d-a995-3ff96bba2c17", "comment": "Malware payload (Mirai)", "value": "e83c4c2bcce2082724c96b71d03bba1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924711, "uuid": "e877fa8a-f4b3-4275-9430-d32223d2d9cc", "comment": "Malware payload (Mirai)", "value": "3358fd83479addee4fc472e10c065fcdac4aca751c7f43146d0fc11230fa3d80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924711, "uuid": "761b0aa3-bf54-4aa5-82f6-bd9de30bc5bb", "comment": "Malware payload (Mirai)", "value": "46b43b2bff120d2d73618c2ae405159579b3bbea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924711, "uuid": "7a723fda-8539-4d61-a923-cd30d13f5fe2", "comment": "Malware payload (Mirai)", "value": "a84f1bc311fe77df37e8cd639ff425d6abdfeb6e6c4b4aae6455f2c8d335f3f48dc2cc981112f049557a1795963c05ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924711, "uuid": "7fa1d375-f04c-427b-bfd9-62405b548e00", "value": "T1E1530254BF4358E0E1CAA779010D42BA0D477B8705BDE4899D32EF0516FE9AAA788C31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924711, "uuid": "9626f36e-1f84-4759-8ac9-d8fc973e717c", "value": "1536:O/Vg7Ym1se/FiFY1udiXVMIfk6IQmY7PKbn0q:+wYmKbtdilMmWY7PKD0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924711, "uuid": "3984fdfa-57cf-4058-8a85-c2f36b716345", "value": 63244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924711, "uuid": "3148409f-e218-4b0b-bec3-123d78699dbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924711, "uuid": "b051fdc0-b29c-4647-8242-6d8473e8ec1a", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd56506f-59ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779874246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874246, "uuid": "9601c5c9-f332-4ed4-8dbb-f89288a944ee", "comment": "Malware payload", "value": "98a7a07ce132d2cc7a76f5aa7dbc31f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874246, "uuid": "ffbd6b8a-3c24-4dc4-8d8a-f8d681a35dba", "comment": "Malware payload", "value": "340ba3a8c5baf893a6929aad2053aedf841bfb3b597af985ba3557a0c2d4a6ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874246, "uuid": "d8aa363c-4f49-4737-b4a8-4f2010f88783", "comment": "Malware payload", "value": "b3df02e5cecd0e61ba7771503bb0faafeafeb4f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874246, "uuid": "5cc12ecc-592c-424c-ab14-2ddf9b3962f2", "comment": "Malware payload", "value": "6c696b4b45c76ff0a21cfb06b30542d73569902ac0a25323dc1a92b49ca64c10acdbe1ee8b2c9f1b99f7284126c5c27a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874246, "uuid": "beec23e2-346d-4179-b69d-05933b9a98e5", "value": "T1B707AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874246, "uuid": "b09a8d49-c458-4d5b-980c-70c1b1c564d1", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQn:cqYUQuVDt0TZEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779874246, "uuid": "79eaed55-7e9a-4e75-8995-ef636df5bf8b", "value": 17203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779874246, "uuid": "2f32b112-c0af-4395-9155-910cbd448b8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874246, "uuid": "c7c52095-2382-401c-92e2-4143e0331a77", "value": "340ba3a8c5baf893a6929aad2053aedf841bfb3b597af985ba3557a0c2d4a6ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887443ce-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911523, "uuid": "741bcbb4-7404-459b-bb3e-478921216a63", "comment": "Malware payload (Mirai)", "value": "494769c22f110670d0be2cd0bc5adf1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911523, "uuid": "eed45930-ff56-42a1-b6d7-bb4b9c67ed9d", "comment": "Malware payload (Mirai)", "value": "3442985e6f00bae4b06b6712357b9e1d5ce92218b4d7e743bf55e0d225827e70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911523, "uuid": "998a2f77-9553-458a-8d9a-dc9e2e6052a5", "comment": "Malware payload (Mirai)", "value": "6ad85eabafeb147a26977ce2b367465824fe0576", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911523, "uuid": "195b80dc-6563-455f-a802-4c6631187941", "comment": "Malware payload (Mirai)", "value": "c62a6803b99eb66c65c40c3f3868f0f514a8056b8bcd31a5d093369d2d9fb708313aa886b16b9932e3f2aa1edbfa705c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911523, "uuid": "919fb6dc-527b-4b11-82c9-cca6fbc536a2", "value": "T137C63950FACB14F6EA431D3084AFA23F23311D058B24DBD3DB447E19F977A92297A259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911523, "uuid": "e993449c-55db-42f8-970e-b991b44b2f36", "value": "196608:/3JVQLzo+JC0/TGRDF7LH5JH1J++91nz+SGIea758r:fKz//TGF9LH5t1J++91nz+SGImr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911523, "uuid": "321bd0d1-146c-48da-a3bd-cdf222f1511b", "value": 12230818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911523, "uuid": "c3e1e773-574e-474c-a7f5-db7be2da2453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911523, "uuid": "53bf9aab-fcdb-41ee-84d6-d5d7787938c4", "value": "wife.386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c84bd6-5976-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779849986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779849986, "uuid": "21ca8824-f1d1-41e9-a5c6-bc9fc1d06174", "comment": "Malware payload (Mirai)", "value": "150f345d39f5f8243117b394dfb3fd68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779849986, "uuid": "76d2b648-dcf6-40e5-9923-c5ccc7ad5c64", "comment": "Malware payload (Mirai)", "value": "3517f65bf81fae23ebe2b9cfab4936ceb0081fdf19a3e5b7468ffb7e845e5834", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779849986, "uuid": "d1864ae3-bb1d-48a3-9c23-dccf39260c69", "comment": "Malware payload (Mirai)", "value": "89383810f028da75b43c9a6214d9366c68fbb927", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779849986, "uuid": "d54f0988-16b4-4bde-981a-0f1cd2720d48", "comment": "Malware payload (Mirai)", "value": "4de046c28e50fa6995f29a528114ff2d3baa0ecda55bd02bc2de667c4692d19396f0046765ed8bd872b5df028cd6f40a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779849986, "uuid": "d8c514e1-9eda-4c1b-a82e-6dde8f514086", "value": "T130812ECEF2D287B21D959D23B1B48C47A29288DB51CBEFC5F5FC28714D58D083096AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779849986, "uuid": "1cd845fb-5293-4011-85e9-878d26729bcc", "value": "48:V0fe0X0DwnB3e/tseqDGEDer9bNeFt0ie0A02Lw0Ce2j2iWjegj5ehkQ4e2KGveF:8/x1iE3MjtLBnYNHw7R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779849986, "uuid": "c04a0959-5658-4d61-ac4b-5e4e68778931", "value": 4045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779849986, "uuid": "107d87d3-7766-4cdf-bc56-e0236a2fc1ba", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779849986, "uuid": "d7f46f63-e6bf-4eab-b513-abe8e6bfc991", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88160ae5-59fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779908516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908516, "uuid": "80b50d20-1497-4790-9cbb-4e373db53b54", "comment": "Malware payload (Mirai)", "value": "1902efdc7df7eb80bdf53ff5e4fcaa6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908516, "uuid": "73b8c2ad-dd87-4eee-a282-4f5aa2910f44", "comment": "Malware payload (Mirai)", "value": "356cdafce485d74a070357a7db957903dfe0924aa35526333378d60bd3305fd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908516, "uuid": "787e0cda-6d26-4080-9283-e3e55c26efa7", "comment": "Malware payload (Mirai)", "value": "6e879e9470df3b0af90bf9de7fe98e13b17054af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908516, "uuid": "201bf6fc-6877-4b28-933a-4cdd38b3cebb", "comment": "Malware payload (Mirai)", "value": "8f509d1ecca0bac12aadfa8692bafe7057342b3e0bf0888d81d89e97a52a3b2c3e770b742b6c5184661455472f4eaee4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908516, "uuid": "928e64b4-851c-4b0b-82c5-36dbc31926b6", "value": "T1F783AD32EA292D44C0455570B0B98F395B73A5C083476FB66AFAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908516, "uuid": "553f87d0-33fc-4ef6-adc2-1aa993035dc8", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC7n:UeAsdukuhoNJVwbmuUqjLjwWin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779908516, "uuid": "b401c78c-7cc3-4c9f-a12e-5a05fa6a9861", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779908516, "uuid": "38d8b579-5d2e-4bae-9203-734c445bb3b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908516, "uuid": "7ede0067-f922-406e-b1d9-3baabb0838fa", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90eaad4e-5a25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779925281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779925281, "uuid": "41ea70b1-e4ed-481e-82ea-ca0493939c86", "comment": "Malware payload (Mirai)", "value": "3bacd0948c6fd7f8a0a94a3de68b8c97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779925281, "uuid": "dca090d5-6925-46f7-a3e1-3be5986706c2", "comment": "Malware payload (Mirai)", "value": "35fa01d967cda20b54b7a2cf8b7d52c5963fa54c4e76037da6f8734f9f0624ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779925281, "uuid": "10ad57a6-51c8-483e-9d2f-6b7c0f94dfb6", "comment": "Malware payload (Mirai)", "value": "8e7f91029f4aed48f9c502fee624e1863a2ca8c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779925281, "uuid": "a2d7e2c8-b9f7-4526-a269-736aeabcbe1c", "comment": "Malware payload (Mirai)", "value": "0969e140e7434bf0d6ae8ae1758da43a9006b4ee015a303c1110c1c101f34a1948e4a6a684c2efbe7d367e794bc24a8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779925281, "uuid": "f9ba9e7d-5a90-41c0-ae19-a146b4a41712", "value": "T17FE3E80E6E315F7CF7E9823447B79F24A389239623E1C685D1ACD6111E7028E246FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779925281, "uuid": "f18cec4d-a77b-4c2c-8e60-965adb80555b", "value": "3072:7E0A4NjdJyus5Gwrel2DcAZtg8wCVMQCOjnbETLdUGnhpZsK:IYl85LreoDVY8dVMQCOjnK64ZsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779925281, "uuid": "8337db6c-9fa8-47ed-a2e7-085a9ee38294", "value": 156000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779925281, "uuid": "ae802a3e-16ba-4c13-b599-3e74e8b04db7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779925281, "uuid": "c732357d-cb28-4a06-90eb-2bdf5b7a98da", "value": "023782pler.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247cf919-59dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779893746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893746, "uuid": "7d13c775-1f5b-43a4-a7ee-14e6ac8201dd", "comment": "Malware payload", "value": "501a468759edaa435b31de9324bb2566", "object_relation": "md5", "Tag": [ { "name": "bromechoku-com", "colour": "#6FE32A", "exportable": true, "hide_tag": false }, { "name": "bsource-bromechoku-com", "colour": "#108C62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ip-bromechoku-com", "colour": "#DF9009", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "lurlsource-bromechoku-com", "colour": "#949A4E", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893746, "uuid": "d0fc7e63-a97e-48ea-a376-78a7273eda90", "comment": "Malware payload", "value": "36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a", "object_relation": "sha256", "Tag": [ { "name": "bromechoku-com", "colour": "#6FE32A", "exportable": true, "hide_tag": false }, { "name": "bsource-bromechoku-com", "colour": "#108C62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ip-bromechoku-com", "colour": "#DF9009", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "lurlsource-bromechoku-com", "colour": "#949A4E", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893746, "uuid": "5f99f71d-e6c4-48d8-afd5-647a8541c81a", "comment": "Malware payload", "value": "3626251071aa6e21d7fd9ecae82efa2e86fc5c3c", "object_relation": "sha1", "Tag": [ { "name": "bromechoku-com", "colour": "#6FE32A", "exportable": true, "hide_tag": false }, { "name": "bsource-bromechoku-com", "colour": "#108C62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ip-bromechoku-com", "colour": "#DF9009", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "lurlsource-bromechoku-com", "colour": "#949A4E", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893746, "uuid": "b5ee21d7-fe04-49f2-babf-37e328c355ac", "comment": "Malware payload", "value": "b585c42100de0f389c322f35dcddc896bc5cb39ebbc37d3f1c11473daf089e23651aaa5f3e66c5b74fcae2faacd46309", "object_relation": "sha3-384", "Tag": [ { "name": "bromechoku-com", "colour": "#6FE32A", "exportable": true, "hide_tag": false }, { "name": "bsource-bromechoku-com", "colour": "#108C62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ip-bromechoku-com", "colour": "#DF9009", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "lurlsource-bromechoku-com", "colour": "#949A4E", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893746, "uuid": "a8c9e528-5c07-4787-83f9-8f4977511f5f", "value": "T11D266C137388613FE06B5E3A983BDB50583FB66825138C4BA7F40A5C8E763416D2E767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893746, "uuid": "6d460e44-a189-49f2-8b70-256980c7f68d", "value": "796dd1c786c846b84580b81c932df83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893746, "uuid": "b95fb99c-dc9f-44e7-ad9a-9ee293ae22dd", "value": "49152:rudaZRrSlf/qHkhySxZvv17QK+mrvGH5MFAUym0HmG6Nf3:Kdeyf4kdQK+mrvFFAUyk93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779893746, "uuid": "634ccb9b-fbb6-4b0a-8544-c24f0d6cc3c7", "value": 4775424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779893746, "uuid": "e7a03118-7b04-40e7-ae95-d46fa7f2c6b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893746, "uuid": "59042f3a-0e7f-41f6-b50c-d98aa76e8a58", "value": "36a4bca295060d1d96f7ac3c65462f581823d74cd4cceac9ae5b3f660341de9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871b41f0-59b3-11f1-a769-42010a9c0008", "comment": "Malware payload (VantaRAT)", "timestamp": 1779876302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876302, "uuid": "fce7486c-8ae9-4954-938d-47e2a61d520d", "comment": "Malware payload (VantaRAT)", "value": "feed1dab288fd0a01b87c41e1b0c2764", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876302, "uuid": "14dfa5ec-bda2-4534-b9fd-1b87af311c51", "comment": "Malware payload (VantaRAT)", "value": "383cb5b51b69f5617c0eeffb7bee5091f873d2f201b986dd05448c50c0b4d078", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876302, "uuid": "b36ea90d-f32f-4878-a2c4-834bcdc75270", "comment": "Malware payload (VantaRAT)", "value": "b92b5686a56e39ba9aef19e2914996fba05737e0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876302, "uuid": "11d8564f-67c5-45a2-b6c5-acaf98260ff6", "comment": "Malware payload (VantaRAT)", "value": "c189f3461f230883a50a422eeb9736df6fa7cf1827c8ae9369052f1d43e3c4988e60e3b8e462a83341c3b0e2093acff9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876302, "uuid": "b738bb4a-5c90-4094-99ca-0cb668b5025e", "value": "T1E95533CAB7919C1AC8DE4BFD686582094AC0C848F2DC26556F14A3FDCD272CF1796EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876302, "uuid": "8c5cecda-d0a7-4e02-a457-8385720e030e", "value": "24576:G66moDMaj1Hl5qyFYx3jtTaIRErHIZ3VTN9GgqsdF49XJsaCMx:G68A41H3qyF65OBHY3dmsHeLRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779876302, "uuid": "a9d73244-fb82-4cdc-b8c4-d15dd6c7b9ab", "value": 1300150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779876302, "uuid": "0befbc5a-1eb8-4a9a-a8f1-c0f57d4158cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876302, "uuid": "886d3aa7-e108-4d4f-98cf-5fd17e79e980", "value": "Radium.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a56ca7-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880781, "uuid": "28d90a3d-633e-4982-b712-c9edcb3f7a73", "comment": "Malware payload (Mirai)", "value": "acde4bc3b0683158d3b32809ab500250", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880781, "uuid": "63e7afb3-796c-4c11-8eba-ac0a2de2050d", "comment": "Malware payload (Mirai)", "value": "38d9f99421e8e342b31fbce999d472cd1a957958ef09cdcf6724bd3293556bfb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880781, "uuid": "11c654f9-8a2a-4967-803a-4fdb6f41bdec", "comment": "Malware payload (Mirai)", "value": "7e1b4fe6dda906d6d20f4191fef1aaf774ac98e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880781, "uuid": "4b0a822d-8880-49a6-bda9-a63f40d3523f", "comment": "Malware payload (Mirai)", "value": "7544a4f6536922f005c1c814a24326c43f2532eb96d78b90cffdfc84426f3354d90fe82b07622bea5016c1540673bfbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880781, "uuid": "90d8fb82-3441-4a2b-b9fa-2d10f635d21e", "value": "T18A730286F522474BBC29B3B7ED454A89FA460E71E8A8F423093C77786485A0607EF17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880781, "uuid": "7009e317-439f-4855-9a54-caa1ef7e9dd8", "value": "1536:U6wytm0wNYe05xzqhrGEiLw8XITMC/MaHLJadSvgXLEAE3rq:U6Tm0oYYZGxLwKITMCEeLJiSvgoAwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880781, "uuid": "a6931ac6-813f-4c69-96b9-69931bc49d8f", "value": 73516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880781, "uuid": "bf933d0d-fc04-44ff-8b23-b1c880af68f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880781, "uuid": "83b4078b-78ca-4410-a8f9-ec09db2269f8", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca4fe45-5a22-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1779923878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779923878, "uuid": "1631c2d1-1bce-45a8-a3dc-97c395588e52", "comment": "Malware payload (Amadey)", "value": "950231c031e667b92b11fe26d5faa0ed", "object_relation": "md5", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779923878, "uuid": "011f15df-4f72-4bf7-b297-a186e95fe5b0", "comment": "Malware payload (Amadey)", "value": "3907a88fa142d0fc99be51a4421fb0558a6ba960c1a614d839f6f4f173a336f9", "object_relation": "sha256", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779923878, "uuid": "b0c830f4-897a-4a28-b530-afce30625271", "comment": "Malware payload (Amadey)", "value": "70c489b43ab0ad103815f55a470f04369d96192d", "object_relation": "sha1", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779923878, "uuid": "64c61925-dfa3-49e4-9b3f-f1599a9b041a", "comment": "Malware payload (Amadey)", "value": "213cdb1e7679033c115a4cec2d64f0622fd54b598c7750f0c9c2a43b29ecc144fd21901794a0bd2999959c3913cf9888", "object_relation": "sha3-384", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779923878, "uuid": "00b94317-03de-45ba-9700-59bab3d24ad0", "value": "T1A4858D51FCDB24B1E942123248B6A2AF2335A90A1F31DFC3DA44777ABC779E40D32695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779923878, "uuid": "805ca34f-7139-4172-8736-6045bd3431a9", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779923878, "uuid": "b6497c45-610e-4fe9-9a56-c6b44477b41f", "value": "24576:RvIWXBumPKcNRJXIaejFOK3+IOvd2w7mSWcN+azeS5US+7G++pCzZYD1H3C:tXIaBdzEtan5US+7G+JYD1H3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779923878, "uuid": "05546422-1860-4416-9fee-65de1aa7aff7", "value": 1795784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779923878, "uuid": "f2df99cb-b9c2-41bd-b655-5252e40863d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779923878, "uuid": "cbcf7554-d62f-439d-97c4-968d9327418e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4146356e-59be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779880909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880909, "uuid": "516388d8-97cb-44a2-b39f-b63e0c30b16f", "comment": "Malware payload", "value": "4567c9aa2bad39aa6163da1904aaf6ef", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880909, "uuid": "5e9b279f-f244-4c8a-81e7-934ba47ac92c", "comment": "Malware payload", "value": "3972be15243f76a90aa2559a55e77f06bf84579571421e5309278f006de0c821", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880909, "uuid": "e7c17290-b88e-4b2c-baf7-ae2735dcba2c", "comment": "Malware payload", "value": "3ad9e5543512b022f553fff03caffd483a112fab", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880909, "uuid": "47ecc6bf-e810-4e2c-a3b1-0e2e36073203", "comment": "Malware payload", "value": "15fa7ed6ad0b79271ba92c897de95f2dcd6abccda85ff92fc7d60bd052f21a9d980dc8dc3572cc679b98b5d88f40bb2a", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880909, "uuid": "4afcc608-9f7c-4ff7-bba9-ca688d1915e8", "value": "T1975423D32BBCE534C20F0DB5E71242C1EF73A7D7A1BC0E8E48B6229325DA95418557AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880909, "uuid": "bee9f1ba-e270-4677-b99d-12c4511b1c9f", "value": "6144:29ngEGx5EO38ifPsWyeYNMeQsbAhcu8Kh34kkFwMX:2qEGfD380s9h2hcrKF4kkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880909, "uuid": "aab84fd3-65f6-4bb9-8ce0-d7a1cc049d94", "value": 295152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880909, "uuid": "7aa07635-d37c-464c-9291-44036fe17424", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880909, "uuid": "1fa69c91-1a7a-4e93-a998-88551481374b", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fd809d-5a04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779911165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911165, "uuid": "9eaaa7ce-e7e7-4ad8-8bb7-c83a19650c97", "comment": "Malware payload", "value": "1ed26f391f4edf5d027209ba09ea3025", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911165, "uuid": "4e3526d6-82f1-45b1-a330-e5eb586fd703", "comment": "Malware payload", "value": "399fe41ee79c076391efb2b2a576ac98a7075126e708942f1d5e3784fac2c54b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911165, "uuid": "4843db48-dccb-46b9-8047-d3402f018ba9", "comment": "Malware payload", "value": "f0ff770091aeaa7c538613996e826d4b63b2b375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911165, "uuid": "68120f3a-9cb2-4cef-942f-3461f17e1d41", "comment": "Malware payload", "value": "7cf1a071ff7e194efe4c6b3f1db0caeb7f89515b10432a8379b3533d6155b52462b9c438a50c4840891bc1d474e55391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911165, "uuid": "451954e1-981b-4b46-8ab6-bcc4c63743a9", "value": "T189A401BE60D333FDEDBBD174A69330A2F4BB74A510244E27D368E2392472914456EF28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911165, "uuid": "af52ce31-dd49-458d-8b55-952120660469", "value": "101e9da62927c83ffbe9363e7b60b054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911165, "uuid": "674797db-a398-4173-8ad7-0b9cdc2e1d5e", "value": "12288:uwuuzG/m2Q9qRi93fcfa83epuS1JL0YzZ6qRoK/KGQMA+v:u3uz/pQ00S8JVYzkq2ASP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911165, "uuid": "f98ad258-6bf3-442f-9e1e-8dfaa081d126", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911165, "uuid": "598131ed-0a77-4825-bb7a-5179a39f76f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911165, "uuid": "6a238178-4649-42eb-bef1-59b3a27a4dd5", "value": "eraser_864caf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8007d962-59b2-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779875861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875861, "uuid": "e581f721-8c7c-47dd-87c2-f565792c3383", "comment": "Malware payload (Vidar)", "value": "efedd6c5fe42a91ec6171151074e9f41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875861, "uuid": "15037abc-5b3a-4389-a4d7-b5821cd50fe4", "comment": "Malware payload (Vidar)", "value": "3a0e3b3d85ceff7a3f3169b8a142214ff94a7c7f5e4e9cd76708dff75b4407ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875861, "uuid": "ebb01873-2fc5-45c5-bd55-d758839c19e4", "comment": "Malware payload (Vidar)", "value": "1bf54f4491c96ce46e51eb867b4f0f4f0ba2e972", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875861, "uuid": "0b0f69e1-a4af-474c-a02d-6dfa709b6377", "comment": "Malware payload (Vidar)", "value": "62ff35657d926719ebd3a2dc4fae4e985af4ee764f55db484eaeb4b363a2e06acdb472bfb47a2322f44f969e0848d549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875861, "uuid": "d8da48a8-450b-4d47-8d8d-87d98069f172", "value": "T146A59C47BCD464B6D5BA923188B5A2907335F8890B3127C33F15B6BA2E777D04E39398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875861, "uuid": "8416f029-a861-4dd7-a610-a489fa4c6356", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875861, "uuid": "f58bf526-e344-427a-a4fe-73cd39d77172", "value": "49152:NMj3FML9dLEG1tOh5RHWMm0uH1l62JYgLP3M9D1B:23Q9TTEEVf3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779875861, "uuid": "d91cba3a-9e4c-4dca-8f00-01a11217513d", "value": 2221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779875861, "uuid": "9314ce45-fd1b-4540-acc9-23ee4a7bb4b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875861, "uuid": "fb83775c-5f6b-4973-95ec-b11943ca5dae", "value": "ui02zmyu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7db8ac0-59bc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779880303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880303, "uuid": "afcd6cec-e1d2-4a04-b323-0cc39081b773", "comment": "Malware payload (ConnectWise)", "value": "14a6a6c04116aa6c9aed270c7060a310", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880303, "uuid": "a554caf1-d233-4136-8c3c-01fd0121ad54", "comment": "Malware payload (ConnectWise)", "value": "3a417084802b5255b332280266442b5a062dd46341ffdb9a7b7c85a521c15a7c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880303, "uuid": "bc5151b1-b51f-4bba-85c5-d70c37b70ae7", "comment": "Malware payload (ConnectWise)", "value": "89e37ff9c56b8dc6f54adb2163fc7d0dd5254470", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880303, "uuid": "70b2efa6-817a-463e-b378-4b4498034c31", "comment": "Malware payload (ConnectWise)", "value": "b9f6959a53388e5c29c791ef94a60a0a49b72e9b9463158061bbce3d027e8d66f996a60bff8cbd863e569563cc02e4ce", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880303, "uuid": "9da3aa28-a00d-4f62-8721-22b105e62360", "value": "T13DE623226AFE8598F9B25F34F93A59A6893AFC19CE61C00F1715790E19B1F408673373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880303, "uuid": "b5483778-30bc-4945-99a0-759d60efa0a9", "value": "393216:6cVPOBdLcVPOYcVPO3cVPOncVPOscVPOicVPOs:6cVmBdLcVmYcVm3cVmncVmscVmicVms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880303, "uuid": "16567934-c10c-463e-9178-3e0d1b52acd2", "value": 14442496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880303, "uuid": "5a5f6de6-23cb-498e-ad4b-6728c9ba90e5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880303, "uuid": "097e4c2e-277a-412c-8a64-7b5a3b76377c", "value": "nbase.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1f8041-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880793, "uuid": "942ca1a4-070a-4059-9d65-3288daa17b69", "comment": "Malware payload (Mirai)", "value": "fc7e00a30afe097d312861dec58e4160", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880793, "uuid": "22588099-6d06-4993-b270-348ae2df753c", "comment": "Malware payload (Mirai)", "value": "3b334add1ac0b1d2206c14b9197f954c4b4b43a34a2bc9e4d11368de4f49d7a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880793, "uuid": "8a71ac31-b610-49e9-b231-2bb31e26d473", "comment": "Malware payload (Mirai)", "value": "52dd15517684a63dec6353afb421d37860ba6ce6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880793, "uuid": "2c7fb280-f2e9-412c-bc12-2cabdf96a63a", "comment": "Malware payload (Mirai)", "value": "ff5a57774b3a1ebe562c5c7e57db5bf71f1a7e8dfddadee5bfe8757f8cf6527abf7969d8661151dd818fbafd16b83865", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880793, "uuid": "1dbe2a44-0f4d-404d-ae60-3ffa4fc18957", "value": "T17B13F1376DE2C79DD0BC12B500ED5FDE486CE10644AC86A6EC48C9DBDC05B2C5E76389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880793, "uuid": "7a093b1a-a34c-41a2-82e4-1bad600c1e24", "value": "768:jBG4QZVo8v3ztmC5gaNYDsLhFwbQWsjtHITSnSNM43tbfJnbcuyD7UGQRj3:jE4QQ8v3wCTNY2hF7tHW2etzJnouy8Go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880793, "uuid": "86a0160b-d9cd-4a2f-b93a-70104d690595", "value": 44812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880793, "uuid": "d6018c5e-7962-460c-b4ba-05998b66df83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880793, "uuid": "1c7fdd8a-8a41-4108-86e6-398dc2cc9d22", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58342c71-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913590, "uuid": "4042dfa9-fc31-4d4e-a5ec-89c774646ae0", "comment": "Malware payload (Mirai)", "value": "d4add96ce72085400a25294620a9b7af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913590, "uuid": "7b594390-3ec0-4fdc-9294-b43b8fa83344", "comment": "Malware payload (Mirai)", "value": "3b62d01cdd743ac554840936a959d0f3c2a2d7395c135a76147e220b99a08f86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913590, "uuid": "483f0214-4e9d-4827-ae39-638717f0d314", "comment": "Malware payload (Mirai)", "value": "beb02fb4b331cdd9d0b62c554d47e6353224501d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913590, "uuid": "39768cec-38ab-48c6-b003-28cce5356f5e", "comment": "Malware payload (Mirai)", "value": "c76085df89479518f6ab48579cdd527910befd60e06febba23ff9341e6114b32d54127fa4e6bca7eb8245f69d3982749", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913590, "uuid": "c14419ed-8844-43e8-9baf-483b7e1f5a63", "value": "T13221328AF084AD68EF18D73C5AB046937B05D924C25FF3CE4E1A96B65A1B28CA5940D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913590, "uuid": "0f86dec0-4e35-457f-ad0a-56f87297f9e2", "value": "24:w5olnAwdGtSnUpzzbBWpzmIKa5gDrms0vGlikC7m17d8zNfi:w5olnPdxnUpzzbBWpzmIgDrms0vGli72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913590, "uuid": "f3bf5a40-f54a-4d17-9f9d-ca4e63201946", "value": 1204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913590, "uuid": "d7a96ae3-caf1-41e5-96d0-75ba78d89f64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913590, "uuid": "fc2b1288-5093-4800-b01f-ae95c73ad44d", "value": "dlr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a8d8a0-59d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779891352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779891352, "uuid": "dd7ad714-f63b-4cd0-8ef4-7fd9dccb79aa", "comment": "Malware payload (Mirai)", "value": "59312d174600205177e22ea25f6a39d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779891352, "uuid": "d1ab683b-ebd0-414c-9eba-34054ce5e324", "comment": "Malware payload (Mirai)", "value": "3b8ea9cc170de884a12fa38fb9530cf3dfeb03b94ce74859e9c745ae79936447", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779891352, "uuid": "9b854e54-e669-4d32-9165-3f1a1ad23dad", "comment": "Malware payload (Mirai)", "value": "d309d13a7c3e01fb9eeb8d18ea8a2b01aad1124a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779891352, "uuid": "8e5ec6f9-b720-42f5-a27b-9bd4c302f7b3", "comment": "Malware payload (Mirai)", "value": "e379a1c990a94bb6e95e0e0ccf016706f1462eb56dea93a138f79c61ad66cf843b3407751f443be02a8f7a48e1acb469", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779891352, "uuid": "3efd2e97-dbc5-4853-8fcb-e3c457e169a4", "value": "T13F04A75A6E228F6DF278C73147F74A25976D23D623E1D684E2ACC1102F2039E545FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779891352, "uuid": "15d162ab-1f1c-44c2-a8c5-82b0477ff473", "value": "3072:9WwbHGgn5EAMcAyynMn9movgk7N5e4egedYAEE5W:9WCTnh4yynMkyBe48CAECW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779891352, "uuid": "de4b4151-fd27-43c4-9e44-bf6c7907010a", "value": 185660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779891352, "uuid": "00bdbf20-d497-43ed-abc0-2805743c3ec4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779891352, "uuid": "f86b4e46-d52c-41bc-90eb-1a5ce8989ff0", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5154fade-59f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779903700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779903700, "uuid": "35630577-3190-41dc-b444-9114d2d961ef", "comment": "Malware payload (Vidar)", "value": "d6cd359f07bb002c4f893ec4e0bcd71c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779903700, "uuid": "fbabf788-f38d-4f9c-8023-c5b675eb51fb", "comment": "Malware payload (Vidar)", "value": "3cc6feeec3edb145763876a396d902d6ef1de2b0f181fc38baa23363ad9a84da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779903700, "uuid": "06f83172-2ad9-4920-b075-33faf7f813c2", "comment": "Malware payload (Vidar)", "value": "3dfe9266a1e61fed1119113868bc89956dc4c336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779903700, "uuid": "6a4ae4fe-d608-413a-a06e-bf053c650cb6", "comment": "Malware payload (Vidar)", "value": "6aa4391696106147403dd7280e9dc215159ff95769161f268a3118bafdf6ed25f8611c1b32b8cba2813998b4bb6a8832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779903700, "uuid": "c7594bb1-f5b5-4234-9fbf-30562a33bd78", "value": "T165B59C06BCC021B6D5EAA23289B512917B31F8990B2267C72F55B7F82F777D40E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779903700, "uuid": "4d5a26c1-652a-4c21-8eb5-d4d581b671e4", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779903700, "uuid": "9f598d64-3db4-43f3-9413-01a6eec1b101", "value": "49152:xARx5UIU/AAMukUiqiOTGcx3LiNOSgk0lSD1H:00/XM9Dyh2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779903700, "uuid": "af097bc2-e21d-4856-835e-f55ad3480d1d", "value": 2296008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779903700, "uuid": "38003cb8-cdbe-4492-a22a-647a20ab0642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779903700, "uuid": "63a96e3a-c941-4df6-b29d-7e122adf50c4", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ecdb89-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880645, "uuid": "88acbd9a-cde9-439a-bfcc-83bd04ae9850", "comment": "Malware payload (Mirai)", "value": "65038d77b5d6afc6c8a7139c7a5ff9be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880645, "uuid": "c62181dd-0b0c-4097-8e8a-f38312fdd1a0", "comment": "Malware payload (Mirai)", "value": "3d28afb549f22e3893b47f2dc7ed5aa8da1eb05571278f2940d36c5dcdce6c0a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880645, "uuid": "a5c91519-abc9-4926-9032-57176206743d", "comment": "Malware payload (Mirai)", "value": "258edbb1756e4864616ef9313fd6cdc30fb91c92", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880645, "uuid": "4031186b-3e0a-4aed-8a24-8f900b16e673", "comment": "Malware payload (Mirai)", "value": "333b25df84f448e715f01b4286854e66f72b5e5681af6f47b4d08e92ca10c3641f9476d0dcabed8a7b284dac937c9609", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880645, "uuid": "933ff40c-8777-422c-9635-a370db92c856", "value": "T1D032C407A7B7AF1BC4D027770193072162A99FA56024472F7D0D1C4E6E9B3812D3FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880645, "uuid": "9231dfa3-f9cb-44bd-b9c5-743a10676ae0", "value": "192:xvPOR1CQOV/1NxfAzJHaCD0SdbNlDqM+2mKdc0E7+e+f:xvPbbzfaJ6CISd1/c0E7kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880645, "uuid": "d2393db5-48da-468a-95c0-4841e8673699", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880645, "uuid": "c80a9bd9-09c2-4a50-ad61-0ab478043364", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880645, "uuid": "a9c202b3-89e5-4733-a93f-fee174fd2126", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e446951-59ba-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779879240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879240, "uuid": "e9c5159f-3481-4fca-bfb2-da01c3fe9811", "comment": "Malware payload (LummaStealer)", "value": "f12b446cb2e2dae5f39124d62517412b", "object_relation": "md5", "Tag": [ { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879240, "uuid": "f55b9fbb-460c-4187-b615-e2ef0272cd85", "comment": "Malware payload (LummaStealer)", "value": "3ecc3ceaff9ec4a7845e267a1345eb3a40a5d5d331c1de00416e68b087fb3f7e", "object_relation": "sha256", "Tag": [ { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879240, "uuid": "849476e1-bf9d-41fd-ac7c-c23c8c031be1", "comment": "Malware payload (LummaStealer)", "value": "89c0e3758d848c3a1d4f44e8dbffec5ace74f898", "object_relation": "sha1", "Tag": [ { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879240, "uuid": "8cf85c75-c80a-4dc6-9b81-cdca1e699a8d", "comment": "Malware payload (LummaStealer)", "value": "259a936ad2da1b0aa609383d8911db3519468e0df7a9a408f1115ab45556d083d5b87b46a38fb3a6b3d8252311c7a5cc", "object_relation": "sha3-384", "Tag": [ { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879240, "uuid": "d0dbb637-70b9-4f59-bf6e-100de2207510", "value": "T1C7F633DE85DA45A1E88A347914333F1AC23DFCDA65E194CB13633932653D982192EBFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879240, "uuid": "607258ea-72e3-4b3e-88ed-94cb30561be0", "value": "393216:eyafBO03sQG+h7KF66rmblbgQkawDrvVW8kSYpCSC7Hy26eaBKqB:erfBO08l+hn6yBbgQCDTVW8kS2EHLjqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879240, "uuid": "1a3fc114-708c-4c41-a30e-1f66664feba7", "value": 16366474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879240, "uuid": "1e62c74e-ebb3-4278-ab6a-21d35ef002bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879240, "uuid": "e27f7d63-8613-415f-bea1-5d7be3afcb6f", "value": "3ecc3ceaff9ec4a7845e267a1345eb3a40a5d5d331c1de00416e68b087fb3f7e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff4faa9-5a18-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1779919723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779919723, "uuid": "059138c2-71b0-493b-8550-35b199ca187d", "comment": "Malware payload (SalatStealer)", "value": "5170f0979e6fd1f0190f4950389ebc9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779919723, "uuid": "06ba4c69-7bfb-4f6d-85b3-f1cd7e72c87e", "comment": "Malware payload (SalatStealer)", "value": "4089a4a5d41a1a1a695fb2adabcd7c82624663a8aabf641186cc272aa31f1fef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779919723, "uuid": "9f511ef9-6a54-4129-8966-18ff21f02ce5", "comment": "Malware payload (SalatStealer)", "value": "6c73316b7ab659c884de8ec2aacf859428a38fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779919723, "uuid": "0ce218ae-0b17-4772-b235-3e17937c37ae", "comment": "Malware payload (SalatStealer)", "value": "48bc2f3b8666509903ddb91012ad5ee8cd4cdb8812978e9997c669fbb12a0af214c5a23e0d72696595831045a50c6588", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779919723, "uuid": "eba045e0-1258-44a3-9c07-8eb49d15b683", "value": "T163F533C6BF28B6C6CCBEB27B6291DC4EC7851D5B7E8648C204651948C0E51B4CE18F7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779919723, "uuid": "1a34ffb3-ed88-44f3-a60d-196b4ce4a571", "value": "62fa4743b0609652b13a6b66dc9c0ac1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779919723, "uuid": "aba90eac-bf74-426d-a0b2-dff8d057e561", "value": "98304:+B9IXrjQroipxfKWzSBV581XN2GnNXfK8zuHt5Z:8GbETxffmBHE9JNXC8qHt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779919723, "uuid": "e579a74b-60eb-479c-8761-8556833d9964", "value": 3598917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779919723, "uuid": "40cc0241-d875-4ea1-bf99-f6a2869121f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779919723, "uuid": "67525a7a-8938-485f-bcfc-9494d22bffd5", "value": "Xenostrraprer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2841088-5a0b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779914197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914197, "uuid": "5360e896-98db-4160-918b-1e65b5abb8cf", "comment": "Malware payload (Mirai)", "value": "0a24f67584908f7461ab0b27b280eca0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914197, "uuid": "bb5e8fa6-6dc1-4010-ab68-dc409323dcae", "comment": "Malware payload (Mirai)", "value": "42508860a46ef05ae02163328d7ff05d168ddc9551428a105ad435732599abc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914197, "uuid": "f0b41da2-8d04-44ab-81b9-6be6a5ebb130", "comment": "Malware payload (Mirai)", "value": "5c29663f785be8e8afc0d8b17d1ea166068e0928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914197, "uuid": "ce26d38c-4bfa-4b76-abc1-fe8869f2743f", "comment": "Malware payload (Mirai)", "value": "2f0409edeb47ac54b696315e44004ac85ab9e10552ca068b0f86c78e27f92dd6c02b7393ba20fa9307ad07bdcd327ba6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914197, "uuid": "ca729e64-af5d-499e-81d3-545eaeeae0f1", "value": "T165F318C7F900DABAF809E7374813080AB130F7A604925F776257357EED3A1991877E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914197, "uuid": "d768463b-34e3-41c7-bce5-78c2f390b2b7", "value": "3072:aB2QFyRAf586DxvHyn+YdwPXCg6VfwvJvXtlzVojbilLRVLAMsU+9:aB5G5C1ynzdwPXJ6apXtlxLDUc+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779914197, "uuid": "d9ae2c6f-b079-4b56-b573-7b6ec74f0737", "value": 161304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779914197, "uuid": "85a01870-b4a5-424f-869e-39616d9a7f7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914197, "uuid": "91a38bf0-2f25-4282-a63a-cdf1120a3137", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698b312b-59bf-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779881406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881406, "uuid": "99191e34-bbdf-421d-9382-d1f62adc5a9f", "comment": "Malware payload (NanoCore)", "value": "3c85194d838aa8adc4c0673e06860f29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881406, "uuid": "84b3857b-ccdd-4489-b575-1bfcfb78968f", "comment": "Malware payload (NanoCore)", "value": "4367742a7a7ebdcba8f07789d15570690c6173dc0fe7cf0be031b24db98a9348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881406, "uuid": "dda0d3ac-4a66-4721-bfe4-5922ba472694", "comment": "Malware payload (NanoCore)", "value": "c7abfd0a84c32ee75f167f75d6fbf81b8d0a6fbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881406, "uuid": "1e2d948a-0a9d-484f-bece-28f3d4b6808a", "comment": "Malware payload (NanoCore)", "value": "f621c6d745d9280694fb94ed7b3f2408cc495cf61c002faed6f3a095c80f7f7349fb1ab03e1c66d82e947331ed06419a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881406, "uuid": "c3713b43-ec89-4eab-b106-0e832fb20a97", "value": "T15C14CF167BA84A2FE2CE86BD712242168379C2E79CC3F3DA1CD455B68F167E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881406, "uuid": "cebe30b2-ccaf-417c-be95-47e2036a577c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881406, "uuid": "8c2c820b-bc30-4cc6-a520-a823bff6e77c", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIUqiT05t4Ziu8hBVv4TPcXQZqU:MLV6Bta6dtJmakIM5tGtMMnEcXs7hm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881406, "uuid": "3694f310-d512-4f62-ad71-d0ea3bfbb989", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881406, "uuid": "f86c41ac-41b0-49c7-96b4-2b5213f3d06f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881406, "uuid": "d3d0088a-9fbd-465b-886f-58db51b057a5", "value": "Em2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dddef2-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913753, "uuid": "64ced3fa-d5c8-4b81-afdc-351d64da6b53", "comment": "Malware payload (Mirai)", "value": "729152a5f92205ea2aec268f58531b76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913753, "uuid": "ac99e5fd-2ed1-4764-9335-b1f9acc908a4", "comment": "Malware payload (Mirai)", "value": "43c058091a80189685818eb352834a1841dff936353bc65bf146c9ff91ad0799", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913753, "uuid": "b8769977-48f6-4fbb-802a-a0bc124098c7", "comment": "Malware payload (Mirai)", "value": "732d0768111eb2a5cdbab14e90518704e7d5e205", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913753, "uuid": "55ba3d9d-a831-4f53-b483-6b9b083e139d", "comment": "Malware payload (Mirai)", "value": "2996039e3a3717ca254426c5d500f118111e97ee75e9cfa4270990bb3390a6ca1ba2b5427f24dbe49368912ac9fb635a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913753, "uuid": "60ea22c0-23dc-4cae-9cbf-21abf317721c", "value": "T1B1434BD9B401AD7CF48FF6BE80664E0DB521322510930B2767A7FD937D32294E912EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913753, "uuid": "1da73b9a-0068-4d86-ae8d-f1072f8fecfc", "value": "1536:8GdivU/mgVNCEFRJLQHnpiaHZJqrur8N6:8GdRRVN7JLOp7qCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913753, "uuid": "69d3da2e-0ee2-443d-96cd-4c3aca7c0de0", "value": 56240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913753, "uuid": "ebc778ae-255c-4264-8b0e-58ba22ac54b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913753, "uuid": "09a97b08-f285-47fc-83e4-535fc527ab48", "value": "Akiru.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81224054-5a01-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779909793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909793, "uuid": "be04da0b-2d0d-44eb-99cc-def1150c2a61", "comment": "Malware payload", "value": "07833ac03d1c92eaf726868ff4820eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909793, "uuid": "69e6040d-96f4-41e0-a359-82b8764e9b94", "comment": "Malware payload", "value": "43c5ada7003955661753e4947674440bcba923d9994db44f3c25f69645e7adef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909793, "uuid": "6c72d324-cdcf-41a3-8bf9-f923d46a6c86", "comment": "Malware payload", "value": "5e9f0f6bb4b7eff2ab7c49f33816929a7e2a5099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909793, "uuid": "540e766d-10b8-4707-b9f2-77a28becdf54", "comment": "Malware payload", "value": "aca22cebd884f040ec1431e014d5d8d99474441d8f0acd93a43f368ad6d212320a2ef747ed87cbfc17e2cc338ea038b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909793, "uuid": "58eda622-a62a-40cf-8699-be6d57f52d41", "value": "T16A08334C61FE406FC0B144B075B3A121B254969FADB00959739CE7AC77B93CA58E22BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909793, "uuid": "6abe463f-666f-474b-81ba-515ac894536a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909793, "uuid": "9e8cd56b-5764-4e61-aab0-bbf88197f525", "value": "1572864:jt9IKPd0004XGRWYRuLT65GO8t2eszMIwluB8T6H9kKKzlLzHGHe+9m4B2yn+BSx:jUK1094XGRWO0TntdeMIwgBJWKKzlvQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779909793, "uuid": "b3d76df8-7bcd-4acd-a4ca-307a56de5708", "value": 77455364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779909793, "uuid": "c7bde913-70db-4094-92eb-736408d3eb52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909793, "uuid": "3b7a9d55-919b-4293-aa04-ae69c8bba813", "value": "With Aoi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e52be2f-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913573, "uuid": "e6d25040-4221-4292-a348-6c3dcb51aca7", "comment": "Malware payload (Mirai)", "value": "05d5a53615e4325bd867035b8a303e13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913573, "uuid": "40ab7427-d4a1-45f0-b6e3-9e22294a1def", "comment": "Malware payload (Mirai)", "value": "443b6090dec69e11e44e82f6557b8fa205a6b21c89c3c91b7d1398b7c9f67d51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913573, "uuid": "96a886a6-a4f7-4107-b3fd-c9b4073ede42", "comment": "Malware payload (Mirai)", "value": "e914e21ad2715f601db88ff97a067f0f17dd20c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913573, "uuid": "d03d04de-c345-4fcb-963a-fb960fc60863", "comment": "Malware payload (Mirai)", "value": "84e3a754c5fe999b5083d410304fe06a9ac749b3c1d4a290a755e4428a2fd982b42c36b03cc424bbbfae8926aee71ec7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913573, "uuid": "b6a5aa7d-a674-4706-a7db-64306121c183", "value": "T170332A02B328494BF9D66EF0383F1BE083BEF98424E4B584650FEB464635F775985E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913573, "uuid": "a41dcf90-a248-4991-a143-d3171d6a515b", "value": "768:1L6zgBypfN1RSPbj6/yjRM7Yumbt++Z9245pvTuGTFjEjYVi451qXbZ2rkXnx:1LkfN1RQbjcw1h++6altETKYXV2qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913573, "uuid": "fe6bfeed-ee48-4471-882b-ed56314f6cbb", "value": 54692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913573, "uuid": "827f59bf-6b51-4b16-8683-6233113bd83d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913573, "uuid": "a65c7a2f-9814-43a7-af74-de1b78d02187", "value": "Akiru.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab0eb78-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911688, "uuid": "6a6af65b-ba7e-4521-b7eb-aa9f75df02a0", "comment": "Malware payload (Mirai)", "value": "672e3a22ec6f0df59ce2ce8deb35d49d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911688, "uuid": "080fe928-054a-42ad-8910-76d3023b05e3", "comment": "Malware payload (Mirai)", "value": "4507539a3a45716387d9c66e47e063da89b35439e514cc18de8034dd84793f3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911688, "uuid": "669d2c24-396b-4da0-b000-a815c3934933", "comment": "Malware payload (Mirai)", "value": "d700c84c8a3b82c2a23c52e35cd97129a5e44bad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911688, "uuid": "6d7be9b4-aa88-4917-b4b7-ccdf30a68b19", "comment": "Malware payload (Mirai)", "value": "44ea4100e0dda218d7c833e0176377f25b5640839b1b776a15e2513db79afe73dbc549b103c3397ca1bf1a8305ab4536", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911688, "uuid": "e62d40aa-5e3a-4dbe-b263-cb3374d357df", "value": "T188531A92FC424A2BC1D402B6B5BE5A8D376213F9D1CB7227DD614B407BC5A1F0D6AEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911688, "uuid": "14f40e69-cc79-4878-8931-8daf72a88093", "value": "1536:AkvvADrAJ9yAPw4+x60GgxDkRucdHHmo1IEwhg9y2IymQY2AUm6hh1Z/C/C:AooDrU9zo4lXC6hh1ZKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911688, "uuid": "7d14b5f9-58cd-4843-af11-91ff9d25691f", "value": 63820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911688, "uuid": "74c60965-5e7a-471b-9e42-4688813e2ed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911688, "uuid": "3f3183c5-49d7-49ee-8660-96c49209ccc6", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b182755-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878886, "uuid": "5d019a5d-24c9-4b06-85b6-f5c5be2c4cef", "comment": "Malware payload (LummaStealer)", "value": "df7e0cb23cb0e7ef55eebba208952415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878886, "uuid": "91b30104-8bbd-4804-8fc7-b925029054b9", "comment": "Malware payload (LummaStealer)", "value": "45ab531aac740335be1c0cd0af9785adc11b6560d4569d74024d05c1dc30bb1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878886, "uuid": "ab3df3ca-4a9f-4d19-9cd3-03bc795533a6", "comment": "Malware payload (LummaStealer)", "value": "b0a34f88d902812be41d848c965b0b4f67bc2f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878886, "uuid": "61b78cff-3d8e-4c80-850b-dafb8ccc396f", "comment": "Malware payload (LummaStealer)", "value": "ab51745b4435437d3450795fed3ddfcd1d3f135ed6f850a9702880d30bd55c638016cad28613bbdcde984294d45d681e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878886, "uuid": "94bf33ae-06cc-4d40-88c0-f6113fac07ad", "value": "T168748D9AE3B758B0D5470979216F733FDB241A168728CECBCBF0DB4079272E26535A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878886, "uuid": "b3d97ec6-97ce-4192-8e7b-0efd9dddcdaf", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878886, "uuid": "74518cdd-903f-4830-9ed9-0cf7ebfd84dd", "value": "6144:zYZ1hfBjV7gE7gVPMBa58tvPES6x6vZLE579QPv1ebx+fZG:8Ph5Jst8tUcV3lRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878886, "uuid": "c892b16e-7910-4096-b33e-e6613261b3ad", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878886, "uuid": "d09b9349-664a-41c9-8282-68bda48a6e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878886, "uuid": "e800c2e1-4a76-4c86-bcc3-0a99ee98a8d8", "value": "45ab531aac740335be1c0cd0af9785adc11b6560d4569d74024d05c1dc30bb1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5ae1e9-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913756, "uuid": "76fcc40e-fcf7-4ec5-846e-469fdc15acda", "comment": "Malware payload (Mirai)", "value": "db665c424da598e98dbba6f88adb75ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913756, "uuid": "7c036b91-cc23-44b4-b6e4-423e9bc7f0f6", "comment": "Malware payload (Mirai)", "value": "473638dbe382f4161d7f6b6e8f7cfa40763a6a52b81059f13719ea7cff00ad05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913756, "uuid": "6ade7d3e-6376-49e3-972a-25af4ff105d9", "comment": "Malware payload (Mirai)", "value": "f89ea8b4e2ba021e01b3471bd0dbf55674d2f0c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913756, "uuid": "c7bc8d38-3ac7-4254-9f9d-96999011be09", "comment": "Malware payload (Mirai)", "value": "280b0f753bc90a53fcae131ade9d0c0b5570322411b9544d002b2b066166ace569ec8e68175b84283028f7be499cdf30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913756, "uuid": "ce820087-24ca-4651-9231-0ae0f11ab3fe", "value": "T168D32B46AA409B13C1D61B77FAEF41493322D754D3DB730689289BB43F87A9F4E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913756, "uuid": "7ada3029-e68f-4d25-9319-5b4dba26fa62", "value": "3072:/mrphNJ1P6X4d+v35o/2cUEBybExoXJr4f0PMViqQwUlRJu+YIaM/9VHM/:erphNzP6X4d+v35o/BUEBybEOc8PMVig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913756, "uuid": "77ed6227-43a8-4bc4-85ae-9c8c33384573", "value": 131231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913756, "uuid": "6bc4ea98-81b6-4b8b-8050-8eae9541a6be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913756, "uuid": "b1768996-d351-4357-bb1f-5cf00cfd6428", "value": "Akiru.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fdceea-5a0d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779914903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914903, "uuid": "5df4f1c9-0394-47e2-b8e0-851dbba9a80c", "comment": "Malware payload (Mirai)", "value": "cea757edf3e9eabdef083310f664fffc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914903, "uuid": "3343bd6a-69ca-4f72-a2c2-e34718800c9a", "comment": "Malware payload (Mirai)", "value": "48fc987cc5630b6039880edde46c2391e857764a683387dd52ee296e415c9a2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914903, "uuid": "df116cb8-f98d-48ab-a189-77e77f24c9f0", "comment": "Malware payload (Mirai)", "value": "d366102eea06dcab77568d594c222a1c1cc7e2ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914903, "uuid": "d39a0d66-5204-4162-aa85-009e0901898a", "comment": "Malware payload (Mirai)", "value": "ad1458fa31d3667ef4f05dcb7193cd5b148172d158f6ef0814433bc77a4a63b3861d8b2430d589470c91112c44e2bb9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914903, "uuid": "a371433c-f170-4aa2-89d2-b95d46f0d9ce", "value": "T10DB339437B8084FDC459D538537F7636C831F86E023A72AB63D4FE263D49EA01A2AB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914903, "uuid": "034b42ec-04d9-48ec-bd5f-1243b3e0f23e", "value": "1536:pgcASzN4THRlL1IxJQ3/VGgh3ukYoeUdZRm2NkmVlCWDD6p:pgcXNsHRlpIxJe9Gg4kYo5Rm2Nkm6U+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779914903, "uuid": "399f6f90-0e14-4cc7-972b-6217fa8977eb", "value": 112784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779914903, "uuid": "83fa19ae-329f-481c-bb37-1f2271f2f0b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914903, "uuid": "fe55e94c-4c3d-41f8-a5be-5d2dc54ef1e6", "value": "023782pler.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d866112-5998-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779864743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864743, "uuid": "64789377-a37f-4b0f-850b-e483e8acd773", "comment": "Malware payload (AgentTesla)", "value": "53143f5c56eb3d8915a2b1ff51172206", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864743, "uuid": "016a8aab-7610-4190-bce1-53a9ddca768e", "comment": "Malware payload (AgentTesla)", "value": "4916e7d8238c785ceb0044785f2f23ff47e27ec03264bc042dbdf6b2bcc7520f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864743, "uuid": "cf6532fb-c1e4-4e8a-bcbc-a77ca89e1fba", "comment": "Malware payload (AgentTesla)", "value": "b6b480053e1a6c162b9e7593c85a3a94f93c4da3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864743, "uuid": "8c8c79f0-bb21-42a7-bbef-a47827cbece7", "comment": "Malware payload (AgentTesla)", "value": "83de3b10c454a07af67be04927223f8823e6f926ccc3d07ff36493657e381783f49030540b560d7960aae5f5c24e9220", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864743, "uuid": "c26c3494-f046-4cff-9376-7e6308f87eef", "value": "T14EB5FBF838F9F49247C1C1E23E36AE34A999D3C75DC177FD2AE47A00C1184A99D4267A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864743, "uuid": "0feb9f95-6728-4cd8-9a72-b8be7ee16f17", "value": "768:fWbjaLvd6/Ppbjk7goiB3AXbarCCsnDEdpBW3B96AWxFdadmbGOqsSWOBOnass1i:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779864743, "uuid": "5d977f3c-2240-4d92-86e1-ec95135c76e9", "value": 2487840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779864743, "uuid": "3ba77e47-7dd2-46e0-a2aa-2eb1d21c4fab", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864743, "uuid": "21beebba-1e19-4f88-81f4-4d61f1da24ec", "value": "Orden_de_Compra_No4500326007.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830d5e0c-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911514, "uuid": "acac6ac8-3ef8-476f-aa58-f0037a18e7dd", "comment": "Malware payload (Mirai)", "value": "b8007497d4dd11cf58d0ec29f39babeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911514, "uuid": "6806763f-7546-4c32-931a-e9d3baba7602", "comment": "Malware payload (Mirai)", "value": "493376191d0d59d746c71a6a8045d65678ac2cfdaf68ce061beefca0d9b881b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911514, "uuid": "fe29b17c-d202-4f44-ba1d-184edb6d9ac7", "comment": "Malware payload (Mirai)", "value": "dcceb798a9ca9932e27ff94a4b6046ecc61e18bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911514, "uuid": "51042615-cf19-4659-815f-9e0303c0a222", "comment": "Malware payload (Mirai)", "value": "7ee9acc69af88e3da58aa9cea03b5a17e486b088840ff00266953aaea0c7691ee44a175e3b81ae473f39b8d8f84cb711", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911514, "uuid": "11abd339-1e3a-4ca4-b86c-33dbcd8518ea", "value": "T169E62C51ADC26B66CACD0334C0FD63AA62603E445696436313F4FBA83E7773DAF5A448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911514, "uuid": "8d21c8a0-6dae-4681-889a-b7c96b4db37e", "value": "196608:c1JZ86+eKvC6aCJmmfIQG9g++91nz+SGFUsr:a3eG9g++91nz+SG9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911514, "uuid": "733bb336-d643-47c7-be4a-e04225415b5c", "value": 14090402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911514, "uuid": "2cb0dbbb-1f55-4335-8e5a-3e24e1e912f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911514, "uuid": "8ce77877-0583-42bf-b7a2-85ce09921892", "value": "wife.mips64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9a1d5b-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924762, "uuid": "a23902a3-8a0e-4c3b-87c7-53117c828777", "comment": "Malware payload (Mirai)", "value": "7e9f7417877b8cedd0ed506c0db65c5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924762, "uuid": "245d0efe-d34c-4b0d-a52b-f4fd9fd9dec0", "comment": "Malware payload (Mirai)", "value": "4a2f6ca07626325723c234f9cdc4eb175c55b298a4e027edddc7dc34b812dd91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924762, "uuid": "e0dc7d05-8110-4abe-8595-4fa7caf1aab2", "comment": "Malware payload (Mirai)", "value": "6af558eecab19b86429c74125843fff0b66c5a1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924762, "uuid": "4fc973f9-2153-43b7-adf8-507a212571ce", "comment": "Malware payload (Mirai)", "value": "c91bd9ee5e95965f741825202478d5595e00c8b830b6d97e010453a8f1238cf882f1174af3e5e9d8fc76b0f6211c52e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924762, "uuid": "1ec3fcc4-c8f8-4917-b97d-960562f9ecdd", "value": "T1A9D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924762, "uuid": "05108bf4-7b6d-4a6c-a737-0b69563d6ffc", "value": "3072:79eSuygEPjt6qkWqMdKmDnYMb0gBd/gQyVGsdqml6saj:79eSuygEPjt6qkWqreH2lasa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924762, "uuid": "09986bc5-2dfc-481f-9835-e933e7decec5", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924762, "uuid": "5249121d-4696-44cd-9fd4-52440bb92172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924762, "uuid": "215db959-60ab-494d-8919-dbf9b0a3f66e", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846b6a63-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911516, "uuid": "e6a6ce83-a7cf-4404-8d41-ad2dcabef401", "comment": "Malware payload (Mirai)", "value": "2f24e228e381f6f4c19ca2c2f8e2a2e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911516, "uuid": "0a436a96-2618-4929-bef6-271167b51902", "comment": "Malware payload (Mirai)", "value": "4a4d45df0c9219f2c98a6f5ed8825ead2282d04d90435cd64e3dc272b7758a06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911516, "uuid": "01a7332a-ffb1-494e-bd4d-bfae6027995f", "comment": "Malware payload (Mirai)", "value": "44fed8b1305c8d216450d1847444437e61d3dd1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911516, "uuid": "c5720da2-0f09-48e8-a453-0cf2b126c3c5", "comment": "Malware payload (Mirai)", "value": "c32f7fdfeaffaae19bc874498a54d8681b8e292683f09e48ef4a9a9d18f703d1dbff1ac14f78c36ff48060424a19de09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911516, "uuid": "8847c345-b6c1-4011-945f-804d0535e65b", "value": "T19FC64A42F60A2FD1C9584D37C6A70E6027762D542B318B92D764F2BFADB23424F56F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911516, "uuid": "a0cf4c26-eb41-43b2-b49f-4ba5ac36089e", "value": "98304:+0QT+MvZPPbVR/5+i74oKkNSQrVvl6AYNLp++91nz+SGxSU+798XKq5VE7:+0iT74oAYZal++91nz+SGoMm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911516, "uuid": "c8c0bfa4-d3e0-4ca0-8832-f894bc90fda5", "value": 12517538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911516, "uuid": "c220dab2-cfa6-4ff7-8401-c26aee86616c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911516, "uuid": "617448be-c573-4a58-9adc-b5876d135277", "value": "wife.ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20f4c74-5991-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779861852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861852, "uuid": "1bc0d2a3-a453-44d3-8d0e-ca88da6579f5", "comment": "Malware payload (RemusStealer)", "value": "86f7a221db1a0bdba38d02503821dedb", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861852, "uuid": "1fc9ab21-a860-4407-b727-28def27d77b9", "comment": "Malware payload (RemusStealer)", "value": "4b1d954729c4aa3dcbb9e81ec47c4ae1950af995d39f7855dcbce49b989ad456", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861852, "uuid": "e29bdb36-7c00-49f3-91a3-29f24228119e", "comment": "Malware payload (RemusStealer)", "value": "19e64b3f359c2e351111aeb5ef50a34228c80549", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861852, "uuid": "995c4bc7-caba-46a9-acf8-2947a51bf998", "comment": "Malware payload (RemusStealer)", "value": "b781b1bba7aa182550bf5974ae3c4edd268006843a9dc13005d234212060aedeff1f2c95fe3d88482be838e8dc7f8b4a", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861852, "uuid": "58db4e94-55fa-4a42-91c9-d195bcc67f66", "value": "T1D8654947BCD064B9D5EA923288B5A2917735F8490B3167C32F11B7BA2E373D04E753A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861852, "uuid": "3d5f7e52-8185-40c2-a1ca-f70c1e187e50", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861852, "uuid": "a60fb0a3-9e4b-436e-b8de-996d6b4a2a66", "value": "24576:tEGnBEX3GiF4unOy1MgL4QtolAz7HgjQ6OgLP8jWF4ZurOsD1:2+BG3GiiupuQtoGzXgLPQsD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779861852, "uuid": "15f967f7-7ed5-4ca6-9ce8-bb02a271c4ce", "value": 1540096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779861852, "uuid": "ddd7068f-ed97-4396-9339-a114414ae88e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861852, "uuid": "ba2b4e04-aa67-49b8-8ea0-5cac891595da", "value": "\u0412\u043e\u043etsexecs64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bce469-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880677, "uuid": "da817d57-e347-4f44-8a6d-ab4d1eb5ee8b", "comment": "Malware payload (Mirai)", "value": "2747e2569192f7b6ba4683885458b23b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880677, "uuid": "66847639-a281-41cf-8f78-fb7031239f99", "comment": "Malware payload (Mirai)", "value": "4b75ae3bcd64a3c11d28b7f0d893f62fc47112be8a5d91b0f3e1abfaf11a8a17", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880677, "uuid": "0ed79733-8023-455f-96f7-c95ec923a16b", "comment": "Malware payload (Mirai)", "value": "e730f8a5533787d759d91530030deb1885cc0e9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880677, "uuid": "e9d0c09f-b596-4a69-b5dd-9d2a6a26e73a", "comment": "Malware payload (Mirai)", "value": "f3b572f42e06b578189590ba2ec21171c2eea6568a0133f1c6db9d4f506adf22bb4a57045980317718e345865210ed2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880677, "uuid": "89bcc39d-4355-4f26-af79-3b8e492ed426", "value": "T170B31A45F8505B17C6C252BBFF4E428D7B2A1768D3FE320399256F30379B95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880677, "uuid": "83ff23c2-b373-4853-b8af-4146ee550532", "value": "1536:rSA0nJ8HeyJ4V04jTp7FkyjOq7E2AsQkslCtwywovqUV5vuuKoSpXkZvO:mFnJEJ49jl7K1rR7eO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880677, "uuid": "deb1c4ad-79dd-4a95-97b6-5fea07b7ec5e", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880677, "uuid": "ce97bc65-654e-448f-9dd4-0fe99e867213", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880677, "uuid": "335d5b86-2557-41af-ad38-c30ca2df637f", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad18cd8c-59e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779896552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896552, "uuid": "21f3210a-0d5d-443a-aeb2-d0c8fdacf685", "comment": "Malware payload (Mirai)", "value": "d3a2a9005e43a5941b6c0ccde515b6b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896552, "uuid": "832a392c-f26b-4575-b4d0-56be7bd3763f", "comment": "Malware payload (Mirai)", "value": "4bcebe0b5e615e64bc22ae25a93b06cace75b2b5dd2f1cd406cb9a4d840886b0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896552, "uuid": "513feb9a-5140-4fc8-9ddc-e70a55a22501", "comment": "Malware payload (Mirai)", "value": "ce4b89624d43936213a86c8a650a90da44371b22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896552, "uuid": "6c11e063-1e76-43a9-8e11-4a6a2177bdd3", "comment": "Malware payload (Mirai)", "value": "515452dd1a2213ecec7219cf2895904f1d199963d237efbd21cc1115cd77977c59c7b7df5356045ec98f805f77de1403", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896552, "uuid": "2251e287-fae2-4392-bb15-98d0411bf422", "value": "T11183A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896552, "uuid": "a322cf2d-40b2-46ed-baf6-0bdb4cb9aa28", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTUb7ZDYovZ73x/nL8y8r:Rakdn2Eo3ePu5GTYRYo99Be037Wt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779896552, "uuid": "043399c6-b26e-4f05-9d71-386c14096151", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779896552, "uuid": "bd38bae9-625d-4d7f-9691-726b5835358d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896552, "uuid": "f13d3628-9ddb-460c-bb03-bc192ca9c7b0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20cc0707-59d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779892022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892022, "uuid": "4d8296e0-10ad-46ad-bf3b-a9f098ef4a98", "comment": "Malware payload (Mirai)", "value": "dd504b8d084e9d7f718bdef47872ce52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892022, "uuid": "d3b2736d-f221-4602-9ec4-5b3167d23b72", "comment": "Malware payload (Mirai)", "value": "4c2d532827cd66741885425d186b1c1bea8c77345d2a6b8c339c4b79d9c545d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892022, "uuid": "6ba7d5af-cb2a-4f10-a605-f2dcf4048d78", "comment": "Malware payload (Mirai)", "value": "320be9be517832b070afd0c3c53cc047029a0cf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892022, "uuid": "6fdc9a0d-985f-4661-be92-f157129cb60e", "comment": "Malware payload (Mirai)", "value": "7dcfde6941c267844e9709deee045b93b984b72e61b78db9ba29dbbf3372ef385c7f4df28ae40686ba09763573c5c343", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892022, "uuid": "8b44c57c-441f-475a-91c1-1a71a75eb6c4", "value": "T1574618173A18DB0EC228223459B1CED56B791C4642DB9527F392F309A8F20BD5A6FDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892022, "uuid": "651a40cf-c8a9-4b00-9e2a-96a021a7b8ec", "value": "49152:940vyECb8cSb2mBnvxtlWwTNMntsB3BeqOW8aLtp+5Sr35DDvX5PNPeYbjkLzuwE:PLPJNHJvv0N0nF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779892022, "uuid": "6abccf51-b061-47ca-bf1e-2cf755014782", "value": 5636279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779892022, "uuid": "da1d12a4-afcd-4306-a516-f8a7fe4aeaaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892022, "uuid": "3251fae9-6bdc-421c-b3e2-cec38805af87", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7e5bf5-5a27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779926057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926057, "uuid": "a5730a76-d9af-4932-bad2-8d1f28c31a95", "comment": "Malware payload (Mirai)", "value": "bde5f0108fb564902a77684421abe9d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926057, "uuid": "3d6485b1-245f-4d45-bf11-7137d8f70a4a", "comment": "Malware payload (Mirai)", "value": "4c830e63c6251710752c90024776df26286ea6dee31e5d807d6aae3fdde499cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926057, "uuid": "e375e306-0943-400f-b662-3e799d04e460", "comment": "Malware payload (Mirai)", "value": "be6aed3437918274d8906cb358b16d28c37cde99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926057, "uuid": "8dd79017-d823-4147-abdd-a46840d0d17f", "comment": "Malware payload (Mirai)", "value": "f1560e8959001c4182feabc731d89369304089cbe703e3a5a83a5226dad16a979f90b193dbc1cbd953878e753a1974f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926057, "uuid": "0ee4b34f-6d41-4c3b-9660-11309718755e", "value": "T146E608927F85DE4FE2A420348AAAC23463D53E40C6E074329662F3191E7F2759D6BDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926057, "uuid": "2c4c5597-25d1-4464-96ed-9953fe810ff1", "value": "98304:9r/z9KBcFU5++91nz+SGnuy1PkRGqrz8CjEJ:9rnU5++91nz+SGuyIrz8xJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779926057, "uuid": "b55d9eab-3c8f-468b-94e3-b0d5c4d88b74", "value": 14090402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779926057, "uuid": "683d98d0-d91b-4038-b9df-549186833717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926057, "uuid": "1ffbb2d0-b508-4202-be6d-2f54975aaf8f", "value": "SecuriteInfo.com.Linux.Mirai.9788.14294.26121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589f1289-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880949, "uuid": "d568647e-c177-4c97-9196-3b61d7eb3337", "comment": "Malware payload (Mirai)", "value": "54b608f5eae2411301307332afb29165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880949, "uuid": "7b7c58de-68e9-4dd5-985f-e551523ffc50", "comment": "Malware payload (Mirai)", "value": "4c8595a0ed40548cf4e92ecf569ef57b7d97dc25f29da9e49abe3c260319618f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880949, "uuid": "8c130962-301e-46e8-b73e-4b164e8aa220", "comment": "Malware payload (Mirai)", "value": "911f8f7335546f8548c12334f71531bed4054bbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880949, "uuid": "c9ee81f8-2f08-4f25-8d9e-90917061a3bd", "comment": "Malware payload (Mirai)", "value": "9c998a6c9109e0c2439e94679c4244f5e1f6f0ac3e2470ecaec020965212a18c8c84e55af99d0e72ccfc60f8ba8e22c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880949, "uuid": "745feb3d-d6f7-49fa-99d4-a93c3ed34247", "value": "T1D714E90AAB510FBBDCABDD3706E9070239CC641722A57F357674D928F54A60B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880949, "uuid": "d44a38a4-428f-4b42-9e9d-309d42a0dafd", "value": "3072:at2MxglrsnBd4i8wyfuWOIMhS8yfEvVd+vXO8DE3PRJk:aMBrsnBd4iTyfuWODyfEvVg2CEJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880949, "uuid": "4b4f3d18-f5b7-4d86-bf53-a4dc1f55e71f", "value": 202280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880949, "uuid": "6114dea5-ecec-4c29-8992-9f3f737a2f46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880949, "uuid": "32f1cb13-d658-4956-a2f7-eb871ff6ce7a", "value": "micro.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555f248a-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913585, "uuid": "e0188625-8a31-4d0b-818b-5f64a94a90c0", "comment": "Malware payload (Mirai)", "value": "1b808050be580bfd5727d71f47c81649", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913585, "uuid": "3affdf37-64e5-4148-9932-c7ded26816e5", "comment": "Malware payload (Mirai)", "value": "4dcfbac2c01eaec09f1ef959d6a25fdaca5fc84936b07328f174031738d888b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913585, "uuid": "5fb1759b-a4ec-4481-a99b-9695c736c25a", "comment": "Malware payload (Mirai)", "value": "d649d92ef2b2086b42a4b90f596cfe6dc966df28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913585, "uuid": "8ee39ce5-b99c-48c9-a674-41c1ac8d9431", "comment": "Malware payload (Mirai)", "value": "4f8138bc12c74dfa348051ab17f0499a8eb6c551217987304a59e650d0a6601ffd5b5d12eaab8ef6feb76fb23059b1e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913585, "uuid": "f7ad28ae-b10b-4329-bba4-4338669a6a9e", "value": "T18D41F08E5F315EF9F559D43C4737073427AE514883D04249E2ACEA506EC430DC99E7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913585, "uuid": "45acf4d5-928c-4082-90c7-3ed22190f39e", "value": "24:3OShMgJc8AmsCxj8Amyz/z2HdllPBP8qtWB4u37I8paXDdz3N9l5zBkEp7iJAGnL:+SegJNOw2H7zP81EXD/9LuEp4nHJsOR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913585, "uuid": "35b8fe5c-d449-4efe-98e2-28e45abce444", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913585, "uuid": "3def3e47-a2af-44ce-8798-25acc6d7c3f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913585, "uuid": "d88a2f72-5f56-449c-90bb-feca4f0639c4", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce4418e-59e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779897760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897760, "uuid": "844c145a-0e63-4d45-97d4-2c0d8504e0b7", "comment": "Malware payload", "value": "495ab0ecea44e7c95f601b800e9924e1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897760, "uuid": "a83a314f-a100-4540-babf-5bbfcae0c5ae", "comment": "Malware payload", "value": "4dd9966df557b6d0327ef92c12d1ce87912577f13c928e1d817a54803939f666", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897760, "uuid": "2bcacd0a-0758-4b3e-aa8a-8ab48725e831", "comment": "Malware payload", "value": "9b279ced9ad74ca7891673aa5573978a13175e9f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897760, "uuid": "b01000b3-5d04-40be-9c31-fffc3074da2c", "comment": "Malware payload", "value": "6ec3fd185fa73a7536f486ca2651a1f18dd830e7490d22726518fa552107616d7e47d5b44260064c097c00bc5e8126b5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897760, "uuid": "dace7eef-891f-4221-8c8b-e7ab33646f66", "value": "T1524633420EEE7E0880813AF1346CC558929A079E75FB87593E4AAF2F7544EFE70D9724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897760, "uuid": "c477facd-b795-4886-83c2-285ef8f4fb59", "value": "98304:sOHcYZQJNaMUK+1Ah+Z+cI6avIRjqjStKF19ZWX7d4p3eBA6L1MuDiXO8oUc:XHjQ8ZAQbaAt4SKzG7d4p3eBAq1M6+zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779897760, "uuid": "10552c2c-3525-4c35-8d81-d4396e9cd927", "value": 5476238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779897760, "uuid": "e1907758-3e75-40db-bd81-3099e17a1371", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897760, "uuid": "2715e00d-229f-4936-abbe-8a7cfa87abaf", "value": "book_photo_2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8ef1f4-59d6-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779891315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779891315, "uuid": "550ceed7-4c0a-4942-ab83-e79f933beae6", "comment": "Malware payload (WannaCry)", "value": "05d7538b86b07e6afbee7b7ff21ef40a", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779891315, "uuid": "0bfb6d1f-7d1b-44bc-9d98-39635d814e12", "comment": "Malware payload (WannaCry)", "value": "50a9f720deb53f88edf2f6761f1f82aca0bbde9b98e8abc6f79a3f8390bbe67c", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779891315, "uuid": "67e20ded-d9cd-4f14-9460-82c8655cdefe", "comment": "Malware payload (WannaCry)", "value": "bca494d260b735c1c05d13903f6aca3b703c6147", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779891315, "uuid": "715a361f-46c2-4760-98b7-b0ae450682ce", "comment": "Malware payload (WannaCry)", "value": "2bd9539dab141ea39338f049127bfe7c26d942298ffbe58c264639c1248b6c8e421ba377746553e3c5710d224cdfe50e", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779891315, "uuid": "9ab09a00-51e0-4931-a142-f7e19fb8aadb", "value": "T1DA36238931BC81FCD1061A7484B7CE12F2B37C6A21FA5B0F9B50857A2D13B96B764B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779891315, "uuid": "dd03fb32-e861-4d4b-9efa-8d45b19e03c6", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779891315, "uuid": "6204e1ef-acf4-497b-ac08-4d20f42c223a", "value": "49152:jnsnnMSPbcBVQej/1INRx+TSqTdXr6SAARdhnv:DMnPoBhz1aRxcSUN6SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779891315, "uuid": "5e67decf-a44f-4a76-b8fc-4ade233333db", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779891315, "uuid": "f18fb293-eef5-43ac-b974-8ed5299dd576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779891315, "uuid": "5fc74cf3-775a-4eb3-89ed-308b3a8033c5", "value": "50a9f720deb53f88edf2f6761f1f82aca0bbde9b98e8abc6f79a3f8390bbe67c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8288cf-59b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779876013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876013, "uuid": "082f366d-5800-4e4b-86ff-2014470ec6db", "comment": "Malware payload", "value": "dcc938384f59429f1a8439a05ccec548", "object_relation": "md5", "Tag": [ { "name": "instantwebupdate-com", "colour": "#D2FC37", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876013, "uuid": "1a55a137-d4f0-409b-96e0-8b50fdf84717", "comment": "Malware payload", "value": "50c3063a7d5671b2c68c2a7f600b5ddeb2e27efd00a812aa9d9dc38d3711b591", "object_relation": "sha256", "Tag": [ { "name": "instantwebupdate-com", "colour": "#D2FC37", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876013, "uuid": "8153e02b-a749-4cb2-a4e7-bd47622b1371", "comment": "Malware payload", "value": "7b9b2484df773df547264111f037fe06e5087113", "object_relation": "sha1", "Tag": [ { "name": "instantwebupdate-com", "colour": "#D2FC37", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876013, "uuid": "167a2bd7-3ff9-43d1-8ae8-32a405545350", "comment": "Malware payload", "value": "a31ce473ffece72d558b24e1db7e30e6d4519e1869e0ce24dcef210c5648806cd54f0bd8c8689be78a7b739d3ec4cb19", "object_relation": "sha3-384", "Tag": [ { "name": "instantwebupdate-com", "colour": "#D2FC37", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876013, "uuid": "3d925084-d405-42bd-90fa-513d69f1d7ba", "value": "T16496DDAB6DDC361E3000B1C6F48521F5E6621336DBDE12D9B8F924337AFA49AC42D746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876013, "uuid": "4850741c-d96e-4c3d-a3ee-7047c8e11edd", "value": "6144:YubnYpscV3SqA5mPYsTvQw1z8jBZlLtH+Bp89S5mfs5wpNvVwS0msFJvXiESUWjg:kPut6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779876013, "uuid": "1582e886-7153-444e-a5d6-300e9bdf0706", "value": 8884144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779876013, "uuid": "cb8853a1-a85f-4fbb-9897-39545545cad1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876013, "uuid": "f8a334cf-d9ec-4168-bf22-05939984fbde", "value": "Update.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7291a1-59a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779871323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871323, "uuid": "95f9fc6b-9119-431d-95d5-c881f40eeb13", "comment": "Malware payload (Mirai)", "value": "fe930f65d32e40f0ed31854885e7796d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871323, "uuid": "cd72d18a-6934-4c5b-93cf-458b4aeaaeea", "comment": "Malware payload (Mirai)", "value": "511b039448227e48c14e715c3ff8ceaac82f7e4781df60e1c5f1eb79bba86e98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871323, "uuid": "4040d5b7-a911-4685-9296-116204f15828", "comment": "Malware payload (Mirai)", "value": "189e637e47de7c9be540a416de16f938b6b50525", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871323, "uuid": "4710578f-b052-4d5a-b46f-09c4855b6358", "comment": "Malware payload (Mirai)", "value": "bcdece4703dc243220ea798f06f6042be0c0241077796895c07c0aa1c1e1c6933bb9ceb6bcab4a0488b88c32c2c05027", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871323, "uuid": "e21251a6-bd06-4998-a6ab-5ba049e33590", "value": "T1BD66AE57F6B244E8D8BACC74831EE173EA28B889821271672FD45B012F26F64EF1D751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871323, "uuid": "283953d0-25f1-4bb5-b2e4-950b2d9cb4e9", "value": "98304:j3iZw53telT/DCVux+rmLkrbdHtrxqP+WVxykdp3WwLZr53ZcGwgAB:+ZY3YJDCl5bJduZLZ54p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779871323, "uuid": "adfd689f-cd9a-4504-afec-abf60a99d5dc", "value": 6619600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779871323, "uuid": "8c5a8a95-67c1-4dc5-83ea-8260ac5d15b5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871323, "uuid": "b283d840-19b9-42b8-9975-b1fdcb003de2", "value": "settings_malware", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c74b9b-59ef-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779902115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779902115, "uuid": "3dbd1ed3-1f62-431a-acd7-7ac1f19a234e", "comment": "Malware payload (WannaCry)", "value": "48cf64ac4f8db5c0e05cc335741fd3f5", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779902115, "uuid": "419feb69-e643-4770-93b4-85bdd29c8be7", "comment": "Malware payload (WannaCry)", "value": "521acfa745e99821f387a1ab22b991a4813c2f93a0a92978f3742fc9ceac2efd", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779902115, "uuid": "3ef77c27-e701-464f-9b52-84418ce68886", "comment": "Malware payload (WannaCry)", "value": "d52fb0b40b90c089644862e97c64a6b384e60efa", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779902115, "uuid": "0d829a36-c9ba-43b8-90aa-6afaec2cdaf6", "comment": "Malware payload (WannaCry)", "value": "5ba67cbc152deca3b06ef4ae4fb1ad33149ca698d98f6131907d3221107b26184f0f4bc7a55749c62b3750350592b5b6", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779902115, "uuid": "260afe4b-c718-45e2-a089-2c2bec7b0aa1", "value": "T1B2367CD0568B6E25D81E0D304FC4B25F3361E893C799272F6692AE7A4DE1EC10F4F668", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779902115, "uuid": "98eadbae-24be-44c4-8fe2-de9921564d61", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779902115, "uuid": "daddff20-031b-4b04-a748-440ea58b0908", "value": "49152:jnXnAQqMSPbcBVQej/RMEcaEau3R8yAH1plAH:DXDqPoBhzO93R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779902115, "uuid": "55308fd3-c09e-4787-9512-9e336feeccec", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779902115, "uuid": "56686b45-dbef-4f18-b107-c1568639acfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779902115, "uuid": "ad614cec-c01f-4caa-9f1b-61f896bb32e1", "value": "521acfa745e99821f387a1ab22b991a4813c2f93a0a92978f3742fc9ceac2efd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f2cdc9-59ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873918, "uuid": "4610b160-523b-46b1-84c8-14ab23f15c7a", "comment": "Malware payload", "value": "7104f0522a0322031504b81855edc59f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873918, "uuid": "45cf6aa1-2746-4f74-8ba4-d3b3503b6903", "comment": "Malware payload", "value": "522c435e2074c7812ff0b800d2ed01c87dd4a667bc386f77a4083a1ea25b5cbb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873918, "uuid": "0f124edf-3ca8-4453-a4a2-f0565005c127", "comment": "Malware payload", "value": "9fa4722ec2d66a1ed8a5701656115279002d078f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873918, "uuid": "e437381d-5bc7-4c6d-83ae-53888aeac5da", "comment": "Malware payload", "value": "bf4e5560fe5bea0d2482db3b04c5b6b058420836c7318612dcdf12bf92af7abd1f08ea3567b0b283b29806997439e7d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873918, "uuid": "c1d8e963-4607-49ee-af2e-bbb7cad2b5f3", "value": "T1B5856D13B2C9753DE0AB1E3A4E77E608987FB7722906CC0B67E0096C8E395445E3A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873918, "uuid": "638aad1d-e901-40d0-a3dd-97ff23e0e05c", "value": "853cadafdb8c01f57f7849b9166e5f1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873918, "uuid": "57a32a63-a041-4aa5-b07e-1e48864dbad1", "value": "24576:4wjLj/FMh0WUlCRToVnGnPd+PDyOqFkN9kflH58QpOuOSjYpk:40jWtoVLPDyOe1pl+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873918, "uuid": "6a92d9c5-5284-4fe9-b8c4-2620d3f9981d", "value": 1802752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873918, "uuid": "82707b75-78ad-4198-9bb0-f4c09f7d4f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873918, "uuid": "d028956a-bc16-4b26-bd85-ddf150b89cf2", "value": "__tmp2048.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae0745a-5a04-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779911151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911151, "uuid": "858f6f0a-f372-4f91-9887-a25bdbf21783", "comment": "Malware payload", "value": "9f494ad4f190b3b330ed8d1bc9131b25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911151, "uuid": "82d6a57f-9b0e-4bf5-bff6-155fa607bc47", "comment": "Malware payload", "value": "52748f567577a1894ebe137895a087160ad627397f05ae700f6f44f37fcc6e34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911151, "uuid": "5e09512e-1cfb-415c-a5fb-f694fb6596c8", "comment": "Malware payload", "value": "cbd3d5c48a5f569c17ebc489cf92fb3b70a220a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911151, "uuid": "68b65b07-fe46-4894-9fc7-5dbf7f69380a", "comment": "Malware payload", "value": "f78657cdba6b59aaac06f58fb56da902088cb14e7832320614718283d1037b81a78ac04503146f1e2ccb0fbb0602bc88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911151, "uuid": "826e7841-5498-48ed-9402-704a1978b5c8", "value": "T1B2A401AEB4E373FDDCFBE178B5472091F5ABB48056208EA79390D0A538359A0593EF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911151, "uuid": "f17cae04-21bc-4ded-87d2-9b4169fb1003", "value": "101e9da62927c83ffbe9363e7b60b054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911151, "uuid": "bd2afa40-c855-413e-810e-17e3fd91d854", "value": "12288:C+OaWiLhFuAh7H2Q0sdkXnj6MO0mrTYBk:IavLhdH2sdkXnj6b0mQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911151, "uuid": "14f03e0d-f8f9-4a55-8ff5-18c603c6440a", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911151, "uuid": "f1b13304-e886-4378-8122-fd0093a638fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911151, "uuid": "f4ba0867-14a9-4472-bacb-b4017de8c43f", "value": "endpointpart.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a3bc9b-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878826, "uuid": "6f564aa1-f53b-448d-8260-745f0662d4a0", "comment": "Malware payload (LummaStealer)", "value": "bf9fdffdb05344a52640c4b49ee7f216", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878826, "uuid": "37c168cc-e51c-4bb4-8bb1-ec4831f24406", "comment": "Malware payload (LummaStealer)", "value": "533defc21c8ca45ae5f488be74aafb33785d6d6b49812943f3e0da3564a0632d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878826, "uuid": "9b7b4528-af8e-4a14-8161-e06d02840f41", "comment": "Malware payload (LummaStealer)", "value": "bb7bc52da579bc28d70e7efb91a66bc1e8f01b8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878826, "uuid": "8adde375-d166-42b0-bb7f-e56fa9de0a9f", "comment": "Malware payload (LummaStealer)", "value": "226f3cf1499baa8d410942fc2b4222023179d5327af49b23c479bf867dd8cdc0eed4a60a8d0f4957a56a40bea64c3f36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878826, "uuid": "00fb2015-6e9b-4a53-b3f1-cf085aa294e7", "value": "T171748E4AE7B748B1E5470975229FB33F9B2416144328CDDBDFE0CB447A33AE26539A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878826, "uuid": "f431b6b6-71bd-48a8-8e7e-72dbd7e7aff6", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878826, "uuid": "a465bc62-2331-411c-9cfd-8ed669c31b4b", "value": "6144:sRLI6zZvCw5/8m5RtUHD2zSnK90dK7KDhAoK4Yeh9bDvJFess1WX:0Tj50mhUCzSKGPlAoK4YehVvJFek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878826, "uuid": "c0d7d5d2-ec72-4d35-9943-29b383fb8203", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878826, "uuid": "027cb813-ad47-456f-8cc7-2f15c5c80549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878826, "uuid": "deaf5399-61f3-489a-b920-a0235b92ed52", "value": "533defc21c8ca45ae5f488be74aafb33785d6d6b49812943f3e0da3564a0632d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b41681d-59ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873276, "uuid": "3de03fed-cffe-44d1-93b0-0343622d812c", "comment": "Malware payload", "value": "c159b9c21c8dff86f7178bb06de341f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873276, "uuid": "5b7f9a10-ab49-4a05-baa4-ed24d6673e4d", "comment": "Malware payload", "value": "541a2aa333d716994951bcfce1d653da1f1e992315387139dbbd98de7d66dc10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873276, "uuid": "f0b896ff-9a80-40a6-ac9a-fbfb8e76aedc", "comment": "Malware payload", "value": "1e6a5053882fac8d48c6eaef9d385034cd67ce8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873276, "uuid": "891495d0-3f43-4c90-be16-fa81dfad5a6d", "comment": "Malware payload", "value": "200d580f9c1714174de9318bd0b479b71a03e1d2208cec508905bb9e69c5c746d7f103c291891fa2d272bbdcc8512930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873276, "uuid": "03059aff-0dc3-4483-975b-2b8e03082403", "value": "T12C76E044FB47ADFCFE6658B18647F37F02526E05C0E1CD72EA4C7A4AA87396200F5A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873276, "uuid": "48b6b7a9-a44f-444d-8b47-c55c5193d96c", "value": "2482c911e99b2b20ce01ccde1d92d282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873276, "uuid": "dfcf14db-2bac-4c24-a38c-af0ba6d2e778", "value": "196608:KoDen9atMVmaQurE6CiHL6ToIUwGA77dx:5en9atMgaQ2E6CK6cFB273", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873276, "uuid": "22f5f995-c1ed-4e66-80ab-ba821e6c5f77", "value": 7300608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873276, "uuid": "97bff91d-fdcd-4218-8dce-4ea3ff7c9418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873276, "uuid": "bffa175d-437e-4915-a843-5eff020fb97c", "value": "541a2aa333d716994951bcfce1d653da1f1e992315387139dbbd98de7d66dc10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134c03e5-59bb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779879544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879544, "uuid": "df73f5f8-f376-4419-ba57-2a3eb98e3852", "comment": "Malware payload", "value": "f113892a4ddef5bb7f4ff04ebdbeeaa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879544, "uuid": "a1f797aa-2b8b-4d95-9c81-200f19ec8f50", "comment": "Malware payload", "value": "54b3318845d6e324e86cc6015df4259be32b50f3e72ddee15b0c76e8fc4f7269", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879544, "uuid": "21de327f-31eb-4cd7-be84-9ad63c5c77e4", "comment": "Malware payload", "value": "468151d281367c95afe2658ead1b476f40011077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879544, "uuid": "6b05fcd9-8bbc-40bc-b634-d43926cfe394", "comment": "Malware payload", "value": "3310c8b1856f230e0cb79e4c9f3e7610473a35406369ff74943414dcb1c8da10e3f32a6496992c1d2a40ed5fe7895ee4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879544, "uuid": "e3f0630f-4816-4726-825b-bc9988ed2812", "value": "T179F33B1BE1E360FCC167C57487979272B971B81817306EBB5694EB352E20E607A3CF26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879544, "uuid": "2706ee17-4d11-48ac-93dd-ff728725a0d6", "value": "546156921ca0d991e6e7bea1c8f84c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879544, "uuid": "fb257e9e-ed40-4b19-8811-ec285c9002a6", "value": "3072:I3CEzY/An1D4E+J3Mwy69AjYK9xZ/xZ36W/:ISEzY/MD4E+5MeGE8xrUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879544, "uuid": "18195904-55fd-4795-ab08-b043640b1233", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879544, "uuid": "daddc583-192a-467b-8e9d-1c9ee2de7b60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879544, "uuid": "89dd2db6-1dfb-4669-8e7d-23c1647807ca", "value": "54b3318845d6e324e86cc6015df4259be32b50f3e72ddee15b0c76e8fc4f7269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8043281a-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779881015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881015, "uuid": "1cbe1851-1173-4660-9262-33f67ccb9b75", "comment": "Malware payload (Mirai)", "value": "ab4ff7f0385894bcd0f7154dc35988c4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881015, "uuid": "5378855f-baac-4834-bc0a-193057edc60f", "comment": "Malware payload (Mirai)", "value": "54c70ad8d3ad96e620887893bf6feb349f336137d52341289650a134b074b199", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881015, "uuid": "a80f8a20-2a55-46fd-bbc4-5cf7b3c5093e", "comment": "Malware payload (Mirai)", "value": "dec45998c42906ad61d35ffba74a683295c72e7f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881015, "uuid": "af19eab4-3cb9-444b-ab37-bd0a56432a20", "comment": "Malware payload (Mirai)", "value": "7b1bca1a25ed8b2b16f13abe6114f2553bb67fa1e3cac99ed9c36d98f9bb89334c74ba7635377ed18c06e51d5356d0de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881015, "uuid": "f255215a-4fd9-4b07-8e50-169c42540ba8", "value": "T12C155B5AB2F374FCC167C031439FDBA2AC39F4A911126E3B21C496353D56EA01B19F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881015, "uuid": "49fb9a65-e674-46c8-b1c9-3bb8077c580e", "value": "12288:Rpkw9Z/J4H+8jmgFA4sNGzpnssY9GAdyyIf057jfP5:R/7/d8jmgFVsNGzpnssYQADP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881015, "uuid": "9dfa76de-2a68-45e1-ab22-e4434150684a", "value": 892064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881015, "uuid": "9802f724-56a0-4711-8236-7bc352494fdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881015, "uuid": "bfddec8b-231b-4b23-aed1-77042260857f", "value": "bot_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ba41de-59ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779886171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886171, "uuid": "da1f187c-7fd1-474d-9056-2ba6324de075", "comment": "Malware payload (Mirai)", "value": "50041fbb3bff1552a478c8acf4be4936", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886171, "uuid": "f398ad92-82a0-49f4-9820-150774a3675d", "comment": "Malware payload (Mirai)", "value": "55655adbfe5d03feee0f6675a599bf82cc1c6588d15946b43530e8ef85180137", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886171, "uuid": "efd3833d-f9b1-4dd8-8c68-7e456319144f", "comment": "Malware payload (Mirai)", "value": "bbfbd27f7658cc5827d2f38cd4138c147c9ce581", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886171, "uuid": "415e14c6-ad63-4bda-9939-aba2ab7bee94", "comment": "Malware payload (Mirai)", "value": "069fcac7befb0d7ff7823d7a9327cf38091364431582fcb0ce534cba8ff6b71274f5f405759ddfe00490148344758792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886171, "uuid": "bb266830-5537-4091-9112-f1721bec0a05", "value": "T16C36F797B8814A83C4E4367BB8BD80C833A74EB99B9753566D04FE3C3ABE5990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886171, "uuid": "4b704cd6-1be4-47ec-9be2-2c6d4e463ecf", "value": "24576:In3MZ4su33kN4vdR7t9uv3sI04kDMCsUIMQalD2U0icsMBj69D7UuW/tVXOy0Od5:qX6Y8pcK1xEFg9ntHcMxh/A5ajpKLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779886171, "uuid": "2a497903-57c4-4216-8a35-9d56f4d3619f", "value": 4915352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779886171, "uuid": "2996b580-132f-45dd-8a55-f2028d0ddc7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886171, "uuid": "1a55b7fe-c33c-4f63-8019-1091e5cbe6a3", "value": "55655adbfe5d03feee0f6675a599bf82cc1c6588d15946b43530e8ef85180137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a500a5-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913592, "uuid": "3b6b4bd6-2a34-47ac-ab8e-a5cb2c5cc322", "comment": "Malware payload (Mirai)", "value": "3524c301eacbf3696322c6622f5734c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913592, "uuid": "bc29889d-8576-4833-8983-c0a4bf61aa03", "comment": "Malware payload (Mirai)", "value": "556a3dc254f21921d0b0c2240c49f2e1edf682615e064db97501a0a7de2c8546", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913592, "uuid": "f9e3521d-9698-4a73-8e83-42e83be1b59d", "comment": "Malware payload (Mirai)", "value": "bec8ca5fa091894b5d4210c1a64ce372467a020e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913592, "uuid": "edf73320-3818-49e0-8346-0aec2cbcb654", "comment": "Malware payload (Mirai)", "value": "9264dc3c92ffb7d7d463781c3c743171738ad30e05c61e205aad9f45aa930bfc3a0aad9b693ca48ef3f97ecd409fb0ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913592, "uuid": "253dde30-3707-45fa-9083-e139115f7e7e", "value": "T128210266E2D4ED32E76200F65285BF832395CED43156FF0B99914512DD2E5C0D133274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913592, "uuid": "74f312da-9f7c-4ac6-a469-b5937e2c98b1", "value": "24:FlWMeFHxgxEmceZGQleZ3eLtQvBawyGues9OmGruQ4/jdNfBc:fWJ+coGQlo3eLtQZGqsspH4/5NO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913592, "uuid": "971b23bb-435a-4723-98fb-5f9b17529ff3", "value": 1196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913592, "uuid": "e888da2c-0a42-4a77-8118-dd547cf0c2df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913592, "uuid": "07b11ac7-f905-4ce5-b908-4041054db473", "value": "dlr.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db8c363-59ba-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779879266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879266, "uuid": "30b0e856-7696-4f39-814a-14078bd35a71", "comment": "Malware payload (LummaStealer)", "value": "3a668373885f82a134608cf9f827b101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879266, "uuid": "b1f278d2-8517-4277-b24d-8e1c6e3f6934", "comment": "Malware payload (LummaStealer)", "value": "55759e81fdc53d2deeca4ffcc284a5990fcdbcd2daa1514a0b2bed6bbdf5645d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879266, "uuid": "bc890458-61f5-4e46-91e2-e76e56bd796c", "comment": "Malware payload (LummaStealer)", "value": "8d4bab2c041a151f715550ab013b755d8a066398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879266, "uuid": "adb111ca-f781-43a8-8f87-b197df1a4b10", "comment": "Malware payload (LummaStealer)", "value": "97f44cb9edf7499d7671479180869f348aeccbd0a622e444101287baa653dc36f82200aa0482c18aba369ae9e95f72f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879266, "uuid": "7539c97f-6b9a-4ed4-a45d-4f303bd92486", "value": "T1081733D812DB41D0E8C6397514363E1E8639FDCA41E072CF93B77826767EA91042FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879266, "uuid": "fb442170-cb84-41b9-b707-d057887e1376", "value": "393216:CbrP0oui1urhK0L8CLtPbIS3xvzNkEKLTx11Gt83iEyUoRsjeVC2OLy4lx:krP0obukU8CFIS3xbNUHx11i8PyUKsyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879266, "uuid": "599b0268-c6c8-43ae-9bc3-12bdcec9a3fa", "value": 19497656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879266, "uuid": "64af502e-bd23-438e-8d0f-0061cd647a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879266, "uuid": "be69e9ea-8a92-45e1-b75b-32b20c7777fc", "value": "55759e81fdc53d2deeca4ffcc284a5990fcdbcd2daa1514a0b2bed6bbdf5645d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9564d2e9-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878903, "uuid": "38d6e1f5-6a45-42bf-ae1d-ff93108df3d5", "comment": "Malware payload (LummaStealer)", "value": "8bc4baeb1574f93a351b38dfc77f775b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878903, "uuid": "e1892179-125c-47df-bd1b-d2e548c2fc75", "comment": "Malware payload (LummaStealer)", "value": "558d71323a2d26b20e7f2e94342c745fd1b4ea2d22fec6697e4bcb330aa0850d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878903, "uuid": "1732ee51-3a8e-4067-9a30-1e7c0ebab756", "comment": "Malware payload (LummaStealer)", "value": "bf09d60358247c3af6b76004d905776aa0f67b0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878903, "uuid": "e77d2933-703f-4180-8277-ce7937d44d14", "comment": "Malware payload (LummaStealer)", "value": "498d84fa9b00aa48cfcf4e9b53d79633861bfc400614bdb1d33a4d902aacfe577f07ee8fdabb5388c5d54734c768fb56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878903, "uuid": "53ff9800-f57b-42d1-96f7-2ef5fe38ce0a", "value": "T164747C8AF7A758B5D94B0838229BB33F9F3417194728CECBCAE0DB8079376D25535606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878903, "uuid": "5b326dbf-23f0-47fb-b8b2-8584cafad1e2", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878903, "uuid": "a00eccec-e57c-479b-98f0-44e1fd33ae02", "value": "6144:EfVhOeLXTkgw1XNDdeqMkDQ4HZ/r0j3qjBDrVSEOP3qdUngw0r:86eLXQ3cqTDNHZ/r0OtDrIPAUgwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878903, "uuid": "33aff64c-1386-429d-86c0-c86f467aba15", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878903, "uuid": "4792dd96-e721-474d-ada0-8411e7d5d8a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878903, "uuid": "9a51d1dc-4f7d-41fd-a158-0d06828bb563", "value": "558d71323a2d26b20e7f2e94342c745fd1b4ea2d22fec6697e4bcb330aa0850d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b376038-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911528, "uuid": "7a84c35e-b068-42e3-b4c0-b964ffcb2d64", "comment": "Malware payload (Mirai)", "value": "fd1e39b61bd07e991c04ea3cff1dfd37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911528, "uuid": "cc192c3b-6a70-478a-96e2-b421b291b8d0", "comment": "Malware payload (Mirai)", "value": "55e650c1eb640cf85f7c8ff5a6f04cfcb3449f90e7d1b8668596cb6c1e40b9df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911528, "uuid": "810b13d9-ffbd-4243-a830-80f2a50803d5", "comment": "Malware payload (Mirai)", "value": "b29c76f6a57de448bcda171dcf3b556cb18b2e96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911528, "uuid": "95eddea0-e9c7-479d-88db-9f5e5639b7f8", "comment": "Malware payload (Mirai)", "value": "cac16032a1249ac831df9fbae8544feb538d1a4e5a6ebe7ed1756974359b5683a6e341811d0eaf0aa5f312d563b09b17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911528, "uuid": "eb7cf082-b3f2-493c-bce7-d2d77ffb0d45", "value": "T189C62A8BB9924982C5E43A77F8BD81C433670FB99B8756565D04FD3C3ABE5DA1A38300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911528, "uuid": "42857a29-adc1-4f58-b599-0298d58e2013", "value": "98304:7zsjwUvVEcAqkSd1l867g9LEe+dVHz+SG9xI7EBayHWpBThER:EjwYCqFC67ILEe+dVHz+SG96ABaFgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911528, "uuid": "5f288b65-2672-433a-90ce-8da5c0782043", "value": 12255394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911528, "uuid": "58291e56-24fd-458b-b819-75dec19dc847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911528, "uuid": "af5b04e8-d292-43aa-8eaf-d57a1c88abe6", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e77f621-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878811, "uuid": "84881cfa-64c0-427d-b4af-315eaf32bcdf", "comment": "Malware payload (LummaStealer)", "value": "09ea7319d81882da0a0f101f2d87e42f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878811, "uuid": "97507a40-26e4-4214-abb4-3cc3b3df79a1", "comment": "Malware payload (LummaStealer)", "value": "56a4ccdadafc68758340a5f228ba2d8423733255493f3f719366dd4d46dc8999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878811, "uuid": "d8dcdd52-87b9-4b10-b8dd-638baff42a63", "comment": "Malware payload (LummaStealer)", "value": "1d9e3d00c2ac130d0978698a69ce892851beb496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878811, "uuid": "55f28240-0fd7-4ebe-9365-eb8047cbaade", "comment": "Malware payload (LummaStealer)", "value": "db0511546982ce695d5b822b585e81262344ea6b04a588b56cd7a5fa0199c74eeee4376d570244944e2629787760b651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878811, "uuid": "dfdc0034-b6f4-45a7-9260-c376eeb07163", "value": "T1BA748D46E7B748B1E54B0975229FB33F9B2416144328CDDBDFE0CB447A33AE26539A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878811, "uuid": "92a877be-088b-4d3b-842f-f3dc53229514", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878811, "uuid": "02beb0bf-fb85-4f59-8669-fe7c8389f374", "value": "6144:sRLI6zZvCw5/8m5RtUHD2zSnK90dK7KDhAoK4Yeh9bDvJFeyH1WX:0Tj50mhUCzSKGPlAoK4YehVvJFeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878811, "uuid": "8d4bed40-8b23-45cf-affb-cd2a08c00588", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878811, "uuid": "00e892c0-0288-409b-b28e-3687fac14874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878811, "uuid": "7d512c5f-0a07-4dff-a572-eb3c373215c1", "value": "56a4ccdadafc68758340a5f228ba2d8423733255493f3f719366dd4d46dc8999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1b97c8-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911692, "uuid": "b553850b-f4b1-4cfc-b895-6ca7881ecb94", "comment": "Malware payload (Mirai)", "value": "c421d10ca1e9406da3544777057a475f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911692, "uuid": "ee8d209b-dcb8-4164-90bb-4e69ac3c0383", "comment": "Malware payload (Mirai)", "value": "57a51d9f2a515e61d09dd7112a4911eab8f5a45c49fec8cd0f91bfddc0dddc47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911692, "uuid": "4cf21526-b97f-4925-a231-98a9b3eb457a", "comment": "Malware payload (Mirai)", "value": "4cf5e95f9d3fff37840fee57448cf9c4a8a030b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911692, "uuid": "a4f08803-9f0f-480f-8be8-d26a77673b46", "comment": "Malware payload (Mirai)", "value": "e2b8bb5d087f0b4f6e01437dcc1d2370a71bb282847566aabef6c525f03972243a6f7622b36ebb886afaa3f6253eb76d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911692, "uuid": "99afa3b7-ae9d-4982-b74c-24650554f3bf", "value": "T1E6C36CD5FA43D4F6DD5305B12037BB378F32D07A1125EA83E3B959229CB1A01D61ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911692, "uuid": "8f4b59f7-3db3-4d4c-9c5d-394f916d5b83", "value": "3072:7W2WA4KfsQDNSHjiz2FBOez5Bts4ceGM5UQ30hAB1E3:Zr4KEKcHmz2F4emeOQ3G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911692, "uuid": "c02edfaf-9438-44f0-af37-d76874cf8a04", "value": 123208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911692, "uuid": "13cb1b40-3208-42da-b274-aaaee95d84ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911692, "uuid": "4a1f8c7f-4b94-45be-9748-ca785488d0a3", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0660c7-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911663, "uuid": "a00305b7-6b29-4acd-a700-8259e6bf3f71", "comment": "Malware payload (Mirai)", "value": "d26c1c172f59959c1d7a200593e51e09", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911663, "uuid": "2b1ac80b-467e-40d3-a2cf-f8250094d28b", "comment": "Malware payload (Mirai)", "value": "57d16d8d465cab070447136f08da0fb40f6f341ef97fceebd628bc4b3f87a33c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911663, "uuid": "438ebe17-1062-474e-9ae8-23f77d4e35e3", "comment": "Malware payload (Mirai)", "value": "719397e15e8dc8d415bc9aa070da5d002e91dd53", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911663, "uuid": "0d0de7d0-ac2a-4813-ae83-c6a17afa1004", "comment": "Malware payload (Mirai)", "value": "037ac288863e9537c127643d34d23214663aba8676c4ce50ad8395a7f88d869208f8bfe723f00255e630e06efe9940e8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911663, "uuid": "63a14ca3-e47c-43c2-83e2-772fad3ed255", "value": "T1FF51B4C542440C3C28637A13E6B68228328594D2ACE97B95DED8BFF0475FE5873A1753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911663, "uuid": "43d90faf-2874-464c-8afb-39769742441a", "value": "48:iA7B7N7hAe6GAgmzPAOKWAUoUA7U7o7UAfz3bAR9RAIcgAtpVAmSOAi+CADfTAry:iA7B7N7hAe6GAgmzPAOKWAUoUA7U7o7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911663, "uuid": "1fc6b419-3fba-4717-b1ef-b424d6311e92", "value": 2977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911663, "uuid": "2c0d3e34-3341-4d3c-81bd-b42c18a61e5d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911663, "uuid": "c6ff8c0a-4044-4978-bcfe-1a55cd8b75fa", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe06ec3-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878941, "uuid": "937fe359-680d-4ae5-9b92-fec0178adcc2", "comment": "Malware payload (LummaStealer)", "value": "f5fd15bbb8215733a9760a0ecb117585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878941, "uuid": "9903981d-3d56-44f9-9d68-c993cfd19fdf", "comment": "Malware payload (LummaStealer)", "value": "58b2c87b0b4f5b037a86f26ff5c75914ca48c5ed9af55aa52652435a6002e5be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878941, "uuid": "6caa2cc2-1292-4fb8-b895-fa67976d27af", "comment": "Malware payload (LummaStealer)", "value": "0819f03f9f7363d0700db7c21b633c7a58a81fe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878941, "uuid": "5a367afc-a3e0-49a7-8906-14dc2353acc0", "comment": "Malware payload (LummaStealer)", "value": "be994852f1a4179626dd87d79121a6f12d95c6c41d4e3019db93b0068a2ff5a9f3b803448f7ce68b3916dc2e69fece88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878941, "uuid": "3b95ad66-da38-49f5-9ecd-521ef309449b", "value": "T15E748C99E7FB58B1D9470938215FB33FDB3416158628CE8BCBF0DB00752B6E26639606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878941, "uuid": "48f59c91-2602-48f6-ab75-250aa5e7b86c", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878941, "uuid": "ae6fb54e-b620-4604-bc40-d10b66a5652e", "value": "6144:Jq59DxVbJnraQYg/MqPUZ52LJlEfsX/quQhqQmWWuI40ANKwywe9IHyaQvRegSmI:gPDx5JnfvU2l5sWuG4Kwywe9IHyaQvRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878941, "uuid": "2fb52b61-8089-4555-9380-d8ed74158896", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878941, "uuid": "61d4eb87-e1a9-4144-aff7-5e19d9d5048c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878941, "uuid": "5e1cf40b-a500-4451-8b59-f1ab74714800", "value": "58b2c87b0b4f5b037a86f26ff5c75914ca48c5ed9af55aa52652435a6002e5be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d09e61c-5a27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779926053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926053, "uuid": "13ac8fdf-a04f-4f29-8946-abb24d692feb", "comment": "Malware payload (Mirai)", "value": "bff49a56d5f4cd7df0f32f291eb8c0a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926053, "uuid": "8d393b0e-6eb9-4ea2-89e6-392f4dce2248", "comment": "Malware payload (Mirai)", "value": "594f1d72141f3b14051ad4f3a0a6e263119d7fafbb4764fba5e90511d09d2f60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926053, "uuid": "39b0d1d5-4a0f-4fd0-b63a-3b12b8dcbc6b", "comment": "Malware payload (Mirai)", "value": "9e5afe9d0a451769fdd89cc2be23776e323f9fa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926053, "uuid": "c3f8595c-a04a-4fd2-9704-089fd21c5221", "comment": "Malware payload (Mirai)", "value": "e1461f1a91651e7aaf0566b1963d3fe6898b2b2e02307d006469560dbbfccd2289a5bde68176019d205e6e565afbe833", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926053, "uuid": "f46b83d7-6474-4439-9a5e-d87bfec9b950", "value": "T1A043023D6B86FC31D6F2D1359AFC8AD12C99AB3AD2D25402613B1E19D6E18C09DE44CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926053, "uuid": "5cff43ce-d71e-4799-a732-6d3456a19311", "value": "1536:iV/rn3NWnLTSZ8bvLJYr8GvV5s5HAw6QGo1e98A1PFALO:in3IJur5vVC5HPj31eP9ALO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779926053, "uuid": "20ec8ed4-ef55-46e3-9212-d1d619fb4fef", "value": 59020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779926053, "uuid": "87648dee-388c-43b9-9e06-e6ae7d091f4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926053, "uuid": "407b3b88-d777-4449-8490-bfd9925efac3", "value": "SecuriteInfo.com.Linux.Mirai.9816.20108.20123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31d0cb0-59da-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779893153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893153, "uuid": "7fa949f5-5e87-4842-8606-4bcf096fd4a0", "comment": "Malware payload (Mirai)", "value": "1981f1f89f5e073a0d43276de71624c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893153, "uuid": "b5a6f03e-08aa-4f7a-9689-81e6260a339d", "comment": "Malware payload (Mirai)", "value": "5b10be68b9d9106c1be2400895a2238770563179522959d2d1ba7972e5652dfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893153, "uuid": "8bfbcc38-26ad-44a6-ae99-db7b67d8d810", "comment": "Malware payload (Mirai)", "value": "ae56ac394818e001073301a4723e29780331fe8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893153, "uuid": "51e85e52-7d84-4f26-8e54-81834e7b241e", "comment": "Malware payload (Mirai)", "value": "5981688c70a5d1b3403e5855349aa53ba09f4043579cbe3ef70edd97d410e7e6ff20a4a94a4c201714352daf84fea6bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893153, "uuid": "e1e79fef-bd06-4bab-b10e-c885b2a17456", "value": "T1BDB33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893153, "uuid": "1bf125ef-aa66-4f4c-ae4b-e35bec55fcb2", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJl:4azwz102cPPaRl+AS97Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779893153, "uuid": "502a957c-42e1-4648-b891-99c8f18f8b89", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779893153, "uuid": "4ec72641-14f7-49ba-b858-8fedb56d9d0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893153, "uuid": "f4a0044c-db81-4cbe-89e4-041f56d8f6e2", "value": "5b10be68b9d9106c1be2400895a2238770563179522959d2d1ba7972e5652dfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8052f0af-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911509, "uuid": "bbba7572-81fe-49bc-b96b-e29f66ccce1e", "comment": "Malware payload (Mirai)", "value": "85fabd71f0e8ab96b45f72cd419175fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911509, "uuid": "c9917437-13dc-4309-a8f5-4b8edc7af97c", "comment": "Malware payload (Mirai)", "value": "5be3d3edd52ca339e0e6e6cf1b8e9270c18b8906a3873ee7db553f81b591d024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911509, "uuid": "72969355-f3a3-45c0-96ae-e53f2fb6abe0", "comment": "Malware payload (Mirai)", "value": "2bab378a70f9e854783bbc45764595446c4f593e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911509, "uuid": "b96f7e40-ba24-4164-a0c6-9f437a76148c", "comment": "Malware payload (Mirai)", "value": "bc2f3f63b1b0c8c15e752d80e7dcf14a2c06118179999185d58c5000a5d2530e56dd2403b69d1d2f448f53b60f16c781", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911509, "uuid": "57d078d6-9a4e-4f5e-8877-1d2168f61e6a", "value": "T141D63BC2D562C29EC73C3D31DFD6B7D8A37A2E34E6C0958EC8C8B73918B3215915A961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911509, "uuid": "a4d4233a-9633-4f92-98f1-5c9190508699", "value": "98304:eQvjztfKHLg7XDrG07++91nz+SGyRGJN0J+q9rz8ZjEx:JfKHw+m++91nz+SGV4Mq9rz8ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911509, "uuid": "eb84757c-cdb5-478e-bbc1-911ed03a5c67", "value": 13172898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911509, "uuid": "d1e3cb99-0b75-4e7b-bb17-8a00bb5cceba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911509, "uuid": "44898a28-65c5-4b59-98c2-00ec9f97a7e7", "value": "wife.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf6ebfc-59e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779896554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896554, "uuid": "01367ae3-eec5-4d2c-960c-a008cae2f145", "comment": "Malware payload (Mirai)", "value": "46534d1fea6afa0de889dcbc799e9797", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896554, "uuid": "e1539cf1-bb69-44e7-b330-61ffd126686d", "comment": "Malware payload (Mirai)", "value": "5c226d56c883fcd3b6d9bf8a65a7f6fdf33d83c8b7e1fc28dc2e14a00768f53b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896554, "uuid": "02e6214f-c742-440f-a65e-2a5bb1658f96", "comment": "Malware payload (Mirai)", "value": "bd40fedbbcde996da832ce2c59fda698a292462f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896554, "uuid": "022a0c57-fcab-47c1-8970-7b7acecf99ec", "comment": "Malware payload (Mirai)", "value": "9900f687648903d195ef43810ec9b8570e5b1c9facb555a75f6e105d85854709bf551206f304e6e5607329f70bc9f264", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896554, "uuid": "16cd3e76-13d5-41c2-b7f7-9998b417b9a8", "value": "T177633A21BA761E1BC4C1947621F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896554, "uuid": "0439006c-dbba-41ea-833e-8e04a41ab238", "value": "1536:lGBVg7AOotXhGIAsQXt3AYQlQm75YH/tatJV:lSCzxBCQmVNPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779896554, "uuid": "ac149ab0-45cd-497a-a471-4b76d7b9bbc2", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779896554, "uuid": "18c65e58-84e2-4955-b43f-ae5173421b14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896554, "uuid": "7795867d-1663-4e10-b96f-3933c6702ca1", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1efa6b-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924766, "uuid": "18bec65d-327c-4f9e-97ad-c1f00753496c", "comment": "Malware payload (Mirai)", "value": "01165b64d2bc17959805fb0883178dec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924766, "uuid": "8117d22d-49d8-4c08-a4a7-d65d0e02416b", "comment": "Malware payload (Mirai)", "value": "5c522d69ccb30c4ca1f7b4c770ccff88b6915c533c451e8900bb6aeb93ede332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924766, "uuid": "7aa49d0f-f8a6-4403-a94b-fd4306945bec", "comment": "Malware payload (Mirai)", "value": "eed9c99ee554fa5111c944935ee9e06460a58680", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924766, "uuid": "7a3f9cb6-2c77-4ba2-bd20-1c1df915f457", "comment": "Malware payload (Mirai)", "value": "e6cd03c27b87bf2f3c70d4c43152fa16340755cf48855a2aaefa3c1957a453a8630fd94f7ad18d5e1fa6d2541e2d5b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924766, "uuid": "83df661b-5a36-4873-8d97-be2428847b7c", "value": "T103042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F12A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924766, "uuid": "2812c66c-c3c5-42a7-8798-c39e8c1ef173", "value": "3072:OLe6vhWZQIvuCeeuaMuTuRez43IVIL7ZQy38YhTfYo+M/RgDlplLn:ee6vhtIv1ruaMuTuReErL7738+x+M/Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924766, "uuid": "697fc449-3479-45ef-a3cd-5f32528248f2", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924766, "uuid": "a762ee63-53df-44ec-a569-f8c765dd0898", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924766, "uuid": "a7986c90-0918-4a96-b48a-531dce2ebeea", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3ea8d4-59fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779908520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908520, "uuid": "8f0d1202-2247-44c9-8e84-9b7b0d635ddf", "comment": "Malware payload (Mirai)", "value": "d1afe7c3b26ca6e8b29572cd92f64063", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908520, "uuid": "fb017d3d-8c67-4da6-81ae-14c499d43981", "comment": "Malware payload (Mirai)", "value": "5c61335e64c69a3b045f840fd9a392c63e3b3f06ba82c8a05538b7a8afbac7f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908520, "uuid": "0e94825b-f616-4c98-9568-8ff730ad5f76", "comment": "Malware payload (Mirai)", "value": "8f6be70453a68971c40e115ad36e3e7d08599b8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908520, "uuid": "9665fafd-3264-4563-a468-9438fa1c58eb", "comment": "Malware payload (Mirai)", "value": "3cffedd03425b400542a03c50ff2c90f1eab5661199f111d791a43ebc3e6c3a37655286fee1734cb501f0bb9be09b9f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908520, "uuid": "daa76284-350b-4bc2-b485-52c6f6cf6a4c", "value": "T12B934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908520, "uuid": "ea8a200b-c83c-44ea-bfbc-4056487a802b", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JINiS:XGptyz+VJzB7T9/bLUAx9e/SBJOiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779908520, "uuid": "8e902d44-b058-462e-86f5-dac8878fc028", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779908520, "uuid": "26219818-f26e-49ab-b360-b7f8f36a9216", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908520, "uuid": "809c5098-e4e4-46af-8178-d3721669e2de", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9b7f0c-59ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873283, "uuid": "08a3b36a-b447-426b-aa96-b868d4a155c8", "comment": "Malware payload", "value": "8f9fa4a6cc40769690e265ef16821726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873283, "uuid": "3bade25d-dba9-4878-93dd-5492290d40d3", "comment": "Malware payload", "value": "5d5fb8c5d73b353bb06effd5b517567d7a06a431fb36065659211440622efa09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873283, "uuid": "f5619ab6-20dc-4f05-ba49-85f84ccfc30d", "comment": "Malware payload", "value": "87dd13275086733a428f1b812861991f5a75ac64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873283, "uuid": "09155cc4-c33d-4e99-9ea9-43d11f1c04cf", "comment": "Malware payload", "value": "8e5bf0cd76566c5b6894d22da5a58d31b33085ba12603dd517bc7e59eb6d36bde53aea2f88194e11ed941ff69e7cf3c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873283, "uuid": "1bba6bd7-a094-4ef0-b052-71af173b0838", "value": "T12F76E044FB476CF9FE2659798147F37F0269AD1880A2CF63EA0C7916AC3399218F1B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873283, "uuid": "d3420d8d-4c3d-47e5-8968-ed3e251b33b7", "value": "3053bc797c33f817e73d7224ee7069eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873283, "uuid": "65891d73-3a0f-4912-b8ca-1f978efa34fb", "value": "196608:U22Y+kTnCLPRZilZsJn9p7P3fPfJb3koT:U3KTnCRZ+ZsJ9NPBbUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873283, "uuid": "a087ef19-392b-4d2e-a60b-1c5295fb8a17", "value": 7769429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873283, "uuid": "1860e029-9221-41b9-8e6c-76fb5eacdd70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873283, "uuid": "eb501924-e2ac-4f3d-b0ab-b7ecb727425a", "value": "5d5fb8c5d73b353bb06effd5b517567d7a06a431fb36065659211440622efa09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7f8986-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911666, "uuid": "f27dc645-a55e-47bc-8d08-4910209423ac", "comment": "Malware payload (Mirai)", "value": "a53e0d30b869f262f34276fabe19f2ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911666, "uuid": "42f5f87f-67ba-4331-ba30-05275a3ba4a0", "comment": "Malware payload (Mirai)", "value": "5e05fc9e7713ebac9dad5091a5c0262e7c3eac0454ee4f7ac101580300eacb5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911666, "uuid": "d141fc3b-e7f8-4c9f-bf86-dc260ede1484", "comment": "Malware payload (Mirai)", "value": "fceefc9ca8067ae47708c1fd8afde5784831e5dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911666, "uuid": "1a7d37fc-7718-44ac-9991-be6ec30bedc1", "comment": "Malware payload (Mirai)", "value": "b94f1584de00044b821d39eb2b9b225e923110d3c59f6963ba62ae54ce7463eca646684f391f1fc715eb06566c3ea803", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911666, "uuid": "96c47dd8-5df3-45f3-9fce-226556b35eb7", "value": "T135E39FB3F30B1091C82306F417CB6B9C2E2315425F6B86D3BCAA313A2A765DE5915BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911666, "uuid": "25fcc50b-c9da-4047-acc4-65e3a69f6fa2", "value": "3072:X/1HeTDitCaG9y+y0+Xk+cdLfSFztgQg5CvugQt5SPub01yLq:P0mGvy/aKFztgjCvattLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911666, "uuid": "e3f5741b-dcb1-46b1-b167-583c0c50d1a2", "value": 157136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911666, "uuid": "530c13f5-ff33-4821-8b2f-e3b66b3a72ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911666, "uuid": "cbacf123-d8e5-446b-8dea-8348192ee0bb", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9676236-59a3-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779869541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779869541, "uuid": "4a214a16-b934-4a46-bee9-7f88494b5208", "comment": "Malware payload (AgentTesla)", "value": "78f77ab6b6f24c0a93da98aa4ac62a1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779869541, "uuid": "8cb250cf-a3cd-40fd-b201-4576884af184", "comment": "Malware payload (AgentTesla)", "value": "5e3d464d7841ca9726397abb1c1d2feaa353b5e79061ed57aa08e9d57b64f7a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779869541, "uuid": "be6b0412-7d36-4003-983f-44bf497f7c72", "comment": "Malware payload (AgentTesla)", "value": "b2fcbc2b61386ad4a10a07d9aaf1ccc8705703a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779869541, "uuid": "eb86333a-c078-49ef-b83b-8291fe906d63", "comment": "Malware payload (AgentTesla)", "value": "62992c5dad9f7f8125e919b97f365f6bc7fbfb47c0ae70cf9025da49c1b1207e9e973ac3c8c7cc603cf3ac7ebbedf875", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779869541, "uuid": "9be5cbd2-c9de-495e-86be-722618e76830", "value": "T17A0619001A76E07595EED31DF436A7B0250EA213508CEF6F32A8923976A2D1367DF5E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779869541, "uuid": "0b5a9667-3496-4ae1-8951-46965db12e2b", "value": "98304:vi7KiPvn36k+umsrjF8+yAQNfhpwHUP4/izWzAAgbsWiUBrtYaGW1fguxaTwO:vOvh+nwj6DJHzGMsWRBrPj1fS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779869541, "uuid": "aaec9132-c448-4324-9aad-1adcfd0ec3c8", "value": 3946738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779869541, "uuid": "df297ae9-885c-4eb3-85f2-61bb2f558f72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779869541, "uuid": "061b0f41-7a86-43a1-a82e-667fe8589adc", "value": "14_00299214S0260657.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996c7992-5991-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779861730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861730, "uuid": "9b3cd3d5-28bc-49dd-84e0-88e5d34ad955", "comment": "Malware payload (NetSupport)", "value": "95d2410c0cbdf5af68ed0b78a9824a84", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pwd-fanbot", "colour": "#FB428C", "exportable": true, "hide_tag": false }, { "name": "pwn-fanbot", "colour": "#5B6266", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861730, "uuid": "429aedad-48d9-4481-bf3e-5f01618ef52f", "comment": "Malware payload (NetSupport)", "value": "5f4f34d88c530fdd91c67292f14407c0e389958f2ec98e3bd65f65000075091b", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pwd-fanbot", "colour": "#FB428C", "exportable": true, "hide_tag": false }, { "name": "pwn-fanbot", "colour": "#5B6266", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861730, "uuid": "58f9e096-6464-4e54-84ff-55338036655f", "comment": "Malware payload (NetSupport)", "value": "586da7d81d984f410aea0114dc9879e0f8d2a677", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pwd-fanbot", "colour": "#FB428C", "exportable": true, "hide_tag": false }, { "name": "pwn-fanbot", "colour": "#5B6266", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861730, "uuid": "468aa258-732b-4e90-96e7-8edda8d76791", "comment": "Malware payload (NetSupport)", "value": "d409b2fbb8b71944ff1624b4ae4fa1fa327eeb738fa9b78fd95810deac5483b8ea871143629fb8f35b8d7a18b534ed2d", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "pwd-fanbot", "colour": "#FB428C", "exportable": true, "hide_tag": false }, { "name": "pwn-fanbot", "colour": "#5B6266", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861730, "uuid": "ea2ab82e-128d-4d5b-b966-9178505f95fd", "value": "T1B5C5334EAA4984DBC9674F74800B5F1EC33E3941E2BDB081E7318292CDD9B9B976871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861730, "uuid": "8069ce71-814b-458a-acf6-3fcedbca7389", "value": "49152:5istkPWKcquae+tGkYrp7LnqVnJTmm3F+WVcBdj3b2+3bw/0JBAThAnl1N9s:5Jtkyqu9+tVSvq/VYj3b2+30/wBvVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779861730, "uuid": "d4d67520-163f-408c-a6fa-51be1294c5d5", "value": 2534402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779861730, "uuid": "ecef11d0-fd3b-4f14-a736-7d7741168717", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861730, "uuid": "b670d5c5-f52f-4424-9e74-2d8520d2b6c5", "value": "grace.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7116695-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779879040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879040, "uuid": "9bba32cc-3811-4814-8524-28c8654defbc", "comment": "Malware payload (LummaStealer)", "value": "43313153a8f298e5efe93b3f88ff1e11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879040, "uuid": "5391a311-3033-4143-93d7-db1898a926cb", "comment": "Malware payload (LummaStealer)", "value": "6047dbfe68f78cacd46b948d62a9e6a58318852609141b66ea2c1c8fcf063540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879040, "uuid": "439fc350-0d86-4555-b524-c78c66398f8c", "comment": "Malware payload (LummaStealer)", "value": "7fd356a85c47212b23d112c337dd1e75f4ee9928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879040, "uuid": "83e09df7-d48f-47f7-bb93-07bdec68d476", "comment": "Malware payload (LummaStealer)", "value": "cf3f3a0203b6cc9b65405aa3ec4fbefde0bde09da77aa2f5feb25d4eca775569c60304ad7a0bf96bfc8a33c38d97e380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879040, "uuid": "9c4d0242-d198-4fe6-80c3-22accc013ae3", "value": "T1ECE438DD12988114E0A3FA7558A4BF352934FCC17EE086CB6EC7367B493CE82892D725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879040, "uuid": "7d73d570-fec6-4568-981e-ac1075f98475", "value": "6144:jM3aE9pQwJAmzcEkslHiww72K4ayoiTwBB+h676tzLqSB6Yo1bIlV4I0rIS:jsaE9myAmIhEW2KbyNQB+I+LBi100rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879040, "uuid": "40861263-ecc8-45c6-87c1-d2e463bee8f9", "value": 675280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879040, "uuid": "56afa03a-4df8-4867-8e7c-ca8140c6c2df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879040, "uuid": "10f12d81-d6b6-4262-9461-5462c7f206ce", "value": "6047dbfe68f78cacd46b948d62a9e6a58318852609141b66ea2c1c8fcf063540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4dbba54-599e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779867333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867333, "uuid": "14697f15-8076-448d-ac28-4c7ed73f6e5a", "comment": "Malware payload", "value": "586fc8ce629725ccbdc14fe35070959b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867333, "uuid": "8868a146-6464-4532-a67c-a50a8b7c4011", "comment": "Malware payload", "value": "621097b50088eb97cf908b87b0babb0afd8f5bc3f38b38dd4672222cd9602d5b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867333, "uuid": "c2d10922-2228-4a58-8721-31e445150c51", "comment": "Malware payload", "value": "27303fb3bb6ce5db195bbef14254fb621a52f19d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867333, "uuid": "3d790b7b-07e2-43ca-9783-ffd28f30922b", "comment": "Malware payload", "value": "1af824b8a5742b8e69daccf1e50497b929c881ef57e4adabef7a874f1c7a53d23b5b37989b5355038a1d686d1d6adf3a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867333, "uuid": "cc7b5950-28b2-40ba-8fd2-6fa8d717ce0c", "value": "T19A136D6526953C25AE99883B5C7F2F0CB9A983F2304491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867333, "uuid": "ce8b17f6-875e-4376-9510-8ed9c89f6443", "value": "768:Wnr9NyXsZztCF9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:UHusZ3cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779867333, "uuid": "b764d34a-5d16-4134-8303-6d773900d48c", "value": 45514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779867333, "uuid": "cf0ccc42-b934-4579-a9b9-d75bccdface3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867333, "uuid": "35195514-3d9d-4de6-8c41-44ea15abed7a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511c3c16-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913578, "uuid": "5d7d378a-1126-4314-ab60-9be09d62e906", "comment": "Malware payload (Mirai)", "value": "8001076bb28709363298337bc8156385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913578, "uuid": "09d9bf60-2496-4fa3-b84e-659529cfb50b", "comment": "Malware payload (Mirai)", "value": "6298b1af579cef7a34b304a25aa598a63c9cd4dbbb1a8d799a98fb2ca1551f30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913578, "uuid": "8b01250e-4df1-4ef8-8909-10d3ee73f512", "comment": "Malware payload (Mirai)", "value": "4f6588b51f5715f3de7e445622b4f4aa05dab2e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913578, "uuid": "24430634-fb03-4ca4-a75b-267cc2f621a8", "comment": "Malware payload (Mirai)", "value": "0f8fa554a7c37ce71a7b8535e0e3485aa5ed0e04bfa4842d2c76c0b9db20cf0e3c3d5a3895c1b90c0c76f410b1ca9181", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913578, "uuid": "4b9e4795-16f0-4942-8723-8644bfe0b8f7", "value": "T11F41120E1FD01F37EDA6CD36415A274136CC842F616A23526334E960BD3E605F6D38E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913578, "uuid": "3089bb28-8ddb-4073-8603-6f87a1c37f29", "value": "24:eT3+n8CcdmpHR9ixZuDa9mCt5BJL4mmlZ9E7peogu/qs+UTK81kKUlu/NkTeZwFk:Ut2OnuDW3B6df9ruS8TLGPkuTeqFGX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913578, "uuid": "e978d9f5-09bb-467c-b7da-072598a4aa4a", "value": 2048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913578, "uuid": "4364cb42-ff1c-4989-ba45-5c7d56d506b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913578, "uuid": "7704bf93-e899-4b3b-a503-32892c1068ee", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adaf6a22-59cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779887104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887104, "uuid": "0cb8df17-ab63-48f1-bdde-5ef416c757ee", "comment": "Malware payload", "value": "d65fe05a3bee25edf755a4bdb8fe1a91", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887104, "uuid": "39f8937e-357c-4f7e-b326-e4452df2b3a9", "comment": "Malware payload", "value": "62fdad7df8fd7bc2b211c2de06c002831b36987b48a943758432f25006661578", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887104, "uuid": "bf5144f3-6559-46d9-b5e5-a61a61745266", "comment": "Malware payload", "value": "db5aeb0d1554f53c2eab67243251383ccfdb7c6f", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887104, "uuid": "ba95eada-6d3a-4f32-a509-04cebae951f6", "comment": "Malware payload", "value": "85adfc75df5c8c1a93711c5d1659655a79d78eee21105850e9c0e32af738bc422cc9a026724e45d349baa5f3e7a310bc", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "Evasion", "colour": "#ED2010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887104, "uuid": "b5c07045-1b0d-487a-85b8-dea88c4aa3ac", "value": "T107758D253785C136E1220272AA6DBB66D2EDBD306B75AAC7B3C81E0D1E715C35A30737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887104, "uuid": "848d23e3-b256-4eac-8d3e-f919c678afa5", "value": "0cf6fa6edf06c0b95d28954dc19082d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887104, "uuid": "6b83cd0a-c6fa-4f4e-a63c-7c30a01fb3d4", "value": "24576:ao8Yh5f/OwtXTGjlouCP5nFk5YlLw53AHcMmpIfm7gYzfrnerQw+:/5PD/uCP55L0AHcMmpIfif7YQw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779887104, "uuid": "d153ff73-eee2-40aa-863e-b97de564782f", "value": 1679312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779887104, "uuid": "11cca0c0-382c-466f-a972-b39c3752a693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887104, "uuid": "0b9e3f9b-49e4-448f-8aa3-1cc0cab8481c", "value": "PhantomX Nexus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9d86a9-5998-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779864821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864821, "uuid": "8eaf601b-4c43-4734-93f9-d751aa11b2f6", "comment": "Malware payload (Mirai)", "value": "2c7d393ba52c69175d910fbcd0ae2921", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864821, "uuid": "785cdba6-54b8-4795-adf4-961caebdbb1a", "comment": "Malware payload (Mirai)", "value": "6380463007c664be8873080075281d40dba1da8c703f9336eebce4f1f5709f90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864821, "uuid": "234a18fc-5b62-4df8-b84c-e26a98285d0a", "comment": "Malware payload (Mirai)", "value": "8fde1edca2cc96d2a05258a4b93fedc56b724b18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864821, "uuid": "c172b348-1a6a-494d-a06e-58ed78c3266a", "comment": "Malware payload (Mirai)", "value": "e40d8ce5e0b5e72d67aee01d7cbf07059cd1dacfc6c5be216c1190fb74fbb344cbfa8980a906ab360d0c95ef18512f5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864821, "uuid": "61ddb624-778c-4c02-a749-c561c3b4d5c9", "value": "T1E7B3D81E6E258F6DF3A9C33447F74E22979833C627D1C685D19CD6106E6038E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864821, "uuid": "8d1d1667-3568-4cb4-86af-374e58e63dbd", "value": "1536:aY/bi3KqqRC7trkT9MPiD4PdXetLECGno/JONtweydAbXZXp:ax3KqqRC7wnUFXVCGno/JOL8At5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779864821, "uuid": "76b01e95-ef09-4be1-9d8c-68293f2cd71b", "value": 110116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779864821, "uuid": "1298a696-9b29-4f3c-8f02-0006e930b3d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864821, "uuid": "67a18547-2153-47bb-ae8d-3c914ae7bc3e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db849df-5a27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779926054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926054, "uuid": "edcf9d3d-15d0-494b-a8c6-31c65d272bf4", "comment": "Malware payload (Mirai)", "value": "21633698fcf26095c4946a7ac0394666", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926054, "uuid": "6968cf8f-d5a1-4dad-b79f-fe52e3a4b4d1", "comment": "Malware payload (Mirai)", "value": "63b55e92c9e18352d180b602a20853b7cacce51b0b51724917bbf43a48f7a027", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926054, "uuid": "17ae131a-38e9-4104-b908-eece523b10e0", "comment": "Malware payload (Mirai)", "value": "2fdcebf61f8bb816125e85425133ba23b8b428c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926054, "uuid": "04bda3cd-ecf3-49fe-bcdb-efccf088934e", "comment": "Malware payload (Mirai)", "value": "dc3461c56cd7a2fd74072678e1cf1017a738fd4b5f45ea138f2b6199e46116bff2177a9941b1ce846c3e4113290a24e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926054, "uuid": "708abfdc-b182-47aa-b8e3-70683d1e8d22", "value": "T18743F17C021654DEC46FC6B55B721BE23CD60FF51253F0C87DBCC2A28A2A66679423E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926054, "uuid": "227944ba-6473-4681-bd39-c3c8cd007205", "value": "1536:NaKQ/4P8ewZUT+h261O2JkI+TfEZJ6pO/l0QJxoARIVJub:1QU8eTqjnJk/tp2X5mVQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779926054, "uuid": "c9d64379-35c5-4906-a21a-903a7f6caf01", "value": 58304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779926054, "uuid": "19803749-b365-4860-9a16-e1bab4b16286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926054, "uuid": "5d96e799-4c9f-49dd-b173-a2381c4229d4", "value": "SecuriteInfo.com.Linux.Mirai.9816.2221.32376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ce8949-5a01-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779909604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909604, "uuid": "5b618d1b-4844-48b0-84ed-19665775ffe2", "comment": "Malware payload (Mirai)", "value": "1909ae2c4be68ff3e2a921881667a7c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909604, "uuid": "19adb7fe-a8c0-4dfb-9ca5-44238dc01a00", "comment": "Malware payload (Mirai)", "value": "63df0c35ea180b58f3b39e9bc91d14e33dcc940325aea294c229cb6654294e68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909604, "uuid": "3a4d02d0-3f10-4eaa-8fc0-c24f1cafcfa0", "comment": "Malware payload (Mirai)", "value": "2e499aaf1b276610eb1a19d82925dfe879363765", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909604, "uuid": "3737db01-e0f6-4dd8-b96b-f4cf345ff17d", "comment": "Malware payload (Mirai)", "value": "533cfdc8c61679d3f8668d9ff1fe5ea738aa8f013c00d64595d516ef88ca7d88f00d969847344b5cb3a7c82f76059898", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909604, "uuid": "01760d14-f394-4682-9b3e-e7a5b8c9aa96", "value": "T1E9D34D06B30C0947E1633EF4373B27E193DFEA8125E4EB44651FAA8A9272D324586DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909604, "uuid": "0b4a8fdd-493d-4862-bdd2-ba8931e77db6", "value": "1536:BdqO8koz7xswz3+uumnsqSUup5CGVSvv/YUUh88tvATsmjfNxPx7sAzkQw+3QHcN:BdqO2x3zR3vAUeqTZ31+EvKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779909604, "uuid": "8b73a820-4c15-4dd7-8578-ca51c1d14a0d", "value": 137916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779909604, "uuid": "b4612fe0-10de-49c0-80ee-c29a8aa4cf11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909604, "uuid": "2d3909d5-3c16-4f25-8d79-04f35d92b25a", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abed6860-59e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779896550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896550, "uuid": "eda9e39c-002c-4666-97d7-3f10076b6676", "comment": "Malware payload (Mirai)", "value": "c8a180c27f83680bfeaabf998139790e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896550, "uuid": "76cf1db8-a861-4b44-ac04-a89ef7ea4883", "comment": "Malware payload (Mirai)", "value": "63e45bad7b1259deabf8cc82e9be8bcf592fb40e6bcdcd54cdf37380d182b990", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896550, "uuid": "bfe54212-107a-4eec-b545-5afa18f624c9", "comment": "Malware payload (Mirai)", "value": "2dcb84c2f1a1f3889c3f9251e5671f214e76970d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896550, "uuid": "8561ce82-c7db-4f91-bd96-f131758069b0", "comment": "Malware payload (Mirai)", "value": "f112dba0f9e0638ae834815d49ab10ba2b4ad817c8732cd2a3eb0658cc85d4018ae1064a2bf90a6e4188683074d98034", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896550, "uuid": "794822d2-c461-473b-8d73-e3cdbe37092f", "value": "T14203F751BC829A77C2E1137ABA6E5A8D336163E9C2CF7217DD214B20BAD511F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896550, "uuid": "7349e11e-e44a-4c91-a36e-682750946a79", "value": "768:MglA4CbIsG5f0OhnlUl0O9FRA1wArb9/3W5uv+bdLdUZXoTp/NbwW:MyabXG5fDlUlXjwVe4v+wZaqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779896550, "uuid": "162bea6e-db8b-4f38-b2dc-ea93bde7a2d8", "value": 40744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779896550, "uuid": "062536bd-73ed-4f20-8bd7-db8dc91e7cf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896550, "uuid": "f89dbbf8-373c-409c-8b3b-784abfbd714f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d98369-5995-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779863199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863199, "uuid": "ac1b4bc9-f76c-482d-95c8-f0c15c71fd12", "comment": "Malware payload (Mirai)", "value": "83f2792f09abf31be68112d975790b91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863199, "uuid": "9bb4b666-b960-4bda-95d8-84b483fdcd08", "comment": "Malware payload (Mirai)", "value": "657eec4e9839e8c51aef38052524b826b07cadb057dc55ab8b900f74d1f0fbb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863199, "uuid": "aabbf32d-1e1a-49fb-ae40-a7ad70fa053c", "comment": "Malware payload (Mirai)", "value": "9b2d0b1fbc8711dcc4c810d26332fbda93f5204e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863199, "uuid": "3fbcf287-9629-4215-8139-4d896673cbda", "comment": "Malware payload (Mirai)", "value": "26712e523c55d9a79b8f1de7af2366388702e9a04e53fee30331620cf68865ef7aee76f6cb7751b116279c2a52157e0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863199, "uuid": "ec06e4d5-d79f-40de-93a1-e249bfb5033c", "value": "T1BDC33882BB43DEB3E55310F102B79B320B32FD3A5832DA85D769BDB198615D0A61637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863199, "uuid": "bdc6f8ca-a2f9-4c15-8bd2-1422310c3e51", "value": "1536:NYp0ogsylGAjz7f3LW7Irfd33jBuGE/9nm9TzXJk7gvP+T87b7n:NYpCsylbz7f74Irfd3TBCQ28vB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779863199, "uuid": "5b376a7d-836f-4b54-a2fe-27097e8b30d3", "value": 126472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779863199, "uuid": "5142997e-8278-4ba1-9b6b-c264af64ced4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863199, "uuid": "8f10d5b3-c2cf-49de-88df-b7c577d1c662", "value": "wife.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbaee45-59e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779896553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896553, "uuid": "b997b752-43fb-46d2-8e0b-6880eb6162fa", "comment": "Malware payload (Mirai)", "value": "47e5f8ebfebda8241873f8b47bedc883", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896553, "uuid": "aa5e3270-9b11-4180-8506-20255bb81e4d", "comment": "Malware payload (Mirai)", "value": "661171d2c765f3c0271235d3e270db9338238c85c07b3281f2612dd7a3a58bf1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896553, "uuid": "f0e888c2-65f3-4af0-9de8-f83a49db31ea", "comment": "Malware payload (Mirai)", "value": "11af2f747cc7cc8107cf34503d8367630d732c32", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896553, "uuid": "96e8966b-5f4a-4f83-8f38-a20135b23100", "comment": "Malware payload (Mirai)", "value": "25242dfab18ada03c6cd5c6a840396ad9ab9d0965552cfaaa1deb3713dce30bd06493988ba04f004f6090ad6bccc1ad1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896553, "uuid": "d0f25ac2-a3c8-4dcf-b364-84261eb33bd2", "value": "T13B438D36E96E1E74C08641B074748EB56F23B5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896553, "uuid": "f02251cd-a468-497e-bb67-bbb368ca5c53", "value": "1536:9aa0brW/Od9hlCRjKKnKQXACspfDCMx2+WZ:9v0brWGd9XlKKQqpfDQ+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779896553, "uuid": "39cebd85-ac17-4caa-a5d3-06a658de201b", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779896553, "uuid": "22ee0cf7-0c20-4e73-8147-e3f55966627e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896553, "uuid": "803c659c-8e14-4c3f-88b2-a8e197d63b60", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5b3afa-59b2-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779876071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876071, "uuid": "29cef4d0-506e-4b60-a439-793c3befb377", "comment": "Malware payload (ValleyRAT)", "value": "c2f2d95617253d4f71835f5f14e456bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sb[sd]", "colour": "#989195", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876071, "uuid": "92dd5c3a-8d45-4769-8827-123e3f64ec53", "comment": "Malware payload (ValleyRAT)", "value": "6688f78afe17fcf4276c0abfa67456d9b312d32c4a30c6d0374a41c94f803202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sb[sd]", "colour": "#989195", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876071, "uuid": "f25aedd1-dde4-4dd6-89e3-61d6afc5713b", "comment": "Malware payload (ValleyRAT)", "value": "26c644dcd8856a9a2bacfcb612069d02bb26d218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sb[sd]", "colour": "#989195", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876071, "uuid": "ac2fb022-f052-4d49-9fba-0914cbe23f51", "comment": "Malware payload (ValleyRAT)", "value": "13b46a691b779982bfd8af4efd0ba9547c6390a2bb8de6b38d898947e7c705a87111239dc5f20022c9641c757235694e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sb[sd]", "colour": "#989195", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876071, "uuid": "c23f0749-507b-4f06-93ac-3824d378cf1f", "value": "T1DEB4BE45F79347EBE029CA3A12498271AAF9FC003F32057753417136FC3AA6CDD696A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876071, "uuid": "db7af157-5f3a-4469-a05a-8ed0063a36b2", "value": "2656c7d8fc37bf0683ba516d399a3c61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876071, "uuid": "bcbae294-0ebf-43ef-a92e-cf421398cc1b", "value": "6144:A5C1Lb8hI1iAOhASBxiPXYENjoMCkF2MXjLAQSZDW/j+yL/W3hURbjhy3YAfqvQj:cCqhInSAgxDE9oMCQFQZycRShM5fqxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779876071, "uuid": "f58cc03c-3d7d-4cd4-9489-5531ed5c5b85", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779876071, "uuid": "1c208c48-70c6-4bad-ad7f-81cb996fcab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876071, "uuid": "89583895-87b7-44e2-bfe3-d70d1c2cf106", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d645cc-59bc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779880251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880251, "uuid": "bb8f33bb-338d-443a-8080-acabdb7cbe1b", "comment": "Malware payload (ConnectWise)", "value": "6fae9bd56536d2cda3e43a24d5317c26", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880251, "uuid": "795539a4-5ee2-4504-bfa3-6358bc1ab059", "comment": "Malware payload (ConnectWise)", "value": "677eb1951827150984929507a48b8e210f2f2c852b3d4c57bbae4e08315b8931", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880251, "uuid": "a313e914-0c3d-4c33-9b0d-053c6c6149d2", "comment": "Malware payload (ConnectWise)", "value": "e23b999f008d51d074b6bc3aba525a1c8fd8ff03", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880251, "uuid": "d817d933-2029-4c12-b198-5138eced26fb", "comment": "Malware payload (ConnectWise)", "value": "42415e2ba268e9ec04c11585d63bcbd3c0accc3835267dfd6eb1d8cc747f9b886d6c3af974daa25ae7592e1c000f9997", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880251, "uuid": "85a2cd9a-d248-498c-b8d5-8ec8c9e632d6", "value": "T184715E1EA41361B9CE1060BF104FCA173A73CEDA8D685D637055982C9CB35329E454CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880251, "uuid": "637c71a0-6b6d-46ed-94c3-40a7d6faed1f", "value": "96:fDYTSQM+8SSjgungACD8vNWcYInszw5dfUls1F:fsSQMZjgugA7CInszMys1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880251, "uuid": "a0d49f96-98ba-49b6-8acf-390aea31bec4", "value": 3539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880251, "uuid": "4f3b8b3d-cb55-47c2-9aa4-2d61244c3be7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880251, "uuid": "b39f86f2-7e48-403b-8c29-92258813bc7e", "value": "zoomupdatepkg.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c06f7f-5982-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779855353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855353, "uuid": "f52ad5b2-8388-43f1-ac37-4198b277e6d5", "comment": "Malware payload (Prometei)", "value": "a34672e9ffc53cc204b9a17d9a826875", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855353, "uuid": "45e89ea4-2fc9-4f45-b602-af075c641775", "comment": "Malware payload (Prometei)", "value": "6821e6f5962502319adb6ec0e14713909182479fcc23a5ed630ab839ed329413", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855353, "uuid": "5ec60714-cdc4-449e-a671-fd8b3415dac8", "comment": "Malware payload (Prometei)", "value": "56747592f29623ff0be95c45634c391910d1b318", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855353, "uuid": "dad5a181-f921-4c24-bc35-27f8f664b6f8", "comment": "Malware payload (Prometei)", "value": "45223d0359f65c21b81ed063cb04403d630e6c7b2e831222504dab62ee455106c96c8a880c2384a4183a74f786587574", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855353, "uuid": "95047ae9-838c-4f49-9045-2f6b50ff2a78", "value": "T1588533257413BAF4FB45BE5AD3AA76D6184090B38C5E28103D41DBB66E7E8FF4739102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855353, "uuid": "4854490a-5b80-4510-96f8-8a2b97fcdaa2", "value": "49152:zRAq9Zj8SmdMD3iQ8fxdKB54G0bOnplx3R84CT:zqaLWA3yfxXPbYTFRZCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779855353, "uuid": "bfdde4db-d59a-44b8-b616-ec3ab4ac76fd", "value": 1773392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779855353, "uuid": "fac6e7de-5225-4f1f-9a9a-d0a4bba90e15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855353, "uuid": "c0b76a4c-c24a-4db2-a313-6ebc7acffb3c", "value": "6821e6f5962502319adb6ec0e14713909182479fcc23a5ed630ab839ed329413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc7f443-5999-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779865173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865173, "uuid": "d7ca4a6f-0e5e-4b86-a141-1aa48597ca52", "comment": "Malware payload (Mirai)", "value": "c48c0295bb67a683efcb027931368ca5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865173, "uuid": "17645d58-88c8-4adc-b6c1-83d33c0403c3", "comment": "Malware payload (Mirai)", "value": "68ad31ff542dbff7145554463983a69eebc6247a9c560442eac5d82adcc8609b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865173, "uuid": "75d5c13e-f21d-435b-b776-625edae0cc46", "comment": "Malware payload (Mirai)", "value": "2f2bf96c6b4bf29ae9964fff52b6917d52bcf1f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865173, "uuid": "d289f551-8849-4cb5-90e4-a88c882938b1", "comment": "Malware payload (Mirai)", "value": "ecb36ee1b6d977cb20fdfcea47dc65ab417ebf6f0d595923878b57f51a217b6afce8da54f8aa7e5681e30a8ec01e1c25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779865173, "uuid": "ae5db5b7-64d9-42e5-857b-343814fe5cbd", "value": "T1B77486179D258965F1648CF223773241A84783BB88E622D3EA6E4DA1BF3091F517FEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779865173, "uuid": "0c60edd5-8e30-4b0d-a1ae-06cafd844fe2", "value": "3072:J9Rs/N/h+sFx1c/C+84wiXhb+A9GDWUO+joCIZgwT:tOhuh84wiXZnANrjoXHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779865173, "uuid": "6f0565fe-06cd-4822-94e6-0069f9638167", "value": 346800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779865173, "uuid": "6ebb05ad-34cf-4332-9b42-1e9b2b25bb68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779865173, "uuid": "5af3ff98-8a62-460d-b872-768ff1f4faf2", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63d804c-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779879012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879012, "uuid": "cb4340ae-3e24-4b83-8379-83434638f7a3", "comment": "Malware payload (LummaStealer)", "value": "05f2e765083fac1f95dd539b8227cd09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879012, "uuid": "1e8d652f-08fb-4567-9e80-c10161cf0008", "comment": "Malware payload (LummaStealer)", "value": "68b195ee5b76a81d3c7630efcd617a7c8b7e4456eedf67d3f46cb118694df2fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879012, "uuid": "72a79da3-c142-4101-82fd-296d29a6330a", "comment": "Malware payload (LummaStealer)", "value": "b242dda91222c8f4f1a79be233c64ccd52e353d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879012, "uuid": "111c4155-d298-452c-8bed-f77865dcb0f4", "comment": "Malware payload (LummaStealer)", "value": "065aa35c3d35b3969238eef0e4075e8a57779b86bea533a6de736a7284d183246606dd334d4513c5997400dab24e0318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879012, "uuid": "9fc67216-cdbd-4bb3-a59c-454d0732f4cd", "value": "T114D48CCE21D842E1F8E9787614337F3A867DFCDA16E066CB13A37426713CD81192A769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879012, "uuid": "bf35779c-33b8-4917-9c02-56fa1ed9227b", "value": "12288:tC5/GhG+RAwCztHF5k0BuvcdeyTK4W/WhXIx6NAQAHLOydz3oI49hB6swURdId2:85/GhG+RAwCzzIvcdXV7NAQAHlNoz9DL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879012, "uuid": "02db1065-fdbc-4ab3-92ac-3cf16469c482", "value": 621072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879012, "uuid": "b1ef54fb-842c-4ed2-8978-1a33cce73daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879012, "uuid": "bf885825-c1ee-40f4-b295-f2c81ca5fbbd", "value": "68b195ee5b76a81d3c7630efcd617a7c8b7e4456eedf67d3f46cb118694df2fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b7962b-59d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779890923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779890923, "uuid": "09e8a368-fb6c-47a5-a027-2e61d61b7e7c", "comment": "Malware payload (Prometei)", "value": "0b164e70cfe5c8294a0ec3007decddd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779890923, "uuid": "f08c4c2e-fe51-497a-89b8-fc38961ed674", "comment": "Malware payload (Prometei)", "value": "6909e1284e37c8f4b75e9bd7cdaca935adf5469c75c37c4a21fc68713bbe0ffc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779890923, "uuid": "072a3710-b52c-48dc-a825-00b75e426ce2", "comment": "Malware payload (Prometei)", "value": "97205506fc7e61b56576aa62e0d3e62e66f7c472", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779890923, "uuid": "4bbb7254-1c09-4bd2-8e70-208f897368d2", "comment": "Malware payload (Prometei)", "value": "f36e31570cd4c52315870b5823e71932d617e9827769a116b549bbaee25aa405004c3a6cecc62760f004671bfb77b2c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779890923, "uuid": "f2f9fe26-0057-422d-8efa-7c199336ae61", "value": "T12237DF77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779890923, "uuid": "72f26889-58f5-4f15-9137-91b31422b586", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQD:cqYUQuVDt0TZEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779890923, "uuid": "7dbefbce-ab21-4a5a-8ed4-4b3a30a2a68d", "value": 24510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779890923, "uuid": "f6300772-8259-40bb-9590-d0d6d25d6234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779890923, "uuid": "c60b6b66-d43f-49e1-84fb-bbfb0ecdd692", "value": "6909e1284e37c8f4b75e9bd7cdaca935adf5469c75c37c4a21fc68713bbe0ffc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38e12f9-5a0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779914575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914575, "uuid": "70dd3037-9ef3-4afc-aedd-5ed9ddb75d61", "comment": "Malware payload", "value": "210f57e3b1c88447ddc11467f7b2fbb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914575, "uuid": "920502bd-204b-42ef-b0de-980e27aaee1a", "comment": "Malware payload", "value": "6922b319dc96d020738bcf466c4d6d9233e4767b68592e1fd9258a232f166ce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914575, "uuid": "c17b56ff-04a1-44df-8176-341970fa030a", "comment": "Malware payload", "value": "72e488857a6c6c659c0c673f0e4c32a610ea41ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914575, "uuid": "9d753240-b264-4185-b77e-6ec895a314bf", "comment": "Malware payload", "value": "59c1e7b61d5167aa3465beaae29425f4fd5086b2e59b7a5e28942d66bc32d579a761dc8877e4f6dc624e0e690cf8e925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914575, "uuid": "3ed5800e-d669-4497-a43c-f763861b3bb3", "value": "T16365121767A400B9D1A7D275CD435D0FEAB2BC164BA4F68F1BA45EA20F237705A3E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914575, "uuid": "26391682-4ad5-4146-885f-40cd632f045f", "value": "87400cf138de3db604008e702f107c91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914575, "uuid": "d012d173-64f7-4c92-8e7a-cc79b6a0ef99", "value": "24576:ZKgkqG+F4Oq02+5ugus16qUkxS/G2bV2AOtoVxjit4uCRK:Y99O2+IgXzmG2bV2AOtoV5iuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779914575, "uuid": "905987e9-93ac-495f-bb50-c8a103bdbf70", "value": 1462272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779914575, "uuid": "197298b2-247b-4841-9fb7-042014bd86cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914575, "uuid": "4445c29f-870f-4777-8e30-7b3cf4f38639", "value": "SecuriteInfo.com.Variant.Mikey.188786.91137757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e132715-59bf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779881253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881253, "uuid": "0d167a93-fb68-4edc-8578-b22f5b2e87df", "comment": "Malware payload", "value": "d6adf967e588d13980fe8378b701993b", "object_relation": "md5", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881253, "uuid": "15bcf3eb-d67f-449b-864a-e69eba193a0e", "comment": "Malware payload", "value": "69c82d2ab46d743871dccca6c21a0447d16ce881b1733b7e86df00468d5dbbc6", "object_relation": "sha256", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881253, "uuid": "1b0320a3-7ce5-4a5f-80f7-f86f3c97fe42", "comment": "Malware payload", "value": "457f597e759cb55d9017be460b75929e058a0958", "object_relation": "sha1", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881253, "uuid": "3ad70698-d973-4a47-afb3-48fc8ce033cc", "comment": "Malware payload", "value": "02b37fb6df8242c09347b73722a2dfb3e656d9e56ae57f974bfbebae81134b3637ff46daf50cbcbb68ec93dc01ae0b96", "object_relation": "sha3-384", "Tag": [ { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881253, "uuid": "e9ddaacf-5773-4741-aeb8-8e71ae3896ba", "value": "T1AD4322428D383CED909F65A72DF310441192DE1A7FBB6473C12724B4193AAD87AE1EF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881253, "uuid": "1d19e462-0ecb-498d-b1f3-ea8641542b00", "value": "384:jOpD56/OMvhp4cFLra/HwIQbDIFP+SJtmjBe3Z8W0OLvZB0/HlBwTz1cfsdBBYGj:CpkJ51FLra+kJt6IJ8WboflCLJSpXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881253, "uuid": "a00adf8e-388a-44a6-a2a5-c25d48d03d4d", "value": 59102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881253, "uuid": "c73d5cb2-9743-4530-a2fd-365c21f4a6a7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881253, "uuid": "003a96f6-ffad-47b3-ba10-c75f978c5085", "value": "pwko.vba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871dc7dc-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911521, "uuid": "c8ce913c-b9de-4c29-a2b1-d8d39c245ed3", "comment": "Malware payload (Mirai)", "value": "fe47981458ee90bf53d4d71d6bedcd9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911521, "uuid": "4f23869d-d67e-490e-af62-2e98216c9973", "comment": "Malware payload (Mirai)", "value": "69cc01aac486a0afdb9a0b8f1b77b876a9d256f8d627c467f965f6e22199abfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911521, "uuid": "deec34c6-749b-4452-8f2c-48e5adf6de89", "comment": "Malware payload (Mirai)", "value": "26f65626ab0ee297b6e0a71424cf118196cd7702", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911521, "uuid": "8cd08ee3-d975-48c4-a51d-f641a2bc5164", "comment": "Malware payload (Mirai)", "value": "cecb346d4d1d9548256c8a5b08fed42e246908fac36025f7583c9757f6b5c1db555c59869a20626a3ceb1bebcec61788", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911521, "uuid": "e79845c1-5a6a-4b4a-8dea-d3b280bc43e9", "value": "T167C63B87B8924942C9E43A77F8BD80C433670EB99B8796565D04FD3C3BBE1DA1A39350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911521, "uuid": "fe5eeecc-8d36-4c77-8969-548c0ae66086", "value": "98304:5G6Cc0IFAu2YD9mde+dVHz+SGt1gNUt1SgFedEq:5bCI2YDkde+dVHz+SGASt1SgFdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911521, "uuid": "2a05e7de-d245-4fb6-9e32-09832edb2805", "value": 12255394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911521, "uuid": "89966eb0-837f-48de-a4ff-4f409d9e0d19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911521, "uuid": "9c952ce0-c048-4412-9ce7-0538183a1979", "value": "wife.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d57d1b0-5a06-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911800, "uuid": "0de16291-c258-4940-8091-c6fd7760089f", "comment": "Malware payload (Mirai)", "value": "26a8ad94deb21288146000ee86f53d65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911800, "uuid": "d97eeec9-b77b-4618-b277-cb18f6240517", "comment": "Malware payload (Mirai)", "value": "6a3b68c51b6e8ec9d13ea497c006e4f09f045d4548762357e5dfe4560a604a7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911800, "uuid": "d82c3cbc-7224-4fe1-8bd4-6ebe69358b05", "comment": "Malware payload (Mirai)", "value": "6ffb0a792abc602e15d9b9567b82a9454527b0a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911800, "uuid": "42167bba-38b9-46c0-a3af-4cf057458f2a", "comment": "Malware payload (Mirai)", "value": "53dfce16e3ddc9a03a0dd19ff0aa9ce4463157c7bdc8408113f7761e10755da5b92384f424361cf35228939683ff0bd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911800, "uuid": "7949470f-5ef9-40cf-9805-a03c21e56a6c", "value": "T12EF34902B30C0A47D2632DF02E3F2BE097EFDA9121E4F641651F9B8A9672D361585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911800, "uuid": "6479c29d-b450-4d23-b98a-496edbd56c89", "value": "1536:SW3bmyGKnCcQjYpySAxgDVT5vhiX+EFW+tk4lvAbRoeDG/t2ErQqh7M2IymQY2AU:tLm3Iy4y5xAVDiFWokPbdE66hh1X2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911800, "uuid": "6723100e-c25e-4f57-836e-c9ff09354602", "value": 158744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911800, "uuid": "6b0bb750-c02b-40d3-a132-5af6a70b3ae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911800, "uuid": "c7f0142a-f90e-45a0-9eec-62bf4cbfa595", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3b9f6e-5999-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1779864926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864926, "uuid": "fb2a27e0-5677-4f13-970d-427e30841fc7", "comment": "Malware payload (XWorm)", "value": "972ea3e44c1639dd672f012e6be92346", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864926, "uuid": "2d8f43c9-2ee7-46e6-83da-9d2a31f1f3cb", "comment": "Malware payload (XWorm)", "value": "6a4d41d28e552bb1b0342aa88aed258cb6824ee913d3a2da16b821fc3f0b34e1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864926, "uuid": "8f561716-322f-4360-8f2e-ecf9a93fbb86", "comment": "Malware payload (XWorm)", "value": "96ca9f001485db2843552f9efe9860563af76946", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864926, "uuid": "23d20112-8ea8-4aab-b3c0-91d32ae75167", "comment": "Malware payload (XWorm)", "value": "28e3716ecee19b9a674db3d838a7668b6a10093626723217ec54810ff997597defb9b5458aa4054adabe19a0f6b2a520", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864926, "uuid": "669bdbcc-0a95-4d6a-ab95-dfd176066a30", "value": "T13BD5A0D9F4D0B4CDE88B2A1ECEE6EF3A0275C624E834C992BB66E69554418C5D3CF44C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864926, "uuid": "eec0dc3c-6eee-400d-8cac-5c21446f6597", "value": "96:Jmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmml:cSuRfZFMYD3q6x4qNq88LXkHqm/yYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779864926, "uuid": "01058038-7d41-464b-be6a-9ed366ba8a3c", "value": 2893955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779864926, "uuid": "a7bf1461-dbd0-447a-a9ac-905e8b8085d2", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864926, "uuid": "fbdd10dc-a866-46e1-8115-e3f3c627b155", "value": "HSBC - Payment Advice_Ref[A2kBUN7v7eYE]_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add3ce51-59ae-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779874220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874220, "uuid": "bb9e85f8-33f8-4e3a-9247-ce18147c3be3", "comment": "Malware payload (Mirai)", "value": "889f5e8182d6708affe8327ab411cec1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874220, "uuid": "9c833459-6e60-4514-bf15-d74de9b863f0", "comment": "Malware payload (Mirai)", "value": "6ab2f89ea340ad724cde6dd0ac1043790aef84b000a9a18e5bbb8853e832f9c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874220, "uuid": "0fba8d7d-6c46-4094-b0fb-3890295e6ab2", "comment": "Malware payload (Mirai)", "value": "7a36eb2063cad688ff06dd8c29263032d9078f8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874220, "uuid": "d41a01dc-87e5-46cd-966d-b84360769d10", "comment": "Malware payload (Mirai)", "value": "86dae6792bcbecf37370b352201da497d134ebbf625df5c70c8a252dfb0fc153803831828d62cbe0d1a914133615bd77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874220, "uuid": "d01db029-9076-4b63-8d87-20b1ba4697a5", "value": "T13444E707BB918EF7C89BCD3306FA871120CEF457216467273778DA5CBA0A54F49A39A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874220, "uuid": "e7be0543-9cc9-4fc7-bae6-ec747dc5ada9", "value": "6144:xz7YpOn3N9ooNYU1M37MTbT+Zy7K9mtwAL4mObI:xzOqlSK9TbT+Zy7K9mtwAL4mObI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779874220, "uuid": "d3d84b47-4b0a-4bf1-bc43-3cc471e9b97b", "value": 253794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779874220, "uuid": "2aa3bfe6-b5e0-44eb-b376-f30041f122f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874220, "uuid": "e66e5234-ace2-49ac-8daa-a86915affb58", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c207d731-59ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779873824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873824, "uuid": "454ae1a8-cac0-4641-99ca-10a03aa99566", "comment": "Malware payload (Mirai)", "value": "7cc970a811a3e8b3198895b1fe2eac16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873824, "uuid": "b2be8fc4-4e8c-4bb9-b6ad-820a042c8456", "comment": "Malware payload (Mirai)", "value": "6ac23208b94baa0b55a522188329926ec2f5a19378bed70de4229053ea2dbbee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873824, "uuid": "14e19519-c4dd-4552-b9c1-47f32d38b3af", "comment": "Malware payload (Mirai)", "value": "cf25fe5faba857bdd37e30fffe68d30ff56ad82e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873824, "uuid": "317ba6a5-5aee-4da0-ab7c-6e30912616ec", "comment": "Malware payload (Mirai)", "value": "956deaf112b2b8cee9d3f4cfe6c665926083aa0e67bd9ed4ad702747ee302fe616b980569b9a70103250deebcd38807e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873824, "uuid": "ede0da02-1cc4-45de-863a-09c82cad67ce", "value": "T18944C7193A21DFBFF56C86304BB38A2057D935D62AE19746F25CD71C1F2028E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873824, "uuid": "9ddd05a5-8723-403c-b323-be0fc00c8f61", "value": "6144:rS6ZK9nYy61TJy1Y6Tsg6bT+Zy7K9mtwAL4mObI:5ZK9n5BYuszbT+Zy7K9mtwAL4mObI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873824, "uuid": "e7616b83-c021-4d9c-b73b-d3e34d5b2a24", "value": 253587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873824, "uuid": "fda7fe7d-1e0a-4b12-b1a9-720f903474fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873824, "uuid": "81d96abb-d898-49b1-8c10-aced7bb5c461", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca63f355-59cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779887152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887152, "uuid": "6543ee45-162e-4b44-9c8d-7ac16892b778", "comment": "Malware payload (Mirai)", "value": "456e7cdc60d419baaf410068b183087c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887152, "uuid": "2b1a3fdc-7e3a-46e3-beb8-c758dd5e9b26", "comment": "Malware payload (Mirai)", "value": "6b68553d4a59465ba60004c68445182cd4053286429fade3ce9d84db22dc8373", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887152, "uuid": "36da3ea2-4d65-4eb9-84a2-2a9648522642", "comment": "Malware payload (Mirai)", "value": "0bceed79a8cde43ad84dafaed0b9760ee568278b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887152, "uuid": "a4e7b3e3-d44d-488d-ba10-2dea0a50fea0", "comment": "Malware payload (Mirai)", "value": "df93e25de7bee9e1bc9a1320f4481018d3042f2bd8d6a21d5ef4bc98c8691f5ad7211e264c6afd1d2c28091c7d432338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887152, "uuid": "459c871c-d084-49de-9c33-fbee36b02609", "value": "T1ECC31649FD41AB01D5D635FEFA4E028973530BBCE3FE7102AA245B2523CAA6B0F76505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887152, "uuid": "7e0d6add-4756-4be2-a7ee-ddc116c93b59", "value": "3072:jjWCXzsUykFXhf1aflNAz72qSSPlO2n82lHWvuX:nIUyIRf1afLAz72qSODnHlHWvuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779887152, "uuid": "9145b77c-f6f6-458d-9c62-eee67000a1b5", "value": 125580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779887152, "uuid": "43856cf6-09c2-4da0-9d0e-9e3f060cebf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887152, "uuid": "b280fe2e-80f2-40aa-b5fd-6a1fa7b78b7f", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4873b6e-59e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779898712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "05b356e1-116b-42bd-8359-5fa8d868ab0f", "comment": "Malware payload (Mirai)", "value": "b38d0844275dfd3215bafcc747487fc7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "eae003a3-d589-461a-ab33-0c638814451f", "comment": "Malware payload (Mirai)", "value": "6ba982824479a491dff3614d03b22ea5c87ce363d5c002144b23c5ef19099905", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "ea87abbd-8246-46f0-9d22-d723db010782", "comment": "Malware payload (Mirai)", "value": "39bd90db415dee3e921cc74c3b1a2abc28603d81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "50a7b155-177e-4de3-819e-207aaa198e89", "comment": "Malware payload (Mirai)", "value": "edc1420efa7ab0d0fe4fe271102d5b73181f441a3e19499b9db3d7d9d7f5200ed8feec63ff9129f258715704ff23d8ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898712, "uuid": "f28de3e3-c913-4eed-9eae-96296064cde3", "value": "T147D3280AED419F11D4E635FAFA9F41493353AFB8D3FA7101D9209F6023C6A9B0B36615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898712, "uuid": "7165c4fb-44d0-4e0a-8416-3eeffef2a3a7", "value": "3072:t7a1DC2jybbaX5wE5y2OaGiqxORPO5+ebgsAEI2nUMQ81X:t7a1DC0wba2E5vOaGLxORPO5+essXnU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779898712, "uuid": "dfb25837-6657-4d23-a8c4-4620f3a083c2", "value": 135480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779898712, "uuid": "4ccb7cbb-bda4-4074-bd23-c6a1b5e2bfac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898712, "uuid": "c069fd70-a4d1-45b9-ab81-4ea3e89138c7", "value": "nova.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f33f06-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911539, "uuid": "addf61cc-88a8-4f8c-b449-dd2f008feedf", "comment": "Malware payload (Mirai)", "value": "48ae74eb57f187056c4a251c5e8148b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911539, "uuid": "c9e5f563-8d70-4bef-b99d-9b61decd0514", "comment": "Malware payload (Mirai)", "value": "6cf4a29c028c70523329f20545df795652c92581433405aa9166dc4483dc68e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911539, "uuid": "aa454e37-6fcf-47ac-8e5f-72102def6f44", "comment": "Malware payload (Mirai)", "value": "e1a6f0883d3ee30ac393e3263905fd032daf989b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911539, "uuid": "cf6a01bb-b61f-48ee-9da5-66b681ae3973", "comment": "Malware payload (Mirai)", "value": "ed46bdb1f639b811680faa0f80abb5b8e0c3b15d4a33cfeaf96affcbd9d71f270217d0bb1fb9d8f12fe2568468fe3451", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911539, "uuid": "44741043-f14f-4308-81f3-94a6705affa3", "value": "T12FE63807EC5605DCE5BD853589B682727B713C491B3163E31BA4B628AF72BD06BB93C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911539, "uuid": "bde4233d-b3fb-4e3e-af33-163e9185e50b", "value": "98304:iTjDTTKLYutQeKGyfEc2XApL5++91nz+SGvTgd02AwIDE6:irfKIjr5++91nz+SGvJQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911539, "uuid": "1abde41c-134a-4173-b7a7-38014be4e6b1", "value": 14250286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911539, "uuid": "849f5ecb-f2a0-4f14-ab91-b1368305dc3b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911539, "uuid": "5a75bcb0-332d-4c14-b93c-1f88c54b14ee", "value": "wife-bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1800ea98-59bb-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779879552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879552, "uuid": "020f67d4-2e27-4bec-99c4-842129aac094", "comment": "Malware payload (LummaStealer)", "value": "a3937d0b126b94423037d8f7140de94b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879552, "uuid": "4d34c15a-421a-4088-8a72-ef8f15082038", "comment": "Malware payload (LummaStealer)", "value": "6d1ea81e766778fbdb40905223c4d77dd4204b311420187f6bae51030d197d10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879552, "uuid": "95c1808f-6fcc-4cca-a4a6-601ccc2a6782", "comment": "Malware payload (LummaStealer)", "value": "dbcb4e20b9720b92aee26f0e955ea35915ded031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879552, "uuid": "f83cecd5-a36e-46b5-8932-7a54bb45585b", "comment": "Malware payload (LummaStealer)", "value": "30fedd9eec2871fc09b940bc4630a1e9882e4000bedb1b790a3d1fbd350017f04a907a46bc8e15e72a0558844b6638a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879552, "uuid": "b1d1f995-c58e-4650-a807-d5aa96f20b87", "value": "T155847C8AE7A758B5D94B0838229FB33F9F3417194728CECBCAE0DB4079376E25535606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879552, "uuid": "fa589002-a684-4e7b-a70c-9f96714c666a", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879552, "uuid": "8d34afae-cb8a-4900-9649-9337495b8183", "value": "6144:VfVhOeLXTkgw1XNDdeqMkDQ4HZ/r0j3qjBDrVSEOP3qdUngqSg:Z6eLXQ3cqTDNHZ/r0OtDrIPAUgq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879552, "uuid": "2d5ec4ad-b43b-40e8-b745-7ed9ad79e7cb", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879552, "uuid": "340cdf95-7112-4714-983f-177ab3e78e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879552, "uuid": "45172ded-4245-43f4-a020-c92a9aaf6707", "value": "6d1ea81e766778fbdb40905223c4d77dd4204b311420187f6bae51030d197d10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6170293-59e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779898742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898742, "uuid": "b59b7a43-ec60-44ab-9e62-f299613114e1", "comment": "Malware payload (Mirai)", "value": "fc979e8defcdb36438c5147f171206af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898742, "uuid": "f2e457c1-f74c-4323-8856-21f56543004a", "comment": "Malware payload (Mirai)", "value": "6dbd998f9898ebe2063d0c01d10e0f2e8cf5e4f5ec691574e69e42cb86580efe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898742, "uuid": "5f47e008-ae96-4aa8-bf4f-ac080656bcfc", "comment": "Malware payload (Mirai)", "value": "312578d0066047ac3f77fa9c54580705c6680a2f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898742, "uuid": "9747556d-3f38-46f4-950b-d62f69ae52cc", "comment": "Malware payload (Mirai)", "value": "29baf0a902024ffb48b13bcced8546ae09d111b67c2f0f2decbdffe5e82dabc1b583a05ce0e1395bf6cebe22715cf3a2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898742, "uuid": "d3f4c486-2c17-4565-92c6-99018ec7e503", "value": "T149D33A63DE266F1AC116E4F0A2B28F755B53BC2948570EF9A532EAE58083DCCF5053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898742, "uuid": "d3e98d13-fe31-45e7-ba9d-f3cbd732fce6", "value": "1536:gAYSOV/60ZR2AZFstCOalHvrVaCiKUPOv9GgKts/GaWrazz+yJv32pqv:gA1e2SuCOalDVaEUPgKAGaW2zJv324", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779898742, "uuid": "543fec63-16fd-466e-b23c-fcdb15ea8b05", "value": 142476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779898742, "uuid": "1a79698d-c81c-43fb-925b-b8494e6f589d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898742, "uuid": "28adac06-63ad-40cb-81b7-9f8d80da52be", "value": "nova.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecafbef0-59b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779877761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877761, "uuid": "5ca2b747-e993-46a9-9747-9c1a59c4f7a8", "comment": "Malware payload (Mirai)", "value": "6c5733df41f08610db7b020171c4d54c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877761, "uuid": "59b84f07-0361-40b2-be46-48373de331cf", "comment": "Malware payload (Mirai)", "value": "6e1b340a07603d554286495b2a8b54181fc3eee555dc700e01e9b7ccc80c064a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877761, "uuid": "3da36c19-5eb0-43d3-ad6b-32653ccdbc68", "comment": "Malware payload (Mirai)", "value": "eb8212a8059397f63eb6aecac305a421ff80d6ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877761, "uuid": "38144158-a909-4b4d-bd9a-b8429b97d58b", "comment": "Malware payload (Mirai)", "value": "0c4d59439a65415f593f6f294465829091daff5606c38a222de4863d986474bb4e134bacf3980674b40a367730bf5166", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877761, "uuid": "096af9fd-f170-48a9-8489-d879a259485a", "value": "T1CCD3F8C7F900D9FAFC0AE7374853080AB230BBA545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877761, "uuid": "b6f7802d-70c8-48d9-a547-d0e572950c83", "value": "3072:MNbul4MGHJLqHy5Fut5K/cwpifdDounVoQV1jbiGLD3rQKJ:1Hy5ct8/cyiWuVosLDzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779877761, "uuid": "b24a4f98-f293-4814-89cb-e82913b4c593", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779877761, "uuid": "cc06463d-7134-4697-9d91-c1195ea083ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877761, "uuid": "abb92df1-f7ce-4ebb-9107-e4be19ac6803", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac46709f-59e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779896551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896551, "uuid": "d8ebdb44-0e61-4925-85ec-64a62900ffd1", "comment": "Malware payload (Mirai)", "value": "3479af11ba05f751702776edb3235fb2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896551, "uuid": "6d11f50c-fb22-4520-9dce-a444eb85de85", "comment": "Malware payload (Mirai)", "value": "6e232c7b50c0a45db0622e501a117377a7769ae9a6f4f3260fd82bfcbf3fb239", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896551, "uuid": "18320f2d-1f98-496d-8b3e-bf83e8a53c80", "comment": "Malware payload (Mirai)", "value": "158a73d22fedbccc108a354e6c5eb208e9841f72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896551, "uuid": "b4f2995b-859d-494e-810f-85be4a9255af", "comment": "Malware payload (Mirai)", "value": "788c794db120718d6633e821cf5601ce0f4c33f7b9b02b6d2ef06614b3f268c3b786c1e07db8a82acdcf0218c8d47d2c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896551, "uuid": "49574749-5cb8-49e4-bdf9-a9ddb95b6ef5", "value": "T1EC730856B8814B12C5D512BAFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896551, "uuid": "a939968d-8e13-481f-9472-7dd94023975e", "value": "1536:2lnHaxP6XkC/zTkS7IDHtfMwo862ta0J0GIgi/z3KvcIc+5UYIWIj:nxiX1Lgbtfbxtabz3KvcIc+uRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779896551, "uuid": "315e3ed3-eb4c-411d-b3e5-32804e9dd1d5", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779896551, "uuid": "5e4759a6-43d3-4b1d-b461-e3b43adfc6ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896551, "uuid": "c8286afa-9575-4224-8b7a-cdca93f4cd87", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9a1032-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911661, "uuid": "c9f748e5-c13d-45cb-b103-5f4afddf25f9", "comment": "Malware payload (Mirai)", "value": "f64b61675601f8a0c992a5cbc8ba20a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911661, "uuid": "929c5f04-fd98-4424-afce-fcda9d5a043e", "comment": "Malware payload (Mirai)", "value": "6e7c6787a3ef9e5b7b0111c576f07c090c1ae61d145a4631bd2eff42851bdedd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911661, "uuid": "4869d3b6-5d8f-413e-bd0f-912826ef3556", "comment": "Malware payload (Mirai)", "value": "6befc10cd82b7407107ddaa07dcc742e6598b681", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911661, "uuid": "77eed188-5251-4dba-ad12-3da964dd6a0c", "comment": "Malware payload (Mirai)", "value": "436e4144ba1c940fd8964886a4732582ab6ead156f4e2f40a42edc6244b7aa9e640334e775c6d60351fe17800b0666e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911661, "uuid": "4fb26666-610a-4347-a67e-69019b147934", "value": "T1197302492499E110FF210B76C85918CC8841A9D5D0EDB1EF312A5E29D9CF8A32DBFD97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911661, "uuid": "1bc5cf97-5e79-4079-95ae-935a5f581e03", "value": "1536:w8IHq+kgs7VI83wgrzlEFSPO/hcoiisjuq5Z14US2FCLtBcGXUqh9+sadEO3dzzG:LIHq+kOQwgrBEEO/h7iF6q5v4USACL0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911661, "uuid": "60e08cc9-5002-4141-be3e-27ff4c8a2ae0", "value": 77208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911661, "uuid": "0207698b-9d89-4f06-a687-9ddbc8ab1579", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911661, "uuid": "ebdedbf8-8767-43cf-8a99-a596af83b483", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66beb656-59c5-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779883979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883979, "uuid": "ab498131-372b-40dc-b327-7142daf23434", "comment": "Malware payload (AgentTesla)", "value": "882617e91c7ca169be34b52684dcb4e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883979, "uuid": "d7726580-21a9-4c13-8c64-82e316571e6c", "comment": "Malware payload (AgentTesla)", "value": "6f6fff30ca8a1a44ee1df1d6dac93313b27aba094dff64f65b304d45f0af5849", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883979, "uuid": "5429982a-6352-4468-967e-ef528d24fd4e", "comment": "Malware payload (AgentTesla)", "value": "48fe4265386abf1fc72a0051f06dd001996a3ac8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883979, "uuid": "3c0ec9ff-84cc-4dbf-92ff-4049c6362b8e", "comment": "Malware payload (AgentTesla)", "value": "35cf4bd4a42e33ff76be29bbce88084c7ced807b618f5da29bdc6c04eeb65d83776c507a9f19edfb9b7ddd965c4f2f1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883979, "uuid": "ef3b751d-f17d-48a6-98dc-0c689cd01222", "value": "T1AE3501142219CD42D4AA4BB81A65E3B417B84E9DE826D3079FC1BFEBBC3A7705D04793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883979, "uuid": "f3ac6937-0941-4e85-acf3-5ad0b00061a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883979, "uuid": "465a618e-a5ec-4a6d-8cde-f225a5bfed16", "value": "24576:Js3qPyUi7oNFLFanYJmdQCZOtYX0IS9AEFT0D:wqyR7oNFLF8YiOtlIS93FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779883979, "uuid": "3f627160-7299-4651-ad64-af9bc40ae93f", "value": 1157120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779883979, "uuid": "2ae1f80c-4d18-4027-9faa-51492ab225ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883979, "uuid": "6f27007f-54e6-48e7-a1cd-57f34c04fce8", "value": "Order BC 12892- 12831 - 13426 PDF.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529f8462-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913580, "uuid": "4ad436a6-7ad1-43fd-a995-7b30513900e8", "comment": "Malware payload (Mirai)", "value": "93e63e9ff48333712b727dc0a2e2268b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913580, "uuid": "83c8a643-e777-4919-b443-266b08c45691", "comment": "Malware payload (Mirai)", "value": "6f7856c60ab476b31dad337faa3f1201bc0ff2180cb5d1bc4459c2feb872bdb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913580, "uuid": "f72c19af-1e96-43f5-857e-144e23f60286", "comment": "Malware payload (Mirai)", "value": "2e6e796c2581f44d7d7d26c76e870bf98e95cc39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913580, "uuid": "4992f906-48da-4e55-9c28-e67b74aae7be", "comment": "Malware payload (Mirai)", "value": "2449181997c155b2a872e04f2380acb6ce7114eeb2c482815b51eef2b064c2544ab71f8d7697b13e19dd772ed093f67f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913580, "uuid": "5753a79c-3508-4e72-bb4f-cd8c9aaf5815", "value": "T10A154B5AB2F770ACC593C030579BDBB2AD39B0B90112AD7B3181EA352952DE01F19F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913580, "uuid": "40572a28-a2bd-4574-b48d-8e3c97481f02", "value": "12288:AmXENlB84iIuQy9Kr02hx1YryAeTXPWydGb0QG5:h0Nj84iTQy9s02xYGAeDYob5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913580, "uuid": "7f1ed3bb-2b88-4dc9-9bcf-3c750cf2769c", "value": 911368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913580, "uuid": "f8b09652-0fca-4161-b218-b83e6f8d0b45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913580, "uuid": "bb2a436c-9d88-485e-b63f-8581df524052", "value": "loader", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b75c9a-59d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779891706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779891706, "uuid": "93362c5f-14bf-481c-b8cd-47c04e892201", "comment": "Malware payload", "value": "edb11e1f03009f16f48dc0bee9e23804", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779891706, "uuid": "d077de16-63dc-406f-8dd5-9d1869deaf67", "comment": "Malware payload", "value": "7129076f2b648b20cbd7b35eb8612ba4315be053ebcb5fa852b689f1ef72deed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779891706, "uuid": "374bcff6-ba3a-4c65-9628-63a2627e28e3", "comment": "Malware payload", "value": "b031465f49563164c09c23cac2ab0da91a933dde", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779891706, "uuid": "958442bd-da73-4178-97b7-e83977271193", "comment": "Malware payload", "value": "1c86b07046659d896a38aef8384ff16752eaad6e9de3ecd301854db902f6567620cb236156d46e236a40ba1d04f05880", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779891706, "uuid": "5e6c7958-9b23-4457-bdfc-4bd8d3cca6ba", "value": "T11605D5B157F6D50DB0B61F00AEB1B152543B7E726D3E866DD24D1AAD0BA3A08C871B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779891706, "uuid": "53a7b154-b8f9-4009-8674-9482c497a3f5", "value": "3072:wLiH82G9QFscH/kCG+C49hFQOY7p1soq2gaUEcbif60yg7kj3pCmSHCt7kGKQFfq:VzN2VCbyfHCCGKwfORDZfORjI4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779891706, "uuid": "0ea7c131-4cc2-4ccc-9327-4b5d95e6bebe", "value": 847084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779891706, "uuid": "4d80f2af-26a9-4a48-b1e4-3154e8ee4a41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779891706, "uuid": "926dd78f-8ce8-45b4-8cd7-94ea98fdff9c", "value": "revised Shipping document BL PL and comercial Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f40e10-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924701, "uuid": "7ca523ea-d651-4d2c-b062-7f3fa6b58f2b", "comment": "Malware payload (Mirai)", "value": "8124ac8f145dc3b7980f782c535edee7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924701, "uuid": "54b15136-833a-4c1b-beed-e20ba53bf031", "comment": "Malware payload (Mirai)", "value": "729b1de7faba10797f2dfa26af04aaa660c01eac030e081af6f816473dcec814", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924701, "uuid": "5c347caf-92a5-44cd-89a0-f750e13f4949", "comment": "Malware payload (Mirai)", "value": "b0881264c98b33f0cb87280487612169eeb70c2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924701, "uuid": "1fca4912-b1d2-4570-8c8a-5e8d8743cde8", "comment": "Malware payload (Mirai)", "value": "c62ef8d318b98c3b8fe632e493cfddc7691b1f0e956bef2680db1c06b4a782c9a7f05ecf701ed30c5d488961dbc2f3e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924701, "uuid": "813a7948-33b7-4ab5-b464-ae41941fcb17", "value": "T16C43E1C3A201D11380F09EB81F6C1BCB26C9C56A34D48654ADA0AF4F59A6F25A77D62E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924701, "uuid": "bca7d8d5-9884-4e37-84dc-ef8773a54651", "value": "1536:KsAep/2E4MGB/+z9eV+W81PUYXrQBirOVJ:KsAeT4MGB/Yqh81sdBiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924701, "uuid": "7c038c68-b21f-46ef-895a-cc8153ff7393", "value": 55824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924701, "uuid": "d1955b60-8ef4-4a78-80b1-a44af4b8f4f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924701, "uuid": "9d320c32-2599-417b-b0dc-3cca8cdcdef2", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda3a9c5-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913760, "uuid": "0f723226-a35a-4ae7-aa18-b72ad1c88b80", "comment": "Malware payload (Mirai)", "value": "e37324b257ee3fe03e6de7a131ccf393", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913760, "uuid": "af6efa40-1242-4e53-9792-8ab14029e80e", "comment": "Malware payload (Mirai)", "value": "73993ec0711e7001f73e0b1e85dda6aaf613b4cabc8d8a4e4b0a25d4133c6f7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913760, "uuid": "0e6b6a73-80ec-4200-b6f3-0b74729db02c", "comment": "Malware payload (Mirai)", "value": "41d414372b6868d1d0ff45264944e22497dd4a75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913760, "uuid": "9f71722b-56c8-4d23-bc6a-4d29491ea576", "comment": "Malware payload (Mirai)", "value": "4af0393798ba60d04020f7dde3acce61845ccc0fc64bdc07b48216cec348034e6e19d11df92b8f90ce6cc485d7d0afb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913760, "uuid": "ed571c32-1b55-463e-8544-5349d3435fe7", "value": "T121430781B881AA25C7C05377FA5F008D33159BDCE0EA33478C252F957A8AD1F0D6B79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913760, "uuid": "2e74a33b-0d4f-43d0-99e3-41eba3f3647c", "value": "768:1JYZi0oDmfSIc3ZvrQNrgTT3NVoMnPWf2MqV/bpdSW4xyP+oi7wCVy/rCxHghW17:oZSmSfZVoM79dSzx69dhW9w5CAYo2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913760, "uuid": "2c03202e-fd30-4378-8afc-8f0962985a51", "value": 60140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913760, "uuid": "26ccc6de-55d5-4579-bf57-8d6c68b9684e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913760, "uuid": "57b6569e-6253-4174-a5c8-b61b58fe32f7", "value": "Akiru.arm5n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5040c866-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779878787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878787, "uuid": "82c17dfd-2af3-4be4-b69d-311b0631b0ce", "comment": "Malware payload (RemusStealer)", "value": "8e6fc309865b90cfea8a6ce32ea8be3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878787, "uuid": "8164d681-d6f1-4eb9-84e5-e7074a4e4c2d", "comment": "Malware payload (RemusStealer)", "value": "73ca6b57bbc1288754443ad72c4c0ad272f2a718d4f11348c3725a96054709e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878787, "uuid": "f6fd19c8-6b15-4d66-84d7-be663b9c4589", "comment": "Malware payload (RemusStealer)", "value": "a036f51e3d88db45fa7bde4434f3a6f31c7d5347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878787, "uuid": "41809347-8e9e-4e86-9374-46d7874b58cf", "comment": "Malware payload (RemusStealer)", "value": "a9486a9219d1097276796eb73b385f3b150d9252dbac85f3cc1d4706923a1b24d09e3951c36abf16f640e0e6d1b50c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878787, "uuid": "312a9c95-9235-4505-b1ae-0fb3c67a13ca", "value": "T12D24286BD25331FCC552C0789266B232B773BA3D4B319EFB0292C3359E619C05E79A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878787, "uuid": "8728a705-03a4-4faa-a816-1172f378a8cd", "value": "f7f06265082add6d6d0fec781c269c83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878787, "uuid": "20b7d5f0-ffb4-47f0-9cb7-4d5cc0aef079", "value": "3072:P/bwnOhr9O8U66TQLbnKpdzeDRxY5yfxypH4M1zGo:rwngf/bK8YYfqYM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878787, "uuid": "e284f83c-ebbf-4908-8b8b-6247dd664a31", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878787, "uuid": "d3738c04-bee6-4374-85ae-1a430f004f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878787, "uuid": "04766b56-5e51-4c37-a912-404a5b1e9902", "value": "73ca6b57bbc1288754443ad72c4c0ad272f2a718d4f11348c3725a96054709e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63050a7c-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878819, "uuid": "32f05987-b484-49d0-9ac1-28a65be0c5f7", "comment": "Malware payload (LummaStealer)", "value": "5823fa8496a8923da9dd070f41785a35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878819, "uuid": "af758c6e-0056-4177-896e-7e65cbabdf48", "comment": "Malware payload (LummaStealer)", "value": "73d60ab8ca5ab470417ee3c4867a2c209aeadda42725e3da0e916df069cdba55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878819, "uuid": "3450e745-68f1-49df-816d-4c5f67928553", "comment": "Malware payload (LummaStealer)", "value": "aa41a75f6f6c162aef22818532587d36598b0ab3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878819, "uuid": "8e9d5a8f-004e-4336-a98b-176244431529", "comment": "Malware payload (LummaStealer)", "value": "b83139fc55506458d7ea873001b6619eb8973d745583bc8c2864adec65442a617d56be9cec55354316f8e6a8916e91cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878819, "uuid": "13e86fe8-535e-46a7-93c9-9a1177f94357", "value": "T173748D46E7B748B1E54B0975229FB33F9B2416144328CDDBDFE0CB447A33AE26539A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878819, "uuid": "29cfdad3-ec4d-4c92-a135-40d9ceded122", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878819, "uuid": "4a17cd03-7199-4623-bf04-cc37c8d7c57b", "value": "6144:sRLI6zZvCw5/8m5RtUHD2zSnK90dK7KDhAoK4Yeh9bDvJFeRg1WX:0Tj50mhUCzSKGPlAoK4YehVvJFe9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878819, "uuid": "fb3e4ec2-e39e-40d4-bd5b-c0bb3e34cbf2", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878819, "uuid": "9d4782bd-078a-4bd4-9c96-082e22da08b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878819, "uuid": "e117d5ad-8ba9-456c-ac2c-4e8579a7a5d0", "value": "73d60ab8ca5ab470417ee3c4867a2c209aeadda42725e3da0e916df069cdba55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a64716-59f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779903437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779903437, "uuid": "893615e3-712d-4fcc-9f08-7b589b057c65", "comment": "Malware payload (Mirai)", "value": "be413a8916f8098cc583910cb33ad337", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779903437, "uuid": "5fc2c3e9-f75e-4508-a76d-d3d7712991f5", "comment": "Malware payload (Mirai)", "value": "73f4e904706425cca8d5578401819c74a988c2cc81eca1ec2bdb4b758668cc82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779903437, "uuid": "12ad1aea-565e-464e-9f3c-e733e34e6c0e", "comment": "Malware payload (Mirai)", "value": "a0eb209d7378acea6fccb458781843702bedd2b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779903437, "uuid": "519681ae-f22b-4c1f-b748-2e05cd082b19", "comment": "Malware payload (Mirai)", "value": "c2158ed29b19e015467ed8f2d165d9fc660885bcbe92a2ab256074d040d33f52e9617670272d4bca53b3ab2dc7f343e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779903437, "uuid": "a0cc6f9c-a8da-4789-8181-f00d67104782", "value": "T1A194D056F6072E82C5D7CA390487C680575AE6E723F3C3052B476976386A3B36F2D349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779903437, "uuid": "90cdc8ed-fe4e-413d-9e20-8b069cff4b5c", "value": "6144:VOHcH2/R2zzjtTSuqYQxGx2r6rod93snkMaCYnu1zroLgp8HcuO:w425WRRqYEGs66pSkMaCYu1gLgp8Hcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779903437, "uuid": "6d73dd2a-f66a-466b-aae5-271aa7b941be", "value": 425648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779903437, "uuid": "b03d63c8-9bd5-417d-8b3f-4972631d578e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779903437, "uuid": "e02ddbc9-c83e-4009-970f-2c071e8de844", "value": "SecuriteInfo.com.ELF.Mirai-DHX.87265456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e3888a-59be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779880941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880941, "uuid": "db221f0a-672d-4550-949b-8f2df58a5e99", "comment": "Malware payload", "value": "8b3e542f45eea900a712679abdbc0437", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880941, "uuid": "8600a101-acdb-406e-962c-453d53ed227a", "comment": "Malware payload", "value": "76151f4450fd09b16177b1d1b6ca7c62b0c763c7618f9098c10948863d463a51", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880941, "uuid": "0bffd278-866e-4ca0-a097-64eb967f6b22", "comment": "Malware payload", "value": "7eafc9521ad7f0b8e922ccfee90655d6bd65c3ac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880941, "uuid": "e8901977-8323-437a-897b-b3c2f83cf898", "comment": "Malware payload", "value": "fa224be32aeba9a5cc207ec51496f219a6dd4009ff7d17ecae2eefbf97a3d6544a3d699729803194d181107d6f9d0dc8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880941, "uuid": "7c0787fc-3c22-43d5-8bca-e4ceb55611d2", "value": "T184511EC922D155326EF5D93372B98548B9A0918738CA7D589CFD38F4C88CE47B8C5B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880941, "uuid": "c94e5765-e7b6-4ea6-be08-90cd764681f4", "value": "48:ipL/ppLpmbp7BHpgTgypg5gmpgagApNNPpOrpjG4p0fp2/p63pdtp6E:ilvcfHi0yiymi3Al0LCYUd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880941, "uuid": "a79cb07b-ee23-4e4b-900d-0b367e386c75", "value": 2578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880941, "uuid": "5486a3dc-44fb-4da9-a372-00fb8aed1f9e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880941, "uuid": "ffc8422a-d429-4bb4-a771-0399a2e42fb5", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b622fc-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880783, "uuid": "5ba4225d-1b55-4ea5-8bbc-b98353c65eed", "comment": "Malware payload (Mirai)", "value": "c2a9b929bd5a4f77e757cd2428ed71f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880783, "uuid": "cfd419fe-ed4b-4d94-a6b4-c6625b8cde4f", "comment": "Malware payload (Mirai)", "value": "763b8afd99c63394425873075ab9b0e3d6d3f33421f3f9f98e7ef1ddea217179", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880783, "uuid": "b6fb320d-b2fa-467c-99e2-365c36136063", "comment": "Malware payload (Mirai)", "value": "0c762186a13828911e9579481ad68e96f0ed0fb9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880783, "uuid": "b1296948-159f-42ad-98bc-5f5129348d22", "comment": "Malware payload (Mirai)", "value": "ed1357a29892b5ec85e0c9215e47383c61ad9f0613109755dfcaaf6385038a54522e30c89b0e5a21a775c11068238673", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880783, "uuid": "441316b3-7359-4f25-af14-cdf1cc5996e2", "value": "T121430265EF75F3E1C4F0ED3ED1B356464B02ABBDE0EA71A17E6460B421C6100A37E606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880783, "uuid": "7114d3d8-b6e0-492e-bd0a-4305c3c54614", "value": "1536:ACUjWRWdpSh3P3nq7Y8uegX8JkhoMJWfReZ7q3La:A1OWdaP3qRwMCd8fAZm3La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880783, "uuid": "157eae3b-dbb7-4740-b2ff-3da6b365bf52", "value": 59676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880783, "uuid": "0f97694c-3f78-41fa-827a-5980794d2578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880783, "uuid": "55123314-836b-4738-abf1-3e97d09b2a14", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e5ceaf-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913591, "uuid": "d4d10fa3-7f67-4779-92a2-1c68ed6f9534", "comment": "Malware payload (Mirai)", "value": "f8f01d8f2ef66de94c4f700fd84670a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913591, "uuid": "10fac7e1-b872-4f13-9786-a3fcda93a026", "comment": "Malware payload (Mirai)", "value": "7649fa641422a292db1a245106f9bca00180c05a6e959c4aa1301d44e51fb499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913591, "uuid": "35e57b48-2d86-4330-ad75-051e3ad4a3b6", "comment": "Malware payload (Mirai)", "value": "8d137662d666f02bc5b0dab155c3ad108865f93c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913591, "uuid": "4bc5e031-2d26-417b-8f8f-06f56282a5dc", "comment": "Malware payload (Mirai)", "value": "0609218da2d50e50dc2133f36622313aaadf09fe3eddece838ab5a1281093671f2738edf34062efcf390efff9ed7846d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913591, "uuid": "3b9dd3bf-8595-4cd4-8df0-42a132970e2f", "value": "T19021CE9AA7E35E2BCD940233DDAF5B10E322BE44869EF507E35216261C3F31A5F21149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913591, "uuid": "77936fef-0b5c-46be-b350-b3e0d17ce36a", "value": "24:JKR4llMRgP9qD0at6EoKG1YrUlFSy40VzLCkIddgHkRGIUAtddzNfW:JKqTFqDPtCYrkFSy4CzLTtIUAtjNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913591, "uuid": "701011c9-5215-4c85-88b4-ee482e7bb323", "value": 1168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913591, "uuid": "f234da4c-3b54-4f96-b5f7-41e9bbbafc89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913591, "uuid": "24293ba5-a3e5-4298-9149-dab7fa7cc4df", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7ab287-59c3-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779883099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883099, "uuid": "c0f4daa9-af3d-4e0d-8397-f5ff4ab80dc1", "comment": "Malware payload (AgentTesla)", "value": "c9214c23707183368b7dd2b61cc92977", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883099, "uuid": "c54186cd-69d2-4387-910d-326ec442003a", "comment": "Malware payload (AgentTesla)", "value": "76e089a21b93f2349ca1dacfd8d4fae4b57702f302103a83ca7c0d988991100e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883099, "uuid": "3642080e-8e1b-4abf-aa80-454fedc27cbc", "comment": "Malware payload (AgentTesla)", "value": "4f8d78cef9c23ae39d80bef26d18710efd5553d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883099, "uuid": "9040da3c-67b3-403a-8772-b8c6f0b7aeff", "comment": "Malware payload (AgentTesla)", "value": "7264b051f1008e4dfe94a26205738d00acd301025524c34cee009294592f60a7dc8882b284a858d9fe709044ce43ff53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883099, "uuid": "11173abe-8c71-4c51-bf0a-0a9d29fae93c", "value": "T16A066D448CA3B347C0E88BDCAE3D5BEC151EEA13EA70D9036315D9766756E83B136293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883099, "uuid": "39469c5d-5c03-4b08-8f56-c9f15ac06e1b", "value": "98304:B0CNxCEtcCxJBev9vXUCik4zwCyRrmtsLCiJ0xNcjovHnH8LpsycGG9z0/Djs:RIuyijiLCNWovHdycZ07A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779883099, "uuid": "542d0178-7753-4747-8bc9-090a275dbb0f", "value": 3812895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779883099, "uuid": "ba85c14b-b736-4093-b831-21c3773c64bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883099, "uuid": "fcfdd545-abad-4fc3-a611-daebd22c852b", "value": "Transfer Swift No. 202600113.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7ef341-5999-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779864980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864980, "uuid": "418a2f98-aab9-45dc-9c65-3fb408dd6c49", "comment": "Malware payload (AgentTesla)", "value": "b53e6afff13c3903ef5369faef70e4bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864980, "uuid": "da30efeb-a230-4656-9e3a-263840745d57", "comment": "Malware payload (AgentTesla)", "value": "77081fc9249fb2d3781de951dfccfc03b87f1ba3ac303e33c3de8504d31832f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864980, "uuid": "f3250ad5-254a-4a4e-81d7-70ae23a23343", "comment": "Malware payload (AgentTesla)", "value": "e2385bbc8552c2ad0633722b2b678548d33366a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864980, "uuid": "37a8d51a-03c0-439f-9bb2-3765ee7c7f79", "comment": "Malware payload (AgentTesla)", "value": "458c97c1779cb8898156b6e9052f8a89be9bf21f150ab73e4abaf5b1c024d86356468745a812587366f26cd7328b13fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864980, "uuid": "bd45dbfe-2a82-4a96-844f-0402ad2526e2", "value": "T103062950076690719739D70ED876EB389C0EA01350D5DF0C306AEA783A5BD1BE39BAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864980, "uuid": "3f765389-2696-4485-8ca5-0ef4a7267735", "value": "98304:LBWtYlrOVF9MQlCkjiN9he/n6VyMUL470A+ARp9YrY2+p6ALuTX8+XT74UQC:yKqLRF/BPL47t3RDgY2+pxSN7DQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779864980, "uuid": "2f8b7acd-b7e2-470b-b47a-7c03093f266f", "value": 3946738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779864980, "uuid": "9eed012d-7779-4c54-9b17-62c9a79bd228", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864980, "uuid": "6b3c32f3-a435-44aa-bdb2-f4dff9095a69", "value": "FACTURAS Y ALBARANES.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82161734-59be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779881018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881018, "uuid": "2fceaed4-b881-4343-b313-7c93367b51e7", "comment": "Malware payload", "value": "2d3b9bf92b3ce2135341f60cdad9cf75", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881018, "uuid": "cffa87db-e4a0-487f-a837-1ffd9975dc77", "comment": "Malware payload", "value": "774df9ce2af5739baac7b25014f5c7a3753f90f5f8ba5a885d37def9115cb23c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881018, "uuid": "213c2bd2-2278-4c84-8286-a80869c88390", "comment": "Malware payload", "value": "c3367eef2674978f02ade2cb6175d3c3d6401bcc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881018, "uuid": "5aa6e254-8513-403d-bfc1-ff512f759687", "comment": "Malware payload", "value": "e676991957921917cfafbc128c2109af5835a48b320243c92058107086a407c340f66ea18c6ba028078c98bf1628e16a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881018, "uuid": "6b092707-d421-4e3d-ae17-05cad368f5b0", "value": "T1E8458D227B11CFA6D370D67249F3833557B112931B82194F6238D328BAA176CBD4F9E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881018, "uuid": "b52cb639-657f-4874-a0e5-302bf376cf8b", "value": "24576:NEE05734z+NsbOt0dEWCUdl8GFr18CiPw2+OXCWTHfVyIz2kMUt:l05j4z1K+dEWCUdl8Gn8nPlbTHfVyIzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881018, "uuid": "652b6ca2-9126-4983-bf20-c5eaefc653f9", "value": 1279392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881018, "uuid": "cbc70040-2194-4b4e-94b0-199b53ab3cfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881018, "uuid": "6e9160a4-2222-4ece-8d71-7d9cdf79f53b", "value": "nig.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf345657-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880691, "uuid": "2f4ea28f-f4f1-4d5a-8943-247aeadf179c", "comment": "Malware payload (Mirai)", "value": "6a27151a55536335f48a54789c3515ac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880691, "uuid": "383ff7d2-bb56-43e9-9a28-b488345b5470", "comment": "Malware payload (Mirai)", "value": "77c2c9ff8a57f9ac4894bdbecb78c45927844ad2561c3ede3ec155025a607802", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880691, "uuid": "40f1f294-211c-4e9e-a88a-c09b947252e1", "comment": "Malware payload (Mirai)", "value": "b3a0e4031d028864332f2b9356d3f0363ad1c890", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880691, "uuid": "68a51e42-70a5-4d99-a5f0-1a6ae915ad98", "comment": "Malware payload (Mirai)", "value": "c939dbaacd8a294ca68373a22da80f8dd1b902d193d267063bbb82de5f3c4fc4b1540a0a47d5467333ea8c05c5a3f9e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880691, "uuid": "022be56d-64fa-4448-9c97-4e9cd403bc7a", "value": "T10741E1CE60F56142C6DCCE0070E58DC86315B5D1E1FE2A3ADE81BE6AC4CAD54B029F35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880691, "uuid": "e03f9189-a9cd-4a2b-a380-e8553a69ff4c", "value": "48:sTpnxWkqxR1lKH54aa/JvpoVVjo7846qPViRxQ:sC1i30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880691, "uuid": "3e7c4b38-bc94-4ebd-b483-c6c33ddbb6f0", "value": 1901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880691, "uuid": "86b8458f-2d3e-4cab-bdd1-a2e1294880fa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880691, "uuid": "50768ba1-e833-4888-976f-821467286734", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a5edaa-59a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779870441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870441, "uuid": "95ca6f2c-3ad9-4f30-b3f7-87a71832260f", "comment": "Malware payload", "value": "026ce34378cdc29ace60056f0bdae8ff", "object_relation": "md5", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870441, "uuid": "ed74ca01-6eb6-4e43-aa78-7e60f4903809", "comment": "Malware payload", "value": "77f91d200d7ad4f237fa69968853a63f657b961be3d6081b02f61e2ebd127553", "object_relation": "sha256", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870441, "uuid": "9ef27580-9f98-4dfd-b0d4-0679616c8a67", "comment": "Malware payload", "value": "93742ceda4532dc30134922ed384c89540785599", "object_relation": "sha1", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870441, "uuid": "d9e37962-7842-4184-9b23-b12e425d72ad", "comment": "Malware payload", "value": "d2102b94c8e9fc254f447be998137ecf33c56ac408754417461a2d46767c9e5f1dbedbe23550e29906db77394e7854ad", "object_relation": "sha3-384", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870441, "uuid": "348592a1-0f53-409d-994f-41b56c05a0b0", "value": "T123D4C053C308762FD729F4582EE16E44AB4F9D6F1271B6D5A99FFC06200FDA0903A678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870441, "uuid": "abda04e3-7b40-4bee-9c7d-63a103fb9ee3", "value": "12288:cbx49h+QhfA9k6AJkoeSdNUASq+Prh/zHiJ3:649h+QhfAq6UU/qY12J3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779870441, "uuid": "160b3c2e-8cac-4531-a12c-d10168c84ff7", "value": 605532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779870441, "uuid": "e635fbcc-7e64-4a78-a4a4-a36b0f2492da", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870441, "uuid": "3097afbf-b27b-400b-a1f7-f4144c02cbe3", "value": "77f91d200d7ad4f237fa69968853a63f657b961be3d6081b02f61e2ebd127553.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b544d11f-59e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779898713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898713, "uuid": "cb375408-c688-4e36-996d-e45859669423", "comment": "Malware payload (Mirai)", "value": "2b89222647464d4a01efa712935a354b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898713, "uuid": "107476c2-ee30-49c9-bef7-d7cade33f1c1", "comment": "Malware payload (Mirai)", "value": "78b7b38f97acea47e7a550dc738f77514e5d35367ebfe7f5fbbde7c5eb1aaec5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898713, "uuid": "be9889e9-d18f-4506-bd30-de3a694164d6", "comment": "Malware payload (Mirai)", "value": "e43b0561d0376d240263846ff90a658d53921e1e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898713, "uuid": "fb9d8cfb-85b7-4796-8eff-21ea77e5ff60", "comment": "Malware payload (Mirai)", "value": "b122599152971a2051229cb4110a45f0993f8253e1231e7f17a28e10faa2627fa58c3b8bddc7599cd8ce5dcc3d58c480", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898713, "uuid": "916496b8-93b9-458e-b25c-433612a84e27", "value": "T15BF33A027B0D4F43D2572EF02B3B2BE1939BFD5228A4E540752EBEC99271DB25046ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898713, "uuid": "5a23d674-64ec-47dc-afff-d259f6031514", "value": "1536:5rTEXdMLXEjHfNxq0p5F12jHnJ8pmDRxlaKYEsqjQ9ZButOrNf5RglhksHH3nbp7:VTX2Vk0pH12l8gDRx+1gAsHHXafZFKYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779898713, "uuid": "2babfdab-3c18-47f0-9277-3ff56b28c0bd", "value": 158944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779898713, "uuid": "463e7b75-8146-487e-906d-35318ae15eb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898713, "uuid": "faba4b2e-7413-472b-8563-5f260269d656", "value": "nova.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40043ac-5982-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779855386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855386, "uuid": "6431d7c0-66ba-45df-8962-d45c7b04375c", "comment": "Malware payload (Prometei)", "value": "92463173672742b66661ff0477078718", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855386, "uuid": "b92f941b-f427-47c7-b1d9-bf17008bc700", "comment": "Malware payload (Prometei)", "value": "796b2c38854556d976c024605437515366a12ee93b8048307b067289bf2d1238", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855386, "uuid": "9a55dd73-72d4-45a3-804a-f86733f23bf0", "comment": "Malware payload (Prometei)", "value": "2e7252182dbd08092a7554d6bc2000ee871e6bc3", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855386, "uuid": "8bcc6e0d-b083-43ce-b5f6-03cabd4361cd", "comment": "Malware payload (Prometei)", "value": "4dcb4224e4c99f278a488c23a869668c4de6375a6a998d2a6094377780233444ec5c18e20dd5b1e087b90a77c9b136c3", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855386, "uuid": "c6dd925c-5629-4e48-b983-8bdda30afa2f", "value": "T168B533E0CCD9BB5B748A3A14031DB0E87579BC63A0F94D99DA32971449EC7DD62333A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855386, "uuid": "43d8ef7e-2ddb-4a45-827d-efb17dac79c4", "value": "49152:NLGTUizDhZi4JexF8BFDFuDm1xLhU1Zyuk21uu6aOVk2+xm:Uy2exmBFDthU1Zfk21u5aOV6xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779855386, "uuid": "25b2ae0a-cd44-45a8-88eb-1614223134ec", "value": 2419129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779855386, "uuid": "2faeb668-d209-4677-835a-a32b07daae46", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855386, "uuid": "299667dc-276f-4314-a87d-dbbc0ef8e207", "value": "796b2c38854556d976c024605437515366a12ee93b8048307b067289bf2d1238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7da033-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880955, "uuid": "db8c0d3c-bdaa-41dd-80dd-9ac4038fa164", "comment": "Malware payload (Mirai)", "value": "98665acf71d1249f876a893289c1a668", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880955, "uuid": "5e1fe5fc-54bc-49b7-b680-7804bf0d3f38", "comment": "Malware payload (Mirai)", "value": "79ac767148f4a00b6f51203d23e8f2d0b7ad4167a5daa7d840e57477e7894058", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880955, "uuid": "43638163-e10b-468c-bf34-a2389004de19", "comment": "Malware payload (Mirai)", "value": "dfeb67c95e2729be1e3c10302b75c16b4c6dfd6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880955, "uuid": "4c40b2e7-cb29-4dbe-947f-de72f7f138ba", "comment": "Malware payload (Mirai)", "value": "9653470c8f6809c19a6b012d1f31b27d5dc7f506e9fe7d6822d49da9f4fcccb45f5a0ecc45b32a359312f51c4684664c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880955, "uuid": "39260669-d02a-41d8-af6a-e76b8439bdd0", "value": "T186E33A17B5D084FEC89AC1744BAFB136DA31F15D1238B29F27C4BA226E4DE704B2DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880955, "uuid": "ceeb9ff8-d798-43ef-9953-6e5fc23438b5", "value": "3072:sJTtAb/khHfZcJg86vXblEENjnTR05UuOAv9X5ZW:sJtAb/kJVL0OOnZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880955, "uuid": "7ded5543-eb50-430f-b613-315138c52a36", "value": 155320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880955, "uuid": "b7e2924e-9117-4ea7-99c7-3d48238f9d93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880955, "uuid": "49986e78-f53e-4058-b35d-bf5c26af2eb2", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a34691b-59b6-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779877488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877488, "uuid": "e926ad30-7539-4ec9-ad82-c9a5293b6a4c", "comment": "Malware payload (NetSupport)", "value": "f089b6fb42c239f730d4ba02ff553fa1", "object_relation": "md5", "Tag": [ { "name": "5-252-177-201", "colour": "#6D7D18", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877488, "uuid": "a9cc2e23-7f25-4106-bee5-99ae15f78996", "comment": "Malware payload (NetSupport)", "value": "79ad6db733805ffff0c251d25cbf911dedf3c78352ec5813742d164b11bf3e7c", "object_relation": "sha256", "Tag": [ { "name": "5-252-177-201", "colour": "#6D7D18", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877488, "uuid": "16ceae67-5005-46dd-86d6-836e4153e8d7", "comment": "Malware payload (NetSupport)", "value": "bb4dbf1689bf997a7d6371fd5f5d0130a464ed14", "object_relation": "sha1", "Tag": [ { "name": "5-252-177-201", "colour": "#6D7D18", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877488, "uuid": "b3548be9-b86f-4e09-ab45-76066d4a9cfc", "comment": "Malware payload (NetSupport)", "value": "48b995f047fb7137581917fc3da65b048c90a9ac3d94d129d0bdad31b0ebb46d8e860d3e225387f05be5a9e9ae2159bf", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-177-201", "colour": "#6D7D18", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877488, "uuid": "0e206207-f76e-4cb6-b613-9fdff23d5c99", "value": "T10616023FF28BA53EE06A1A367A72E114543B7A2165164C0296ECF88CDF751701E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877488, "uuid": "587801d8-b840-46f4-888c-f39469e6b225", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877488, "uuid": "d8bb4832-faab-4e6c-b1ff-a67a263acbf3", "value": "98304:R5OxzPwkJpVvJlCqnUtX/gL7kBO5WIw0XDR6Pktd:LCJLjlCqnUtXI3kG9t6Pktd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779877488, "uuid": "66f5ef00-9dce-499c-b756-4d14fe9e4d42", "value": 4116979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779877488, "uuid": "ed9c708f-ac21-457d-a0d0-52b844e3cc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877488, "uuid": "6ce43a8c-8062-48a4-8c26-a269cce183d5", "value": "79ad6db733805ffff0c251d25cbf911dedf3c78352ec5813742d164b11bf3e7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee19520b-5a13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779917707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779917707, "uuid": "8d3372a1-0923-4348-91dc-662df89ae88f", "comment": "Malware payload", "value": "aa1761e10daaee9aac9b53f6df0e9eb5", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779917707, "uuid": "d90ccbdd-ea85-48c2-b9ed-58d8ded43225", "comment": "Malware payload", "value": "7ab6da29e7f5f7270eb97e74a2c8a171128400145c44b3e61d67d0462abe607f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779917707, "uuid": "66708de0-3a19-4f7d-bb57-e7289d9a1407", "comment": "Malware payload", "value": "9115329803c96b5ec91578169d4c2c3f415dd520", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779917707, "uuid": "8b676984-d2a9-4762-bb00-66ca5ee78a66", "comment": "Malware payload", "value": "39b540b50af6770bb1ac3d61832e3ab55bb66eb05fc8a81fd57f16fbdf677b8e1f5d167b08cd8e2acebae8d64482e951", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779917707, "uuid": "d77b7b59-d811-453d-bbac-a0bfda39f8fd", "value": "T121F533CF86E6B682F5EE4EB2FDA3D378BA787136E549C10E3509A017248301B94D4B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779917707, "uuid": "15b251b5-cb10-496f-a244-a782b49960ef", "value": "9b05359936c2afc89afdc2cc60a791a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779917707, "uuid": "dd10c405-117e-4edd-9996-47886338567b", "value": "49152:pyCegPZ621NY7fuPGZaVsk1neRoWTfOJum7CbHH2BJo1m6aslsYAO:pyCegPs2Y7fXBASGoaI1mJKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779917707, "uuid": "7243cf9d-3ee3-4c57-b703-f00a1ea3cf55", "value": 3518464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779917707, "uuid": "629f747d-10ac-46f3-850a-6969c1cd71fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779917707, "uuid": "df703691-1d67-4f35-903b-6fa29fbfa3c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4381e8-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911694, "uuid": "b86f1ca4-b023-440c-9352-7bc7f973e380", "comment": "Malware payload (Mirai)", "value": "b503cf3f4b4d94c6cb758f6a921db83c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911694, "uuid": "8339dc4f-e257-4ad0-9bee-baf765ccc319", "comment": "Malware payload (Mirai)", "value": "7b25f4059b8dd05a00df17f65ce6704dae90a75b7c9ea2beb2c446eacb076e38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911694, "uuid": "9b43608e-71c3-44ff-98be-f3eb505c5308", "comment": "Malware payload (Mirai)", "value": "5ba9f248c0238de1c007cf841b9505bf64ae4edd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911694, "uuid": "0056821a-d058-456d-a3c5-713f2fc4a9cd", "comment": "Malware payload (Mirai)", "value": "a38bf696c9803c881ff64f5cdbe71463ddd9d6542290d88e4d1d2fba2d60ff2e553b1901e0c802e202263551923f329c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911694, "uuid": "8ea84e0f-1960-489f-804d-d73af5218eb9", "value": "T151F31A42F8418F16C5D211BAFA1D128E37131BB8E3DF7212AD245F607B8A96F0E3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911694, "uuid": "92b23659-eaca-4b1a-be59-13c9020db283", "value": "3072:XkGROPfU3yLPrW40QdIA2XSaRuwXOcJvBCRlYOP6hh1zP5:X3RgfU3yLPrWlesXSaIwX6RlYO+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911694, "uuid": "d323d62f-8598-4944-bfbb-d64d162e58f3", "value": 170940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911694, "uuid": "97a53808-e60b-4868-b63f-d86bd41ff172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911694, "uuid": "5c2e51c6-3697-407b-a8f5-343c1635b713", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875e1b5b-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878880, "uuid": "6831c152-b6df-424c-904f-485f31479735", "comment": "Malware payload (LummaStealer)", "value": "c0c65337c6d152465830cac6b3b0dafb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878880, "uuid": "3ccd5ad8-d40a-41ba-9918-6cf09963bd59", "comment": "Malware payload (LummaStealer)", "value": "7b3ecdcde58c29dd29e35689acb45003d3d108ca1a823f3e908c523bd1023d4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878880, "uuid": "fe6b01eb-6f3e-4ce2-9dd3-6325e146a4ca", "comment": "Malware payload (LummaStealer)", "value": "b082b98fbe759eecc9a27c516c2b6fec3c248a4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878880, "uuid": "ba82cd5e-00cb-4a39-b9aa-99e8bb722639", "comment": "Malware payload (LummaStealer)", "value": "bbc099cad5b9e22407e8306cf29cf995c7ef27a1650912ffd91f7fb0c3307c5b86e33f68b782a3cf0ee0f7de55813078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878880, "uuid": "7773ccfd-08ae-4d48-9ef5-946f5a0bda41", "value": "T138748D9AE3B758B0D5470979216F733F9B241A168728CECBCBF0DB4079272E26535B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878880, "uuid": "aaa41208-ef91-4bfd-8b90-751e2efd59f8", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878880, "uuid": "b1729597-d649-458c-9e89-e01fd8bba744", "value": "6144:zYZ1hfBjV7gE7gVPMBa58tvPES6x6vZLE579QPv1ebx+2RZG:8Ph5Jst8tUcV3l2XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878880, "uuid": "de79713f-22da-44f3-bce5-0dbc168afd03", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878880, "uuid": "e85821c5-ff9c-4d38-a464-fcfcf2b00d8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878880, "uuid": "dd9caba4-7421-408c-9bc8-2179f7aa5f71", "value": "7b3ecdcde58c29dd29e35689acb45003d3d108ca1a823f3e908c523bd1023d4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6848fe73-59c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779883122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883122, "uuid": "32ed3652-771d-42f1-ac2b-321d4cc46f7b", "comment": "Malware payload", "value": "557c4efdba3a0b4d677b88c8a439bab1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883122, "uuid": "54fb7e99-3313-4fa5-90cc-243206a1e275", "comment": "Malware payload", "value": "7b679a520a543299f7690098878395870cb111ed8cdd7c828abdf6394ad3656d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883122, "uuid": "3e66a59a-256e-4392-95d8-8454f9349216", "comment": "Malware payload", "value": "e92eaccecdeeaf70ac7e56097dd98fb2dfce102d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883122, "uuid": "46b4a3f4-0b93-428b-941a-b1e82d18100c", "comment": "Malware payload", "value": "b292c2220355b317b2535ee24e7501ed453d7431b55e575a58568d8f8de37a00b72a4274b4591c22cf9fb2a050c65d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883122, "uuid": "b465f599-82d5-47cd-b05c-1eba82f0a636", "value": "T170254E51A7EA5208F2F75F886AB55415597FBD6A2C39E2DD1208219F0BB3E00C8F1B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883122, "uuid": "4bc17845-83d3-4c34-8942-74ab4c2443e3", "value": "6144:uDdHtopkSeLqEy3z1GK3ei6NATwMnf6xa7:uJHgesNnf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779883122, "uuid": "f9771f84-c017-47c2-bd49-a43936c68169", "value": 1013032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779883122, "uuid": "4db695f1-c939-4170-b32b-7046e86f1ebe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883122, "uuid": "ad9b08e0-3687-48a4-961d-9a21871a63ef", "value": "Pre-Alert# 44722 Booking# RICG395300.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd730d93-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880688, "uuid": "f9fcdc38-a8db-42e1-b760-aea18c4556bc", "comment": "Malware payload (Mirai)", "value": "e454d2a86479ddfaa129fa403c1b0d0f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880688, "uuid": "519aad82-e887-4262-ab60-cf460e0b2126", "comment": "Malware payload (Mirai)", "value": "7c0afc0e882d2b15b684068215508f5ed72f680ef36992e8165e7dfc6680d783", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880688, "uuid": "07f1f84c-30c7-4bda-897b-486e161cd174", "comment": "Malware payload (Mirai)", "value": "cab5e82efbf25314ba5fb9906a15cfec69171c55", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880688, "uuid": "59accbc5-92b1-4f7b-b66b-e8772b9ca75c", "comment": "Malware payload (Mirai)", "value": "f4f5ec1321d4f3b333abb327b8194b01cf6b5190ec9cc211c9439ce42e35f802d884fcba31ba31359f595851b25009cb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880688, "uuid": "c744ac71-c55a-43e4-83a2-df0cb2815619", "value": "T187E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880688, "uuid": "a7116ace-f609-4cff-a6e9-5d243e557718", "value": "3072:kxjJw1Cc/0s6YAPwenUr48pzfR+JonLy:kxlw1xAop0YfRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880688, "uuid": "cd6f1dba-d44f-48de-aa54-fd731d708ef1", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880688, "uuid": "f4006d90-f576-41fc-84a0-ba6f4ee348ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880688, "uuid": "2458d220-30b7-4af3-9a5b-69943adf5a58", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cd6e59-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913587, "uuid": "f0150e11-c4df-4344-92ae-cea20706d1d4", "comment": "Malware payload (Mirai)", "value": "7333864e904c89c153ea7463f254f75c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913587, "uuid": "53ac431e-505f-47ed-a649-220e33b258d3", "comment": "Malware payload (Mirai)", "value": "7cc8f04cfe213262c56ef7bd0ca186fbf4ae9157a097bb8b26b3ef7b7d085f9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913587, "uuid": "7679f105-5293-4b50-9628-d1db27937efe", "comment": "Malware payload (Mirai)", "value": "3de50f560e5e57a004be0b110b47c0a54ac91d32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913587, "uuid": "3a34bf5d-473b-4962-a6b1-2d25b1aef482", "comment": "Malware payload (Mirai)", "value": "3d2f585b8a774290615dbdbc06e70732addb838924bb5a33dff13f2f65cc51686368fa60df5011b70cbdae8242a57c6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913587, "uuid": "e22a5e34-6c88-46a8-ae19-1c3a81edcf2e", "value": "T18B31219566D05EBCCCE491BEAE56431073749F40E1CB7263D2187B25BD1AE3C5C2644A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913587, "uuid": "fdd21f63-686f-4b6c-bfc8-6403c3a93a8e", "value": "24:FouKGpa7Urz/jlfXXK1hH9Vev3gRGaJ9iMfBButPlxrR+z3LNs:fKGpa7UrLZsI+JZButPlxrs3LN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913587, "uuid": "c9e01d3a-b361-4f8d-bfae-5da5a78e005a", "value": 1464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913587, "uuid": "bfcd4b2f-6bb4-4a92-a5af-8f376cea793a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913587, "uuid": "86c6db52-5b89-42ee-826f-b4d332f5e5bb", "value": "dlr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363b4dd5-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924700, "uuid": "d913380c-a784-4d28-9c98-0e94335268c0", "comment": "Malware payload (Mirai)", "value": "32eafa58db4aafa274e277b4fa3f8715", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924700, "uuid": "1e0d4c1c-f95c-4734-9f60-9bbe192f2cf8", "comment": "Malware payload (Mirai)", "value": "7d5fc618349026a735a6295447edac757b139ad43056cd559a9673c9442d88c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924700, "uuid": "622fae95-ea66-4cd9-84f4-ad00c40972f3", "comment": "Malware payload (Mirai)", "value": "e3b7c051cbb40078d135831e932d40afc8715ba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924700, "uuid": "30a2b019-63fa-478a-90e4-35185123864b", "comment": "Malware payload (Mirai)", "value": "665d3b0d91ec73e033680a892b82990c42a5f5c7d8ec3dc248c11c03f4bb1e22b86256e3d52ef30d9b5f4a1d2761fc41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924700, "uuid": "f44fd660-9584-4296-8d5e-08ca372f8ca8", "value": "T1E1E329C7F900DEFAF80AE33648570905B630BBE115921B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924700, "uuid": "c14730fc-191d-4c84-b1a2-59bb06fb8149", "value": "3072:GmzTDH86JG78FenJljAX0Gidw+w9EEVvjbiQLZrEyqKYvf:G2TDH86JOHjAX03dC9EMLmyqlvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924700, "uuid": "39c59b87-b216-4acf-baa9-f488f06972fd", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924700, "uuid": "f26f324e-4d9c-4841-b2a7-b39f44e2e793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924700, "uuid": "b838cb52-52de-4121-88a6-def294c04376", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecc2331-5a06-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911802, "uuid": "8ccc9643-3251-4e37-9387-92fe22020696", "comment": "Malware payload (Mirai)", "value": "d87a5a8fd71c0ed185727f0bac9146fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911802, "uuid": "1dbfdcbb-b1a0-4c87-8c95-d9fb97f4e3c1", "comment": "Malware payload (Mirai)", "value": "7df59a12ca75efaf0d8448f8b97ea3331325951f2dd59029b0d74a9a2cb1097b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911802, "uuid": "facb276b-2738-46fb-9293-2895085969d3", "comment": "Malware payload (Mirai)", "value": "c5fa2baf84574674ae8525a09db654c744ab7a5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911802, "uuid": "5b2bc4ee-b185-4578-b1b2-01b357616390", "comment": "Malware payload (Mirai)", "value": "42c087491a9c66d47ad530f5f058c7ec6fe18c8fbb672648a4f601dc5848130f054920c08212b11b070539061f967611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911802, "uuid": "48d88d86-83eb-456b-81bc-c73caf9d98cc", "value": "T17214B81E6E228F7EF6A9C73547B74E24975823D623E1D641E1ACD2111E2038E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911802, "uuid": "b0a3c198-5a4d-4443-8b9b-c09b66470b33", "value": "3072:QDy7dCcHfWaKYCYv5RuiMK3+cQOXfj56hh1P8DV:QDy7dCaWalr3bt+eX7E8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911802, "uuid": "eaddc478-bf2a-4795-b1f9-f7d0b8a06f12", "value": 207860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911802, "uuid": "a460bac8-2acf-4052-9df8-a818bd18f85c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911802, "uuid": "e12ac6e9-c30e-4f3a-850d-cd2267935aa9", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26799aa4-59f3-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1779903628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779903628, "uuid": "f2435572-8dee-4084-934b-30c2cbbb6627", "comment": "Malware payload (ScarfaceStealer)", "value": "c62e255e24ae2828eed69e12c6843d4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779903628, "uuid": "5e3cd18a-373a-43a4-8fa9-55098ebb76fa", "comment": "Malware payload (ScarfaceStealer)", "value": "7e61532302f2a326a7191f39635df7cd23a5deb03b2dcbe1feca367b799b5e12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779903628, "uuid": "e8f5eaea-293c-43b2-b8b9-00cd6abd7eaf", "comment": "Malware payload (ScarfaceStealer)", "value": "f3e0efdb97a5e63dc3e7a8fd177dd05ee244c482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779903628, "uuid": "666c9e34-c1a6-4983-a613-18dbe57b9e8f", "comment": "Malware payload (ScarfaceStealer)", "value": "91507b3b4907dae966ee180afa93525b3631eeab6febde0c94e5d2a77a82c5c274628b38635ac6c8feb23646aff5785e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779903628, "uuid": "240f7b25-2403-4611-8144-62dc0f1ebcd5", "value": "T161E623EA40A552F4D5D34B80234E53CE71D0B15E45F96C2D3ADA2C42AF22DAF268DE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779903628, "uuid": "5d6f7036-b7f5-499d-945c-2a33d612d351", "value": "ae41470776de8f200324de833b6ea38f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779903628, "uuid": "5b505a87-6c5e-4bb2-821f-af156b2c47f3", "value": "196608:dtUVWMMST750pJDZ6P4pt1vJ9kGQJ8uuYVNSVbGQjV5CcOXlCPb2QRNB:dmVWMM07581T1vDKJ5VAVbeCPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779903628, "uuid": "5d821a64-24fd-4890-9f76-fd21c97ad5d2", "value": 13969408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779903628, "uuid": "5c96d0ce-9206-4b9c-b9ad-ade34e314670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779903628, "uuid": "604430cb-0eb9-4379-a512-00d19b4ad56e", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dd349b-5a1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779922743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779922743, "uuid": "0623efc8-2d44-4f53-b2c9-d9da18d9ab42", "comment": "Malware payload", "value": "c409efde87d14f7a02f67742df2b28c6", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779922743, "uuid": "b48d2087-c6c4-479c-b53c-3e2ce8d48c72", "comment": "Malware payload", "value": "7e99f5e3d4efc4aece3e91b7cbbbcf2ffcb21072a8f14bd874047383e77fe5ab", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779922743, "uuid": "6a37cd1e-1f2b-4f99-b7a3-fd4257a4159d", "comment": "Malware payload", "value": "a806cfe9b0f5a65f211b68fb0287e5fb5a5e7b62", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779922743, "uuid": "d12169ed-07bf-42db-ae0a-16e304eae980", "comment": "Malware payload", "value": "0571eefe642333de783e86ac8bf90d0f1fc6deafbe759aaa3137ee8e4a2fc5c7cfca1813486a38ec69863fa1a58da38b", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779922743, "uuid": "958b376b-ecc7-4be5-80f5-47dc1cb4c766", "value": "T1E1F5E5608B92A132B320D74D497ABF38A41F598764E5DF01301DEA38395EC67931BBE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779922743, "uuid": "e8e2e4e6-4a4d-473c-88bf-6d1d70c582ea", "value": "98304:1xJ0/B5hVcHXI/GNLQIXblXuhvmQE6BCBEFQ+lbiyCTSkm6QUCJUrlA+KSW:1wBlYXtNTLEjEYCBFGbmTSkm6YU5A+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779922743, "uuid": "86677a26-0880-45b0-97de-5eaac21c62ab", "value": 3415178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779922743, "uuid": "83f24dda-eb16-4e4e-b05a-fa1c1deb544c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779922743, "uuid": "2af22c85-6204-43a8-bc6c-d7d597e3487e", "value": "April Offer-SSQ2026.4953.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51aaf0b9-59a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779870629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870629, "uuid": "b13384db-6afd-4faf-82f9-4c2499296197", "comment": "Malware payload", "value": "93866e18c76704646138231055494342", "object_relation": "md5", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870629, "uuid": "ab5796f5-b83a-4b60-838e-00e403e59ab7", "comment": "Malware payload", "value": "7ee2e6db7dd37a3d01fa27e6a21a591ede991ec74214540d82bf110d2e3e3b64", "object_relation": "sha256", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870629, "uuid": "020560c4-fbda-4938-88d3-8cc7b2eeaa2c", "comment": "Malware payload", "value": "632a05646423df9d7820a012238c912499adaa6a", "object_relation": "sha1", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870629, "uuid": "c5e44c85-4b6e-49e3-8b6d-63148a8c73b7", "comment": "Malware payload", "value": "0e4744ed48b8eaddd16cb2e83c11afd2299a4bbe117aecd92b33516f1c1d035bfa069d6228207546913cc41ea86c2bfd", "object_relation": "sha3-384", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870629, "uuid": "589f73ea-dd5a-4e96-b4f9-748f5718ca1b", "value": "T1DDF05C261B0FD100897A56B27AB6D90CEB53E2B34840D4A5B389D8011F72375DBF1ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870629, "uuid": "efe3a5be-d464-4f01-bb58-edd9732b47cc", "value": "12:xvQNRRaA0gfOSaGHDcVUVQAVOF/XLBU6BY1sz7i4HFIL:xvQNRYAgSnHDkUSAVONXLBx7i4l8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779870629, "uuid": "1356dcd4-9c66-4aac-bd1f-d6267f016318", "value": 465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779870629, "uuid": "f0e06785-022d-4ca4-baad-9bae205a9d34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870629, "uuid": "f65faa06-1a43-4545-ab91-cc6cd577ef8e", "value": "7ee2e6db7dd37a3d01fa27e6a21a591ede991ec74214540d82bf110d2e3e3b64.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5881ecd9-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878801, "uuid": "8ef75f4c-7b00-4af6-8702-b077bfe06561", "comment": "Malware payload (LummaStealer)", "value": "caa823db63bbba6ec582e273937e7d59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878801, "uuid": "f0830b34-4c3d-44c3-a319-c3757bd89f3f", "comment": "Malware payload (LummaStealer)", "value": "7f2dcf5c28160454ce88d2f97ac15cfb8950bf7797b64a03dda8fd4b91f042fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878801, "uuid": "c22a7abb-acc6-465e-85f1-eddedcce6a2b", "comment": "Malware payload (LummaStealer)", "value": "5df624b326e8fd1df30dca2de6702b7f1a0395c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878801, "uuid": "9cec31ce-c09c-4b7e-b969-eea279a96c11", "comment": "Malware payload (LummaStealer)", "value": "99951a4bf7a3c4868836cf7c66a0948786492595b79271362353ca3bee62ff4265314a21749628ba13fc329a2ac3e257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878801, "uuid": "99095d3a-e845-4e8e-9ef1-47153ef1277c", "value": "T1A4748D46E7B748B1E54B0975229FB33F9B2416144328CDDBDFE0CB447A33AE26539A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878801, "uuid": "a6b55e6e-5f1d-4ad1-83c9-f418254720f8", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878801, "uuid": "0cbd4cfb-ab4d-491a-a2dc-3a3d55ec693f", "value": "6144:sRLI6zZvCw5/8m5RtUHD2zSnK90dK7KDhAoK4Yeh9bDvJFeCs1WX:0Tj50mhUCzSKGPlAoK4YehVvJFei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878801, "uuid": "b5e3805a-246e-47a3-9287-91d41a932c01", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878801, "uuid": "91448408-4801-4a94-be3e-35c9fc226f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878801, "uuid": "4fb1f281-8daf-41b5-b58d-cfc172d8e211", "value": "7f2dcf5c28160454ce88d2f97ac15cfb8950bf7797b64a03dda8fd4b91f042fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7775bb-59db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779893684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893684, "uuid": "076e0e64-e86d-4a6d-8db1-4392eb9965c2", "comment": "Malware payload (Mirai)", "value": "32181779dbc2f9375b5b6f6d57822f8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893684, "uuid": "bcfc4fa9-c6db-48d5-9ee1-744023f260aa", "comment": "Malware payload (Mirai)", "value": "8058b277e0cae15eb1b1f19145c2da546f4329365de824b23527d9a5171b2167", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893684, "uuid": "480fe74f-395b-4653-9f03-d76802ad6af9", "comment": "Malware payload (Mirai)", "value": "7a08f43c2b454d96b39fe7562038188987ed27c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893684, "uuid": "17a12512-252c-4bd3-af3e-2cd29c2b263e", "comment": "Malware payload (Mirai)", "value": "b5372f03316bcac7ad8cc171137599638283cc2ed001a1a331f39be4962705a1fb70a522706cf995c5a81aa3f46d28e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893684, "uuid": "17b21409-fc61-4a54-877f-a750747b9e42", "value": "T150C43955F8809FA1C6C02976F65D86AC73134B79C3EB72068A255B343BE786B0F3B605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893684, "uuid": "c4069ba9-0b01-4816-a883-9c5e6cda2faf", "value": "12288:01C3he1bRGrSjXk59LAHIuampP0qPhgpRIYp1:X3he4Srk59MlFJcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779893684, "uuid": "38850595-e2cf-4879-b2d5-ff66d7f35c83", "value": 558392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779893684, "uuid": "14cdfed5-aa05-4b57-862d-16ff0b255088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893684, "uuid": "81f9c388-a91f-456f-86e9-02555fad6ad0", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ab7a62-5982-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779855392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855392, "uuid": "28d4b894-fe3a-471b-a623-87da0c2685a5", "comment": "Malware payload (Prometei)", "value": "0ce5813731f1c552c68e2f58d90e1216", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855392, "uuid": "33105a0a-401b-4fe5-b7d4-8838ab8e7b4d", "comment": "Malware payload (Prometei)", "value": "8070697f780decc5b07a2d3830f90aabeee73a5523235d602510ccf5dcf3ef00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855392, "uuid": "6f95a78d-e905-4216-8276-19dcc01ca31c", "comment": "Malware payload (Prometei)", "value": "d75be84f24ee674ebc1c37f1c2750c4f93f360af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855392, "uuid": "ad12e4e4-46cb-40cc-8ca0-77fa4fdf1f33", "comment": "Malware payload (Prometei)", "value": "7a97a3e156da77b598f63dda874f8fc2d38648ac6a4543f14c729cd2cc36bc3555b927847fd0c8bab2c49c2fb1262e83", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855392, "uuid": "8036b955-870a-4de5-966f-2fdcdd80f141", "value": "T10A166D6AB2B354FDC15BD03097AFC6636835B4B40131BC7B26809A352E73E605B6DF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855392, "uuid": "b6c92371-35ef-49b3-8d49-846ffbc42834", "value": "98304:GRM0MUCZs3WcmDZXeC+CSePlPqSJWTREfmeBeetfAZR:lRvL8REfmeBtfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779855392, "uuid": "83a94a74-ffab-4d3a-93ed-83ceeac53fdc", "value": 4284336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779855392, "uuid": "8a40fadc-9a0f-4498-af61-63e4e0fe1dbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855392, "uuid": "760f95ee-b8c2-4166-8dd6-0c5b04258f3b", "value": "6821e6f5962502319adb6ec0e14713909182479fcc23a5ed630ab839ed329413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1def9569-59ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873119, "uuid": "d0430744-3b34-46c1-a1c5-45b7c4abc0b9", "comment": "Malware payload", "value": "a0c4f602db0582019ff690d029f6bc0e", "object_relation": "md5", "Tag": [ { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873119, "uuid": "a2050a12-327e-4718-9af7-e20c1905e493", "comment": "Malware payload", "value": "81a5042fdb3885e4c108bc2a511bc078fa6073f47c72ffe5258ebac85ccdaee8", "object_relation": "sha256", "Tag": [ { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873119, "uuid": "36707328-3de0-4ab8-809c-6ffd96bfa042", "comment": "Malware payload", "value": "f3571243388076dbf424097f83bfe0ea6d063c72", "object_relation": "sha1", "Tag": [ { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873119, "uuid": "6a72efb6-3c94-4f0e-bb62-84c4b9fc728a", "comment": "Malware payload", "value": "e935afb97e4385f971acc0ca6e160bee5ab4156916820f1193053808375007258eaed17d3e8bfc1ff9dc6d164f99df63", "object_relation": "sha3-384", "Tag": [ { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873119, "uuid": "4e3649ee-58c6-4a6f-9952-96b0d5cbe658", "value": "T1D6C02B675F1CC0B4004016C340F7DC0FC57250492510F20048C2C8C651DA2340C1E089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873119, "uuid": "cd403df6-e19f-4090-9cdd-24fca1c10a6f", "value": "3:YYGRXkZ6XgQtWEopvF4/x7D/ecOGAyYdss:5WU9BuJ7yjGApt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873119, "uuid": "654d792f-85d3-4000-aac3-88a7683f6563", "value": 141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873119, "uuid": "07d16b6f-789f-4523-bbdf-aaea210096f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873119, "uuid": "8ace7faa-7767-449d-95bd-7717a3de8c7c", "value": "JPSL82.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c62d940-59fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779908523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908523, "uuid": "1f53a9c3-7cd5-4850-8fb7-be556c8cfc71", "comment": "Malware payload (Mirai)", "value": "4c64326f55757b44bac2392025f09bed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908523, "uuid": "fb32a9d4-75f6-4e92-ba30-264b33c83fc4", "comment": "Malware payload (Mirai)", "value": "827aac2f8fbedc35593f84d0705867d91aa3d2c94d713beb69efda7294ec8bf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908523, "uuid": "ec4ebb5e-4ca1-4c4d-bc3e-12b0c8eda4b1", "comment": "Malware payload (Mirai)", "value": "32eeaf8dcc02c6e057c5a1f8ce4659ba2742556c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908523, "uuid": "ae14dd02-3776-44aa-bc43-9d447f769328", "comment": "Malware payload (Mirai)", "value": "7ae4791322fa03b7bc307a64953b3cff636e2ef6f829a2be4a491e654110661a4ddffbf38bf63c94c0a98ad26d729b9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908523, "uuid": "a194be83-727f-43d1-a8ae-2e1506a6d7c1", "value": "T16BC3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB367574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908523, "uuid": "0996308c-b7ce-481d-ae6c-80779876469b", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JM2N:MwCvdHmezn0nUPMu9KryXsM2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779908523, "uuid": "f8e19d45-cbb7-4f30-808e-55353c7bafc0", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779908523, "uuid": "240f0b6a-1b9f-4ba3-a601-8e659672f8c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908523, "uuid": "6c29718e-97eb-4ff0-b132-254aca90b0d1", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec05d0e-5999-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779864933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864933, "uuid": "453c7201-2792-4f92-a1c6-edbb3a0dd45f", "comment": "Malware payload (Vidar)", "value": "4e701d95e445d2b7c1e126665e476d5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864933, "uuid": "cdf691e4-b548-477e-9906-6cc4c88f4c62", "comment": "Malware payload (Vidar)", "value": "82e9f638f4235a110559bbb2e9d83c4f72c23040799c80fde7e9503cfe66aa6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864933, "uuid": "5119bfbb-5f3f-478e-af71-41e72005eb2b", "comment": "Malware payload (Vidar)", "value": "2a3aaff6a70ffc53905afc8d806e57037d68d7da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864933, "uuid": "03499841-2e31-4453-9a84-e7a188161a6b", "comment": "Malware payload (Vidar)", "value": "95469911e1e3947a879939076e3eac447c35cba613a687c5700ca664c9781709a67e6c08f521cf629f6ec7e571dca269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864933, "uuid": "0cabe445-72cb-4730-9f05-fa7258642916", "value": "T1D9251258220AD407C8A21FF40971E7F866689EC8E921D657AFE6FEAFF47D1143901392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864933, "uuid": "7ece1968-4089-400a-a969-c4d18c450ec7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864933, "uuid": "d6fa40ef-29ed-4ae3-9f74-960fad9196e3", "value": "24576:wSAEFT0DCsq6JcxeaNGWnLeFWkozxAnOiP4WGZ:Z3FQR8xeGLeF5EAzGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779864933, "uuid": "13fdbd8f-e43b-4816-b91c-0ad11806e360", "value": 1031680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779864933, "uuid": "0fa3c411-8edc-4a65-82d9-ad8ffe6c06ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864933, "uuid": "cff43efc-6bad-4d21-8e84-cf0521403fd0", "value": "TAX INVOICE S12-SIN26010104-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7871e6a7-59c5-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1779884008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779884008, "uuid": "0ac05f4d-259f-49b6-898f-539127917142", "comment": "Malware payload (DarkTortilla)", "value": "b1c478e241918101b5f38fb6d07f2597", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779884008, "uuid": "6dc54b9a-4723-4fd8-b17c-f95dabd86eb0", "comment": "Malware payload (DarkTortilla)", "value": "82f667e77a036edce6b6bef25fbc989fbf1f27e1bdc3ddb99b821ca9f60dd10b", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779884008, "uuid": "e7403e22-12c4-4ff1-b2b7-918083469e58", "comment": "Malware payload (DarkTortilla)", "value": "127775bca5e6049972c1ebb7714621f54830a033", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779884008, "uuid": "966c0e17-f0df-46c8-90f4-541bc8008e91", "comment": "Malware payload (DarkTortilla)", "value": "0e8fc7bebf8621a29c823876aba80227be2fa335fd427cef1f5cd735db01b5b8b524ea6cd605f6cadfbfb660784e7eb8", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779884008, "uuid": "6695ca90-1486-4ead-b6e8-ae6dbea5e66c", "value": "T1A955F11A1AC29F50C54F9730ABBE15E9D2B34E2A0D3443E747531EE9FE3672AE181853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779884008, "uuid": "741c191e-d1ba-4919-87c1-f1fa6712cfac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779884008, "uuid": "30acbd72-ed57-4549-9554-2ef7d6f865d8", "value": "12288:SeiEbgNjaz0+HyaCuVdyrxvD9wR0FLB/bBNTiwX7CtR3gDhMzXtFscrYJFapei+R:05a8uGrxtFJz7CYDWzocEuei+Zcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779884008, "uuid": "a3efd16d-d942-4bf5-a4b6-61533664e58b", "value": 1332736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779884008, "uuid": "3dc8f2e0-1d60-4dd0-8ac5-ca817a7a8f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779884008, "uuid": "ab22360e-2f5a-4cec-a8b1-455684d4bf9d", "value": "Quotation No 550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9ee7cb-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880793, "uuid": "f8e54fff-8a8f-495b-baca-578321b570b9", "comment": "Malware payload (Mirai)", "value": "9fd15dbe70af3ca5ea970211ddfea80b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880793, "uuid": "722d2513-4d37-48a2-8957-3069073d1e4f", "comment": "Malware payload (Mirai)", "value": "83ebe9c9c3b1b089e6eb91ba28535db8b5a64c01baa9fd270a85640a5853e3de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880793, "uuid": "740751ea-1d7e-45e5-8475-12c5712c7b5b", "comment": "Malware payload (Mirai)", "value": "5ba8e855cdfa8e8c5b793eacc071fa3752fcdffb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880793, "uuid": "0da39e59-9a5b-472a-8ece-6e0a7aea45be", "comment": "Malware payload (Mirai)", "value": "678223275628301735fd7d880527595d481efd1740ea2f5fd7ff21b5a76cb4accf6a84de3d4d649b922d471a6e5ed5a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880793, "uuid": "4884b74a-f79d-4265-8a81-0b69a4eadf13", "value": "T106D37BB3C82A7F98C514E4B4B0318AB92B63A55542471FBE29A7C7B59087D8CF5093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880793, "uuid": "81312426-c3c7-4f1c-8286-a747d439db23", "value": "3072:SJNzrjrbLnL454jU1dBWr9/QXWFWk1WQ:SJNzrvvL4uU1T4xQmF91WQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880793, "uuid": "fd02fb62-532f-417c-bf8c-83e7ce19c8b4", "value": 133260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880793, "uuid": "6217fe78-515e-49dc-8ffa-15844235c7a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880793, "uuid": "f6cdbd04-4b12-4720-bce0-54139a5e3133", "value": "micro.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292a0147-59ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873138, "uuid": "f061f074-b04f-4fbc-b612-cd0ffcdb9b36", "comment": "Malware payload", "value": "9f95647cbaf903d41c9eee162903def0", "object_relation": "md5", "Tag": [ { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873138, "uuid": "2cfa810a-1068-4222-a820-4d207f006248", "comment": "Malware payload", "value": "846a1b1c04619190e117a9d92cedd5201f699ded609bc16e755b30c2e2aa8d8f", "object_relation": "sha256", "Tag": [ { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873138, "uuid": "57159244-75fb-4745-8d26-97233cda3c42", "comment": "Malware payload", "value": "15de41bc2a91339624dd05c5817a118bac7b42ba", "object_relation": "sha1", "Tag": [ { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873138, "uuid": "ca13a1f4-4bfa-453f-b01e-9869018570d3", "comment": "Malware payload", "value": "9d7baae20d4ab143fa0fedd9e40cb184a8be68ae07a3b9f9c78be51f735ece7e1c587919dacf289a2679d455b78414c1", "object_relation": "sha3-384", "Tag": [ { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873138, "uuid": "5657972a-1043-4b2e-9fd6-f2601b47f58f", "value": "T190C02BD75F18C4B2154102C388F6DC0FC23104092A00F20048C6CAC704CAB790C4E085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873138, "uuid": "c9f1ac93-477d-46c9-92c3-2293fe16a23f", "value": "3:YYGRXkZy1OKKzREopvF4/x7D/ecOGAyYdss:5WWRzRBuJ7yjGApt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873138, "uuid": "ba54937d-a3f3-42de-93d2-c91975a8c4f8", "value": 145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873138, "uuid": "57558f97-e141-419f-a026-31e092f94a60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873138, "uuid": "ab8c2f0d-1e9c-461d-bd30-2c86972d0e2f", "value": "VLJDX22.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432f50b1-59ba-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779879195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879195, "uuid": "784238d4-8c68-46e6-82fa-5e2405c2daa8", "comment": "Malware payload (RemusStealer)", "value": "779c052780eb2926fad3eb231e8847b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879195, "uuid": "f097821f-5d1e-4e43-b8f8-168fe725820a", "comment": "Malware payload (RemusStealer)", "value": "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879195, "uuid": "6dba2bc1-746a-4b18-961c-a225f86ae574", "comment": "Malware payload (RemusStealer)", "value": "b0e2fc11692381c9ebbe7b74d2d4225075974d9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879195, "uuid": "771805db-b3ba-4aad-a667-cda4c57be15d", "comment": "Malware payload (RemusStealer)", "value": "7b21cf6af610686851e9b40d484330cd0071275b85e8e076b3ba49ba644d271c5a7b1e08b1c4ef2e7d24fb98f593bd16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879195, "uuid": "87c1f1ba-8045-480f-9cc3-4f750f4075e0", "value": "T147767B0B7CE108FAD4AA633289B662A17B71BC550F3227D72E9072783FB66D49D75304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879195, "uuid": "2a68fba1-6a38-4190-8167-3bbac5dc5749", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879195, "uuid": "43bc27cb-5ff3-4e33-b069-8e32e16afac7", "value": "98304:qsQqxSliyM221sYQhxMf1LyVkb/O0fGZY0:q7qUliyMmbMfgVW/ZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879195, "uuid": "60863855-da6d-4d5f-a70b-6f1a002d9191", "value": 7120512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879195, "uuid": "d58ab7a9-6946-41d5-9579-8b417f03d1a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879195, "uuid": "2d07b910-b7db-4786-a760-9fdb3ff937ca", "value": "84705a48cd1e868dc45ca6f42d565cf1c2a3c44def8fe25f7f15e5b3962bc5e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3638736-5991-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779861827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861827, "uuid": "03ac7b82-a92e-4973-b3cc-75ca4e2cff85", "comment": "Malware payload (CoinMiner)", "value": "e31553435f5fd1f677ecadb5a221bd6f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861827, "uuid": "addcb9bc-b95c-4ecb-99b9-427283ec3174", "comment": "Malware payload (CoinMiner)", "value": "851398c8621e444a0a86b275aa451c3f2a007d4b027f4dfd50d4a5566aac1bac", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861827, "uuid": "e5dd3667-2d58-4f03-b0a7-86447bdb6fb4", "comment": "Malware payload (CoinMiner)", "value": "bd94a7a73cb4b7085b8e2e2efdb5e298694539a6", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861827, "uuid": "fd1b5f7c-77f2-4705-88b3-81c6a9bdda1a", "comment": "Malware payload (CoinMiner)", "value": "c83793be9c44b780304833952455cd6f0eb396ce0f9ba4faeb865a2a586a8e0328468f2e91a0704dc17125b0fb22c948", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX11.file", "colour": "#F3623E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861827, "uuid": "557503e1-e25d-46f7-910e-b3e35b831513", "value": "T174867C57A2E550E8C82BC178C6965233E7B2B8155370A7DF16A8E7361F33AD05E3E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861827, "uuid": "533bdc90-ab09-4d51-9c8c-12db3b91c6a7", "value": "52e4bc72e2d08c9515f27eab903d1dc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861827, "uuid": "e698395e-169c-4722-bbd7-c58cf21b87a4", "value": "98304:ngD0LNSaFzazC6Ob2cUl/6pRedsp/KepIKJaz3eHp+ee6Mjr:ZSaFazCt6cUIp+spiep70qHpNcjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779861827, "uuid": "ddf0e575-a3ba-43ae-ac24-d063033d7577", "value": 7979520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779861827, "uuid": "02ecc8a8-26f2-4483-9fc3-bcf6938f8328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861827, "uuid": "42d52982-12f2-4376-8f43-74eb67eb5c85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b297c9-59be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779881017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881017, "uuid": "2b96cc10-83de-4573-8887-02d90110f16c", "comment": "Malware payload", "value": "afd9c07f231a7b6cba0b3b48885bfda8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881017, "uuid": "7bafcc2a-e507-4d48-8995-218348ff6a99", "comment": "Malware payload", "value": "851934f8fb3b754596f14ff0945dd21db218609cb28aae8078b3e19cc0293c6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881017, "uuid": "3ad5141f-1be6-488f-8be0-021e5ca2898e", "comment": "Malware payload", "value": "316da363da54944fd37883e24711a56ab8e7275b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881017, "uuid": "0ef1aae0-82b2-4e84-af6f-917108d34204", "comment": "Malware payload", "value": "229828afeb9f8393a18e49357090ba5804b98bad2f2516e2aac29e2d003049a62b17e2e82286f63dfcb9e5f3c4247ad2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881017, "uuid": "9134bb2d-3849-4415-bce3-179b0a9259b9", "value": "T165457C44FF449F06C6D8327BFAAF43697332878297C67606AD2492387EC7A1D5F26205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881017, "uuid": "42f2b0c6-3642-4836-9900-b0a486405ea0", "value": "24576:9gWtBWOnrRK/SVDr5BRWmnT1TGH/pvV8odvS0i:BL/DlJnT1TwV8odW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881017, "uuid": "72e4c2fa-6326-42bf-8fb6-3db65b10e3a2", "value": 1202692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881017, "uuid": "b38ca33f-6e8a-48d1-a369-345d2c818822", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881017, "uuid": "49e637ec-4e28-48b3-b983-702b1f880d3d", "value": "nig.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7918e760-599f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779867689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867689, "uuid": "6e00a491-0300-4178-87f2-bd02b88eec22", "comment": "Malware payload (Mirai)", "value": "7fdf48e8ed3781413a0961f95f24987f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867689, "uuid": "536ee1ce-7156-469d-a05d-04772134eeb1", "comment": "Malware payload (Mirai)", "value": "852a189cffc28b34d76f6f65b4642ee982300004ebe39355e12b279201894e07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867689, "uuid": "7632817d-fe4d-4504-92be-5efc1a43248e", "comment": "Malware payload (Mirai)", "value": "507d9d4d2959d8082c3442d4afd5996a96b22c94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867689, "uuid": "7676a4e8-0755-4690-be2c-21bd10828b66", "comment": "Malware payload (Mirai)", "value": "ad88350b644007acc0d76932e5b051f99db35b211f60a4eb5d6dd3270b6390b7fff146c368a3821c99c853afda5f13fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867689, "uuid": "98012ecb-6f20-49e8-a344-20833bcdf05e", "value": "T198143A05EB504B1BC1E22BBEF69B428D3333CBA4B3D7332559285BB13BC27595E62116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867689, "uuid": "81d7432b-8c75-4d3e-8921-eee5a57c90fe", "value": "3072:/5JlPoOnUaQHWTuisaqHIwqSJzMQ5eanYS9qmjleHCG7a2qQbAI6ojO/iL/KdIHt:HFp6eanYS9qclgN7LqQbAnojlL/KdIHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779867689, "uuid": "2cba1a5b-bece-49d3-a53f-add76af8fbec", "value": 195538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779867689, "uuid": "5f47df0a-c584-4a8a-82d6-cb252883ced3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867689, "uuid": "143f3c18-d090-4ef9-b785-5899683ca86c", "value": "bot-armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619a2c31-59f5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779904586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779904586, "uuid": "193a61ee-ec84-400a-afc5-54015c6bf79d", "comment": "Malware payload (RemusStealer)", "value": "f34bba7156548038c3979142dc5ff845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779904586, "uuid": "590d010d-ab9c-44d6-959a-5f24bf8a1d9e", "comment": "Malware payload (RemusStealer)", "value": "85397c6e538138dfa71c4f26c572d540b52d75a7050f4fdc68bb1261267f6f13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779904586, "uuid": "df284d09-af3b-4cb0-9504-1516102f5bb7", "comment": "Malware payload (RemusStealer)", "value": "118ff00a0e479dd71b9d4bcd791575d9f7a6a8b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779904586, "uuid": "23ee0218-c295-4da8-b658-3084fe81b693", "comment": "Malware payload (RemusStealer)", "value": "fd21ab018ac5d8ac782b302a1c5caf65bedb098e39e8bb9f8d312ba27b932c4dc6e356676723b6094df99b6e0e41f160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779904586, "uuid": "569c148b-bad2-40e5-b0ac-16e2e8829fe0", "value": "T1C77549077CD424B6D9FA923289B51291B732F8890B3167C32B55B2B92F777D80E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779904586, "uuid": "79e954ae-eef2-4334-809e-b733bb20e82e", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779904586, "uuid": "68de7ec4-4b1f-45e6-972b-65a5839139e8", "value": "24576:PBQ5ZEqSm3Q7ez7osUYShRMEsSyJheSgk0HIsv+D1cj:PBEZbSm3K2XShpsSyOSgk01+D1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779904586, "uuid": "a2e7b45c-824b-44de-bc02-f764c8efe971", "value": 1632456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779904586, "uuid": "748dde3d-fa82-43e5-bd39-ab87f63d5ecb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779904586, "uuid": "d5a6ca98-d6c9-41d2-bd8e-29bdef307e5a", "value": "m\u0435t\u0430\u0441it\u0443\u042564.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220e5031-59d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779892024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892024, "uuid": "56041534-50ce-4e39-9bcb-2e5c55017171", "comment": "Malware payload (Mirai)", "value": "829aa7b57846d193a3a1a28a367581cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892024, "uuid": "4ea3416a-f64b-44b7-8092-d3c928eaef42", "comment": "Malware payload (Mirai)", "value": "855931ed160f9e4b3cb321c96e8454e5b3662859e1829784cd0bb0c71aee4053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892024, "uuid": "6be5d244-7438-48d1-8347-031885124da7", "comment": "Malware payload (Mirai)", "value": "3bd44327c6e4b60290510dd5470537cdac84cdd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892024, "uuid": "cc0fe64d-83da-4038-a83b-71b392e31e09", "comment": "Malware payload (Mirai)", "value": "02959639b54feeddfcb8192aa28194de4be8f9b79246ef675c18359756776a1ec39647655ca42e72db902f8af7473b25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892024, "uuid": "3388e687-8481-43d7-89b3-3512272756d0", "value": "T19A265BA8BC1CB552E9C87AB47F6541C57339FC499F4183277614BBADA9F23188F22720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892024, "uuid": "717b6506-1008-407a-9ec5-175badab09b4", "value": "49152:AWnR7B1+rTTpAbzsZDWJ9dWEhDZ5EOczqmM:PnR7BErTdAboZDWJ9dWEtEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779892024, "uuid": "7bea6dd1-158f-48e8-a157-29befc6ff8c3", "value": 4849816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779892024, "uuid": "3e73fc97-5fcb-426f-91a3-779cfa646d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892024, "uuid": "5d2f52ab-cecf-444b-8893-ded1312a8d87", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aceb1b90-5982-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779855320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855320, "uuid": "4cb704ef-380b-45df-9041-fd055dbdf149", "comment": "Malware payload (WannaCry)", "value": "d00571b24ceb211f0661e9365e1fc697", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855320, "uuid": "66114c3e-ea35-4a58-aba4-f17b82968dee", "comment": "Malware payload (WannaCry)", "value": "85b9eb097c475325269c7146cc3052734ec2cdf4a79b7feb67b184ab725923fc", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855320, "uuid": "4fd290d5-e5cb-4505-a5f8-3142dbd6534a", "comment": "Malware payload (WannaCry)", "value": "1bfa5e6b13f50e1aad11743458e7f9484271a271", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855320, "uuid": "ff9d1865-ed7f-44c4-9946-985224cfb9bd", "comment": "Malware payload (WannaCry)", "value": "56248e2d655d855ca3c4e881af159d991d02b0059e3d51bb14cf191ff364423f4eba749b54db6e724eaaf2edbf884440", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855320, "uuid": "ae888153-60b3-48df-afd5-c4a8d264595c", "value": "T1C7363394729CA0FCD0410AB448B34D2AB7B37C9967794F1F9B9081AB0D63B9A7FE4711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855320, "uuid": "2ff751cd-8168-4631-b48f-e0478740356d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855320, "uuid": "a65c2691-6214-47e3-8a13-624c43a3d24c", "value": "98304:DRDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HP1PiviP0okh:DRDqPe1Cxcxk3ZAEUadzR8yc4H9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779855320, "uuid": "684ce42c-47ee-477f-ab6f-da255d516110", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779855320, "uuid": "9d1385ed-b9bd-4385-b998-59c427e8e73e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855320, "uuid": "d7c7a061-f31a-4459-9b8e-3c9ff3b19f59", "value": "85b9eb097c475325269c7146cc3052734ec2cdf4a79b7feb67b184ab725923fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb026c3-59fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779908522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908522, "uuid": "dcb50cf6-66cd-46a1-9ae6-2a9ed3c4c8c1", "comment": "Malware payload (Mirai)", "value": "2abe0d45e8f424fb1359739611a49369", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908522, "uuid": "a2db2003-ba1d-45aa-ae5a-3284890d7ced", "comment": "Malware payload (Mirai)", "value": "85ecaa95b0f53838eee3b5c294643c7456dacda2915b3fd9751d3a8818c7c615", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908522, "uuid": "e0817cf8-2dee-45fa-a268-12f7097f9812", "comment": "Malware payload (Mirai)", "value": "720ce214daf5667268932c39b5b4521a6f554e6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908522, "uuid": "d7b335ab-9636-4461-8921-8d3c0d3a4c90", "comment": "Malware payload (Mirai)", "value": "a52fc11a59084f964975aa23a5d7c3f02048541fd38b90d78f6e0fc345e9f9acd578691d13740689a12250a99cc71c30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908522, "uuid": "135f9ac1-5186-4a58-a744-f5f4434d0635", "value": "T1C5A34B36B874192BC4D4A47E22F74721F5F247D925A8861E7EB20D8FBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908522, "uuid": "17c307d2-a90c-43b0-872a-75b76887a7e3", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0oAj:bbbmPTO930bkbRl886Aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779908522, "uuid": "9ddccd17-67be-42f0-9660-796341b66a4f", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779908522, "uuid": "9ec79ca6-122e-40d7-9963-78ec316791e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908522, "uuid": "4575444c-d8dc-4007-a159-76d1780a4f92", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f68dd6-5982-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779855436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855436, "uuid": "0d75a361-0185-442b-9a9e-a9839736d3e8", "comment": "Malware payload (Prometei)", "value": "9428ecd58ca644f338a0bb1cd813193a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855436, "uuid": "1d734efd-0d56-4bad-9a1c-bfb4e2736cc0", "comment": "Malware payload (Prometei)", "value": "8676ba28a7aa7662b9e6c97f291d2b1e059d70a893d23838af3b2ffb8cb00abe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855436, "uuid": "7e536dd6-b380-424a-a76d-1854f47d8560", "comment": "Malware payload (Prometei)", "value": "d9c3753f8e8e06a877e14657552c3ea1d4114756", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855436, "uuid": "5ca5a793-7dcc-4aa0-a09d-df82bfe80d9c", "comment": "Malware payload (Prometei)", "value": "410eb1142f836e7be0a25e50d5b602182c310705422c61e97547d4a98e20145e6354083e70690c617c203ce3a1970fac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855436, "uuid": "62cce236-0ef4-45a1-bfb0-3e640b106241", "value": "T1B2A423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94E34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855436, "uuid": "e791e5e3-557b-463e-aa26-e7ae9ca58758", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdl:Fs6pyCC/Ya2hpi6T6N4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779855436, "uuid": "22949a61-a4f1-4012-97f9-4e598f3c6bae", "value": 449082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779855436, "uuid": "704cf1b2-ebb0-418c-8836-cce390da959f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855436, "uuid": "bb84cc0b-c609-4fd4-86ab-900bb95b60bc", "value": "8676ba28a7aa7662b9e6c97f291d2b1e059d70a893d23838af3b2ffb8cb00abe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a796a06-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924707, "uuid": "37636518-a98a-47c4-915e-4c49c4c7d871", "comment": "Malware payload (Mirai)", "value": "74f69ca619fcefc703c922e2670da196", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924707, "uuid": "bbaed41c-4ef5-42cb-b5de-16dd76293cf6", "comment": "Malware payload (Mirai)", "value": "88288b59a32da4b8ebbd362de871189c1101e8b90d2108c444e31bc8c462b6f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924707, "uuid": "682d92c2-bc6b-4a3b-8292-dfa67c37751f", "comment": "Malware payload (Mirai)", "value": "589d379c114862ed31be0e3dc952778ebac0f31d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924707, "uuid": "8998cbc6-39ce-49f5-a01c-fad2fe82463e", "comment": "Malware payload (Mirai)", "value": "6272f37a06cc8f19d4bdb4807278f853a9c46ee0c49465705461d6e8c2df84e13d433aeda8f66d681964e5dcba816ed4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924707, "uuid": "b30e1caa-eda8-4acd-a6ac-e3c9490ec8f9", "value": "T16F530223BC951A62E243DBF142D0A9DD569BCAC3CC9498B2505CFCAECF242687F755B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924707, "uuid": "7e295b09-830b-462c-9bc6-f20dc7b58a05", "value": "1536:ouwAht8biDyM/wt2DVOxp0MBgwHeiWA7Yy7xJAmrx8ZKHOKeQD5:3Bt8biDyKMsOxuMr+w7Yy7nHx8ZJG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924707, "uuid": "c6200a58-6c9c-4239-8968-929718c10787", "value": 62012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924707, "uuid": "11183058-bfd2-4718-83dc-ba817523ea4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924707, "uuid": "45198283-3f87-4f81-a935-6285e563e96d", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f17b84c-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779881013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881013, "uuid": "941839ee-663f-4f8f-8d29-5a072ab3b940", "comment": "Malware payload (Mirai)", "value": "34702cd3c6fc9a07d99d1e4ae2cddcca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881013, "uuid": "340a1312-a34a-4362-8e2f-1d7d07a05f7c", "comment": "Malware payload (Mirai)", "value": "88396b3a312fca9b2bf09d12ef5cea0063e98e688e29b08d537015a2a24ce6b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881013, "uuid": "baa94f99-f830-41df-b375-fee5a78b5140", "comment": "Malware payload (Mirai)", "value": "4b033a1c1b2a98247455ae91703b49d2ae939afb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881013, "uuid": "9db39f91-8e3a-45dc-9d4f-271a331081cf", "comment": "Malware payload (Mirai)", "value": "798834e3b7a2b17258efb1b69d0794a13214cc091e6c79677c325b96fb236f0e41d1a7a6e7b3b56f458b9bd337eb4a6e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881013, "uuid": "a4bb4e4e-990f-4622-9f76-1cb3ac05da29", "value": "T173E44C07FF446FEBC07ECD30496EC217049DA9C645C5972A72BCCB4CBA59A8D0AD7988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881013, "uuid": "4692c9f8-cbce-41ef-a87b-1ca53d0ddcdb", "value": "12288:cTVytHXOJKMX9Ab3Pr+IUoYpYVdgNI5f5Vk0jnXCH4IOZgVoy7DxGLkcvicSW0Sa:knrNZEahbnbUqpJ7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881013, "uuid": "36e7ca16-a0ea-4100-b331-8ee700b7a926", "value": 690844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881013, "uuid": "ddd38be2-9cbc-428e-916c-5b3c28dc7bad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881013, "uuid": "a2d0e5e7-7ce3-4002-9507-da3c7e11012b", "value": "bot_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7512ff7d-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Kimsuky)", "timestamp": 1779880996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880996, "uuid": "b1d41ef5-d389-4bd8-81a5-b7fcb06b7aeb", "comment": "Malware payload (Kimsuky)", "value": "e6349dce8c03da21af31c9c73831a88a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880996, "uuid": "799e853a-b4eb-4f82-9c54-708ad890ee45", "comment": "Malware payload (Kimsuky)", "value": "89d7edbe8559fa62e844232c74502e66ca9c3e1501459862929032b4adf3067f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880996, "uuid": "779c3c7a-e70f-43d3-9c2d-6233567c887c", "comment": "Malware payload (Kimsuky)", "value": "c11b3789792869f2a8a7748134c4a81d0e5c52e1", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880996, "uuid": "eaa3e37a-76fe-478c-8ad9-91f0b05bab51", "comment": "Malware payload (Kimsuky)", "value": "e0eb3c6ba2c1ea93d4ac316a15f2213528c3539ba63f66d2ae2b50cefb0757393138dcd83e625f79a5894eb83fecfa0d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880996, "uuid": "241e3cbf-6829-4e14-8641-375fb22761e8", "value": "T18C2533829EF680A1005CBD12481C9DF96035A372189B7F1ADC25CB74CF62BE79BD79C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880996, "uuid": "c2b1b865-b160-44dd-92ad-06ed4086bf3e", "value": "24576:BkSWWMqy6qAugtN0QzWWwNDjUT2s+iWmoKQbxpdcSxu05K:EIyHHpjoWmmbm8u05K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880996, "uuid": "6fdcc44e-6b33-4c53-8d5d-e416eb17acc0", "value": 1048065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880996, "uuid": "bd1f84eb-a55a-4bfb-9adb-2ef162ced031", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880996, "uuid": "83b5728a-40b6-46ff-aa4f-4d4c0e74bf4e", "value": "tax_refund.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21daeb8-59ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779874254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874254, "uuid": "e4dc78e4-5190-428d-ada3-bd9e63912dcd", "comment": "Malware payload", "value": "efb444e954bd85b00868655d208261ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874254, "uuid": "b6c16215-98ba-4c6d-afad-e77ed640a7a3", "comment": "Malware payload", "value": "89ebc4514c77bfb436e56bef005a0db5f71f5bcbac4042b489b33d6708e33b2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874254, "uuid": "e7307347-5e4b-4453-80c2-2447f67bc929", "comment": "Malware payload", "value": "e3332c20105ff9d4fb18156d69292e0bc21a6de5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874254, "uuid": "8a82585c-a528-483b-bf87-09d356a22d3a", "comment": "Malware payload", "value": "cb3a7c35ce9a279d08decc168546e5cc8eee0af1ff34b997aab61023db79389737301ab957a546859b3d49c55f0993d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874254, "uuid": "0a5423f8-7ca6-46a6-a3a5-9e5c5d755eb7", "value": "T151D68C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874254, "uuid": "f59d80e6-44c0-4da8-a576-16cb88fb302c", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ7:cqYUQuVDt0TZEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779874254, "uuid": "8f6e7af3-936c-4cfd-ae24-7d407af2b00d", "value": 13434880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779874254, "uuid": "2fe96bd6-a600-47ad-a16c-af08fe40f430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874254, "uuid": "c94f3212-9994-46be-baf8-1d2af2f5a991", "value": "89ebc4514c77bfb436e56bef005a0db5f71f5bcbac4042b489b33d6708e33b2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d46de6-59ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873478, "uuid": "4f501651-3f4a-461d-a0a1-133bbaa83702", "comment": "Malware payload", "value": "6de2d48e35895c2636caf63acca0133b", "object_relation": "md5", "Tag": [ { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873478, "uuid": "cb804046-23ee-4595-80cc-b3f13fcc0ec0", "comment": "Malware payload", "value": "8a58866672b47a03e94418af175f69a2e93774e0ca00bff7d9f18b2cafd1ab28", "object_relation": "sha256", "Tag": [ { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873478, "uuid": "fc59b4d8-7a26-4ae2-acea-d08c2f330eda", "comment": "Malware payload", "value": "316d58067791cd67aa87023565bae4bc73788f48", "object_relation": "sha1", "Tag": [ { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873478, "uuid": "fad92d0c-3403-43b9-a04b-12435d44aaa1", "comment": "Malware payload", "value": "b2a09164fc7c4ecc2e5addd9f173be77a01e949d5eb8b4e7a381eec26367ddd7daa643d40eb6af0cb50a2d4d90412a02", "object_relation": "sha3-384", "Tag": [ { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873478, "uuid": "22440ecb-7c67-454b-acb3-80207c83ace9", "value": "T151C02B6BAF1CC4F1054112C384FAD80FC53700095E10F784C883D8C914CA3780C4E8C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873478, "uuid": "f745d65e-d7a6-4144-b6eb-db5dcf3fdc5e", "value": "3:YYGRXkZOgeELETnEB7M0NmopvF4/x7D/ecOGAyYdss:5WWETo7JfuJ7yjGApt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873478, "uuid": "4842557b-54e1-415f-a13a-ab6729d37a13", "value": 152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873478, "uuid": "fbc8798d-46b0-4707-8a82-9358cc8c89f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873478, "uuid": "94884616-58c0-4a79-ac95-f16fe9e78af1", "value": "8a58866672b47a03e94418af175f69a2e93774e0ca00bff7d9f18b2cafd1ab28.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee59583-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880637, "uuid": "132b3258-211d-4612-9daa-84403acd7b23", "comment": "Malware payload (Mirai)", "value": "b6b6fcf6888e32078b383ae0d259ed76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880637, "uuid": "d7caeefa-ddc8-4c14-9271-c879b5e79f91", "comment": "Malware payload (Mirai)", "value": "8a6637f9382a4d4f8186c95b23bb21100ff2d0085357d3f1bf96e4194ec8b59c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880637, "uuid": "87564eab-01cb-499e-a327-563317278e3e", "comment": "Malware payload (Mirai)", "value": "b08bfef475a411942c3a2702503ec5198aa98e40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880637, "uuid": "16f4cc3b-ab5b-41f1-b198-7461d21eb992", "comment": "Malware payload (Mirai)", "value": "741357be08ab00f4f8ddd1a6219a8f1ca32c0142fe441ca3f01ec68b5a7a96fb735711b1d390b13d38cf1c707b01fe9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880637, "uuid": "ae4e7c34-486a-4394-b66c-66b4102844a2", "value": "T19014C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880637, "uuid": "c9563809-e274-4f20-b914-17f8842a9836", "value": "6144:4f6eQCbeoufx4bdf2dp06GtCqjYW8nY1j20WI:Vely4bdfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880637, "uuid": "41c86d5d-159b-4a9c-9af3-d0bf752027f0", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880637, "uuid": "2ee6e845-8f52-4424-8ef6-7a0b15ca0454", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880637, "uuid": "672a3cfc-4432-40a9-a297-35a3aa1852d0", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8910842a-599e-11f1-a769-42010a9c0008", "comment": "Malware payload (Havoc)", "timestamp": 1779867286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867286, "uuid": "c41cf9c0-1f65-48f9-b58c-48acd6116fd8", "comment": "Malware payload (Havoc)", "value": "9e0dfec9f8ec5ce311fefe29c0f3a8de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867286, "uuid": "8f0974aa-b836-42a8-ba77-1198e7841bae", "comment": "Malware payload (Havoc)", "value": "8a69ef840fcf206de7a97fec7c4fe67fed489ed200c2013f1480d9faf6f7359c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867286, "uuid": "c801d7fb-0e6a-4c85-b6f3-f5bde17b5105", "comment": "Malware payload (Havoc)", "value": "8e07c122ea0507d2f6732213ede6e9ee985be784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867286, "uuid": "04a47d8b-f313-4ef1-bb98-011ccb4ed2b9", "comment": "Malware payload (Havoc)", "value": "6aa3dcb748954eac00c4c94b3ca6932efd5b200deb0b622625690728d2c052a66c66301a8c167fdfd2d16337b591bf39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867286, "uuid": "d1c5512b-4088-4af6-82f3-8e3eb3469103", "value": "T103C30147825AD4FECBD69370C0E96F32BBB290626B050FBB10E9D6311ED0C657E9B905", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867286, "uuid": "afcc16ff-60cc-433a-8ea4-009dbeb349d6", "value": "c1f4358211a66fe3d457f3e6f5983347", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867286, "uuid": "5c6b5405-c403-42ff-8efe-dc80cdf80eae", "value": "1536:wLoknZAF9tFbugzhswLMGXghVXBIguAp5yqpPRB8NJAGVPOKdiNOCH7gZ3/XmmpF:wLdnZAR3hs+MkghJBIgDrfau8OW/ugJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779867286, "uuid": "2777540c-a0b3-4226-a07f-070b24a775dc", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779867286, "uuid": "5f7eac1a-7eb7-4b49-80a9-1f94581a53d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867286, "uuid": "784ce918-6f96-4c28-b486-a6f198f0a85b", "value": "SecuriteInfo.com.Trojan.GenericKDZ.113800.11702.2266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7caf0a29-59ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779886163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886163, "uuid": "2e002d90-f560-4b50-be84-6ffc3627f8fc", "comment": "Malware payload (Mirai)", "value": "e43bb8833510e07ca1be89595cef8406", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886163, "uuid": "73643cca-1196-4922-a88d-1a984be26d8f", "comment": "Malware payload (Mirai)", "value": "8a7872675a0f1aeb248d2a819d6b0542e78e0eab230b291d62bc25a03baad9e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886163, "uuid": "b4f88cd8-b876-40ff-8cfd-257637961c4d", "comment": "Malware payload (Mirai)", "value": "d0b77e34aff02b3345d31545db6a02f70fa2ccd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886163, "uuid": "a4127e5a-df46-4c83-9ee8-b3225cf2ed4f", "comment": "Malware payload (Mirai)", "value": "e36d1cd5c7186baf6429be5960673c05520e3a13b6cf678815538ab758d6fc1a60f44ea47b1ce637ed3f2b4546e1f4bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886163, "uuid": "9b6d958b-faa3-4ba3-ba65-5f1109d24345", "value": "T17C360997B8914A83C4E43676BCBD81C833A34EB99B9753666D04FE3C3ABE1990D35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886163, "uuid": "9fdb3128-7507-4d78-a4b8-26d219ce0c3b", "value": "49152:w5gcqFewiQMzDUTNPUG4ZwcvE8bEIvVf1:ckkwrMzDUT5eJ71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779886163, "uuid": "fd8c6f46-c16b-40ba-8bbe-78071dfb6b5b", "value": 4915352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779886163, "uuid": "bf983a1e-1d50-40d3-8081-586a99df3fe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886163, "uuid": "81941d02-6935-4313-9b36-e1aa41bf9ec0", "value": "8a7872675a0f1aeb248d2a819d6b0542e78e0eab230b291d62bc25a03baad9e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cbb215-59da-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779893151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893151, "uuid": "6bc13262-680c-434b-99e6-9c12a39d82a2", "comment": "Malware payload (Mirai)", "value": "5f572640fc6e2585e9ccf6535d922e2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893151, "uuid": "1847a467-9ef4-4e53-b808-ccae461a023a", "comment": "Malware payload (Mirai)", "value": "8ae932b31d92bdb4e79109768722fabd9beca9f638407a9e8ef2946181d67890", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893151, "uuid": "a0300b4b-a018-4942-8e1a-60b084ae5d43", "comment": "Malware payload (Mirai)", "value": "7badc5d51f40d72c1f0a52885cc2c52b396d9e2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893151, "uuid": "2a02185c-a295-4852-908c-988307bc716c", "comment": "Malware payload (Mirai)", "value": "9948fa14168b60dcf5ed7140823a5da1e3ff50c9ba32272dcbdd5e8c162d6b96fc71c1d25ba3be5c6b46ce7fc03f5ab3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893151, "uuid": "92458de3-cc8c-46f3-926a-4d4b5d6043b9", "value": "T1B3933894BC419B12C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893151, "uuid": "1fab2690-384b-49f1-af92-d01ded1c3e3c", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2Dn:eyxt7W+G+3QBBntmzg6d7WidDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779893151, "uuid": "515d410b-88b7-43ca-af81-a15d773f8d91", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779893151, "uuid": "c4020c0a-cf4a-4c1f-87f4-490fc110e8ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893151, "uuid": "b5afc5df-b62a-4482-bcb7-e66cc4adc503", "value": "8ae932b31d92bdb4e79109768722fabd9beca9f638407a9e8ef2946181d67890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a486887e-59da-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779893102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893102, "uuid": "8d3c96e1-3b47-4a1c-9720-895a897c9092", "comment": "Malware payload (AgentTesla)", "value": "16047fc2befce320b1bedac03a6852d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893102, "uuid": "cf4ac388-ac66-4ed4-91db-0311ff7fbf6f", "comment": "Malware payload (AgentTesla)", "value": "8c1d87fd44657fef556790d40f427921fe10eddf40f9edd6a58d68687286ea9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893102, "uuid": "afa9689a-8538-4e2f-bfdc-8ad750239117", "comment": "Malware payload (AgentTesla)", "value": "88cf57140a1445809cb087979582308089397061", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893102, "uuid": "182fe53c-fd67-4a66-96a4-78532d0b82a5", "comment": "Malware payload (AgentTesla)", "value": "562868d96e62f1cd9d856f3b04e1abd12073d4ceda4943f26557bed6380320eeb525a56de1c38032804d57b36b06e064", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893102, "uuid": "3a6f3b6f-2f23-4979-908d-9ba99d0fb94f", "value": "T1EBE55B449270E104BBC3CF566636EEB4718E2907B9388961B10FD6375D5FE93C0A29BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893102, "uuid": "9ff69da3-2634-4b2f-8e10-b30ceb7facc4", "value": "98304:i1CEKRAelUg0G+L4W57tuACfcgBObYs2Sh2cyDkyAY+sNuCEj:i1ZIALG+MYtuAWPBOk5Sh2PrAY+/Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779893102, "uuid": "c09b83ad-9455-4ee8-a2bb-f7d73ac93a67", "value": 3212591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779893102, "uuid": "6fe15954-65ce-4444-ac22-c8197e7111a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893102, "uuid": "4b903901-a071-4c1b-98ad-081e7fd4cdf6", "value": "PO 012447.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1bd19e-59fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779908524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908524, "uuid": "de1665d4-92e1-4f26-9113-da4a76cc2ff2", "comment": "Malware payload (Mirai)", "value": "b1da14c237dbbf65a2273533ebf4eef5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908524, "uuid": "c6716d52-c6a4-4bf0-806a-50169c8324d1", "comment": "Malware payload (Mirai)", "value": "8ca7865081d5e24611fc14ea44cc7557797e62b7946227eceddc8eecb8f8c955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908524, "uuid": "7cd7e306-965c-4592-8db7-99f119ecddde", "comment": "Malware payload (Mirai)", "value": "785764d5dbe968baa7c2a51e28d7ac98dd55a990", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908524, "uuid": "a0917954-0221-42dd-8913-0486691c2a62", "comment": "Malware payload (Mirai)", "value": "946e664d3e7166f7b9645803407512e8aa7b400953cda8d3f6505c5f852703ba1190d6d23e3cc7e6fd46e32210caea4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908524, "uuid": "13728720-73b4-435f-ace8-45dd483e8dbe", "value": "T1D9A35D97F401EE7DF80BD5BA04670A0AF630E3E51B930B366397BD67ED351A50826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908524, "uuid": "8547bf8f-13ce-4853-b1dd-e436ccc2689b", "value": "1536:iPhR5NhZp+huOzP6DxHd8P9foRRfZAuDbAV3GNPt8QkUa:ip3PSVWxHcqRhzhNPt8QkUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779908524, "uuid": "d5362c84-c76f-438d-a8e6-ea079c9c3e83", "value": 106760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779908524, "uuid": "928dd3bc-0459-4e0f-8dbd-cb43f4c21429", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908524, "uuid": "825dc95c-356d-4e01-84d0-f7081f010a4c", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd01a40-59fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779908526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908526, "uuid": "dd6cca69-1757-4304-8019-a0fd7475e4a0", "comment": "Malware payload (Mirai)", "value": "87dde15df862577ba83d560be969e842", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908526, "uuid": "1a086ec4-c60d-4acf-a199-8d822b0a1dcd", "comment": "Malware payload (Mirai)", "value": "8cd877745fbc99022028e822a2d3b20423e309cc33ab131451d6781ecb6bf6f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908526, "uuid": "7f436685-0c5c-40de-9378-c14fd8be728d", "comment": "Malware payload (Mirai)", "value": "caabd38eda5082bbfdee27cfcaf5307716a6c577", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908526, "uuid": "3a218932-ad41-4155-b1cb-f51df3d236b4", "comment": "Malware payload (Mirai)", "value": "5f430dae59b469b925f1ff9dd85a07a16356c76f352ff434419ea1283f8e4ff81ff52325d98fef9fcd2ebae6d8604762", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908526, "uuid": "27c9a59d-ff3e-451e-85d8-f8cc73241765", "value": "T17FC3E81E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908526, "uuid": "60393e04-db7a-473e-8b3f-890dd720ccbb", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3T0j:IaOulLUUogcQ9BvMEWSWC2h3T0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779908526, "uuid": "21495fa8-9030-470b-a5e5-2a569181d30c", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779908526, "uuid": "a65ad8ae-50d1-473e-859d-6cb7370c4cb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908526, "uuid": "397a1f53-525b-436b-b8cc-463ac558ae2e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7485692e-59ba-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779879277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879277, "uuid": "1b974f10-2edd-477c-bddf-d8064be819d0", "comment": "Malware payload (LummaStealer)", "value": "575df73acb23c85dd89690362c4b5235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879277, "uuid": "f9c60b9f-2cd0-4e36-8ac5-53d8cb4799d8", "comment": "Malware payload (LummaStealer)", "value": "8cee1385e626ea3b107d63fba785d9eee4d1464aae86da8ce83c7a116c4bd10d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879277, "uuid": "97e9862c-4f32-4fc9-b47f-a409e027773e", "comment": "Malware payload (LummaStealer)", "value": "176f940c974119780028cbb639ba0a11df7390cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879277, "uuid": "ec1a151c-a39f-43f9-b905-7ce5ac30af06", "comment": "Malware payload (LummaStealer)", "value": "2468431969ab46b7a324402985abf548b2f83a90a98de8a7bccf24fd6b29efd7dac7040da360f924073e467c8dca9faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879277, "uuid": "2fa77e59-7cd3-46d2-b90f-f2959a597a53", "value": "T1032733E9328801D2E8CDB7B9057A3F15997FBCCE00F429CFAA5330A578BD554502FA99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879277, "uuid": "2a5319c4-1085-499a-bdb7-a1f7ee7ed781", "value": "393216:G7JzXvasRP/Vs9b5chA9Hd9I1+jZOfaoy4oDNUQ+AR1pZcvJgw:GBySHVs9bWuHPIxaoRoDqZAXpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879277, "uuid": "29173957-b693-40fc-8ba8-e1ce09fbd7cb", "value": 20490240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879277, "uuid": "41bcf990-ac50-4e08-bf06-fd12a7843afa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879277, "uuid": "f6d08842-09a0-4124-9caa-9b1a0e5c49a3", "value": "8cee1385e626ea3b107d63fba785d9eee4d1464aae86da8ce83c7a116c4bd10d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c3bc3d-599a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779865450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865450, "uuid": "2e55edc9-c3d9-4619-82ef-ec6ed11f3a43", "comment": "Malware payload (Vidar)", "value": "89125e33ed9f2cbbc45830308b5fa114", "object_relation": "md5", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865450, "uuid": "40881428-6aee-4972-9470-e5b8f2e9e7ce", "comment": "Malware payload (Vidar)", "value": "8eb42426a7406faf3497a0b58b16ab62229bb0d8300ac6e7e27fa98abdc2579a", "object_relation": "sha256", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865450, "uuid": "e4fd2bd0-c2c6-4674-aec2-1b4a0c40578d", "comment": "Malware payload (Vidar)", "value": "5e4507f0cd7645becd1d7df8f62b7e19a27688c4", "object_relation": "sha1", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865450, "uuid": "a6cb01f2-d935-41a9-9d26-7331b4907900", "comment": "Malware payload (Vidar)", "value": "e60f8806b3ad4248a05df15232882039d6194429377b95416aca3314e75bb167202565f511fe2311b73781e4b12d4a81", "object_relation": "sha3-384", "Tag": [ { "name": "photobookadm-pro", "colour": "#4E322E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779865450, "uuid": "f3bace60-72b3-4bc5-a0a3-ea610f63392a", "value": "T19F9423156BB15BC747907073B8AF463DBB210A9388A8840D32FEE4C65B3F1A4D78B765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779865450, "uuid": "0b7e769f-73a0-4e27-a17a-5a90908d0a26", "value": "12288:Jg2jL/Qxuf9pECOBSe0PTiTBt2i6z4GVE:e2XLf8tnumq4GG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779865450, "uuid": "34327000-83db-4f45-80e2-f58a6f99be29", "value": 429293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779865450, "uuid": "107e9e96-0dcb-45c8-a49f-4664967be1d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779865450, "uuid": "c59a21d3-3e08-4aad-a565-bb0a19d4e619", "value": "photobookadm.pro.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d1f34a-59fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779908517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908517, "uuid": "5873a3e9-8afc-4400-b77e-b9393a2eccc2", "comment": "Malware payload (Mirai)", "value": "e95ef917ea59e147f932366e6815b78c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908517, "uuid": "10809b4f-740a-4f99-9759-84865f973a0c", "comment": "Malware payload (Mirai)", "value": "8ed7d6bef18b368269c33af31e745d67d8d7a7cb0e3cc32baddcc9e3b3009eac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908517, "uuid": "292ff1d4-8adb-404d-9b9e-492b5c83fdf7", "comment": "Malware payload (Mirai)", "value": "7898c53cffea8c5a63f8ccc90d9d239c4d02ab4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908517, "uuid": "df902c8d-49b9-4d6b-8339-b31f95abfced", "comment": "Malware payload (Mirai)", "value": "502921486b223bec52bc608b49e0852e77fbaff25c937d41fcaba57a7dd103ffda51b50c44a4d5a32100f7b5be3260d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908517, "uuid": "5ff0c346-c918-4768-b18e-2b6f845cc00e", "value": "T1B7635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908517, "uuid": "f569d663-f5be-4c6d-a35b-6982b3fc3ddf", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGcfz3WyL35IUfA5PGFjfnP1:zGYxpTGASC4XTfyyLpIoYPsP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779908517, "uuid": "67170b6c-1e53-4285-9ad4-bb75406f4570", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779908517, "uuid": "661536c4-0970-4158-bf82-b289b94dfa7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908517, "uuid": "287c656e-c04e-4eef-a13c-8c7349b6109e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8972e3ae-5976-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779850107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779850107, "uuid": "290bc5ee-d58b-45c5-85b9-3e70418cfeeb", "comment": "Malware payload", "value": "1fc3676e9b6dee2ed1d7dff47a0363a7", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779850107, "uuid": "ceca4735-19a9-4661-8d8a-2688340cf49f", "comment": "Malware payload", "value": "8f28849296f4c10a3271aec35441bc7421be693be966f749cf50120730adb348", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779850107, "uuid": "4f5cc966-07e9-42c7-879a-a583eb288d26", "comment": "Malware payload", "value": "78f49e86cca760ed7b460d398851f5644c3b5176", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779850107, "uuid": "7e068790-6a85-441a-b9d5-5385daa276ae", "comment": "Malware payload", "value": "06bd86b1137373af66a1b845a703397168c7a130544237ca5769cc02ddf12ca3292ab753c9cf3738b08c03885671fc3f", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779850107, "uuid": "853f9966-eba9-48f1-b699-8328c0f3cec2", "value": "T179722889F7F89B67E4AD06B2413683A623B0D2131153EF1F6CC055AC6F233D46356AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779850107, "uuid": "4d666b7f-b081-4d5f-81d6-f3b4a8d46451", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779850107, "uuid": "97cae6cc-ce7e-428d-8045-a767e1964552", "value": "384:drkmQxSdXcMB3uOLXmSCdHcXa7bB9L2RmUPmnaY:d7ZcMN9mSCpj7bvezev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779850107, "uuid": "6e7552d9-7b6a-407d-966d-66bebf3cacd3", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779850107, "uuid": "c1c2005b-982f-45cd-b407-e5259e8b3264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779850107, "uuid": "82bf9f2f-ac3d-40b2-b5d0-3006e7f99723", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe1a763-5971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779848124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779848124, "uuid": "1c209a59-1dda-4b10-b4fa-ba29ae6e7016", "comment": "Malware payload", "value": "e9faa7c1a650bdc41029e7d6a4db02aa", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779848124, "uuid": "342fa668-390d-408b-93fa-33b84fa6cead", "comment": "Malware payload", "value": "8f7a545b607d31b2aa4d18aaba3ac76f79bb48f4420de80330009adad4cff543", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779848124, "uuid": "75e46ef4-cbc5-4ecd-bf74-a879c2fa742f", "comment": "Malware payload", "value": "581bab6aa61520c0661bcae7694ed49750027d66", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779848124, "uuid": "72e4ba26-2ebc-4f10-b89e-3c173e3280e5", "comment": "Malware payload", "value": "70a837454a580b67e980fffea76a6480ee506d8ffbc495602a4611df817f8c93a7074e6f623f26319a14705a3add1632", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779848124, "uuid": "4291b5e3-bed5-416b-a0e4-cea354eed304", "value": "T169E623E994E552E4C8D34E80728E13CD39D0916D49ED6D2D3ADA2C02AF21DEF560EE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779848124, "uuid": "c7497123-2c47-41bd-aa65-637008506a5f", "value": "8a32792ca9671a007e92d5ce958a37ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779848124, "uuid": "fef9dac7-b349-4521-8f4d-15860aa0d3e0", "value": "393216:wH6yt9fMmZwx+2hYPc8/xV0Bi/FrDXLTxduVf+ISy:wH6ycnC+mDHxduUISy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779848124, "uuid": "3027ca25-bc44-4774-b706-5c966e018148", "value": 14041600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779848124, "uuid": "147e3251-4ad6-4446-9e03-0812198fe150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779848124, "uuid": "04e597ef-8c7d-4b91-af38-b5c20fa5a0b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d468f8-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880790, "uuid": "cb3dc1d5-2fb9-4a8c-a8c1-570ca1a19450", "comment": "Malware payload (Mirai)", "value": "f64efca8e4ea312c02b3a0e0bb4bc279", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880790, "uuid": "49cd4049-32a9-46e3-a252-c906632f8f87", "comment": "Malware payload (Mirai)", "value": "90085b3f48965aa41f42d39a2c14ce2235ca6040dffb8b78e4b6ebd04e1a9f33", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880790, "uuid": "70d63e5a-f58c-4a59-ae0b-d64cfb442887", "comment": "Malware payload (Mirai)", "value": "188723cba67cff1f127947a3bcad575b3ebed68e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880790, "uuid": "2599f2f3-a47d-44c0-9bbf-6cbd2b1dae31", "comment": "Malware payload (Mirai)", "value": "020b0be3ddb55389071437809021e40dcb4f7056db8c9546056b1db26b181237131c9ad579aa699fd8367f348ca042e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880790, "uuid": "6bb2e0c8-4581-4695-b6c6-11d9b9f6888f", "value": "T1EA5301E9C8EC7647CA592C3523CD2AE2CA4431D845E98BF4739651CD829129FA739CF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880790, "uuid": "8fc4fb8e-e1e9-44b8-9f32-8bcfc54e4e5f", "value": "768:SkhE5VR5/15NDMGynSlH7/B88cdtk1cB+q4FGh1Ur/+HXG2tqKFHHOJvzJCkyGEb:SSEX1/YGynCaOcB+q4GhY+3dtqKFnOdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880790, "uuid": "a5de6a9d-364a-4f57-8b0a-f02d0c2d15c4", "value": 61972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880790, "uuid": "c3bd0bb7-2754-4b27-9596-cb0cb1203c3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880790, "uuid": "4003722a-5974-48be-8ba9-8dda23ea92d2", "value": "micro.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e58ee74-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878838, "uuid": "e71c1c73-e0f7-4cbd-91be-55ec7e52cc25", "comment": "Malware payload (LummaStealer)", "value": "10272fe0d639c02f0fbff712bae94d70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878838, "uuid": "5edac943-6142-41e9-bfd5-6d7ad6cc6b2c", "comment": "Malware payload (LummaStealer)", "value": "9169eff6b0f7268971ba56ac4fe723bf563f733d58912c3047b7dbf48d4ba56a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878838, "uuid": "6979fa1f-4d0d-4d1a-8897-ab290a32e26c", "comment": "Malware payload (LummaStealer)", "value": "688c5181ae179501ebb8a0c79fe45ff649df2eae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878838, "uuid": "4a9d6832-3a56-4438-931a-0e33e2809a68", "comment": "Malware payload (LummaStealer)", "value": "483014c067927dce9cb99fd954f4bfd402fcf3188310eba32b63171a615aa1151f0703eb7361cd83c63f71d00aa223a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878838, "uuid": "8fbb1119-8cc2-4099-9c0b-950f851ea9e3", "value": "T120748E46E7B748B1E54B0975229FB33F9B2416144328CDDBDFE0CB447A33AE26539A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878838, "uuid": "404a9d8d-158e-4241-9549-bda8c59fc232", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878838, "uuid": "a2c3c214-812e-41d2-8430-f32011bd52dc", "value": "6144:sRLI6zZvCw5/8m5RtUHD2zSnK90dK7KDhAoK4Yeh9bDvJFexs1WX:0Tj50mhUCzSKGPlAoK4YehVvJFeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878838, "uuid": "57a06612-93f0-4ef9-926d-0522fa87530f", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878838, "uuid": "4ea7cf7a-144b-4f92-aabd-5ba15e5494d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878838, "uuid": "3adc964b-d797-4ce8-b4d1-5c0952d6c26a", "value": "9169eff6b0f7268971ba56ac4fe723bf563f733d58912c3047b7dbf48d4ba56a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7473e7-59e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779897731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897731, "uuid": "20c328ce-77de-4430-8d7f-0de96b4af3ec", "comment": "Malware payload", "value": "6d4dce542030685d7206249f15d96d0d", "object_relation": "md5", "Tag": [ { "name": "89-40-206-73", "colour": "#29C15B", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897731, "uuid": "c395e9ca-e7e7-4cd0-b833-2227a12e15e5", "comment": "Malware payload", "value": "9194bc0f0466bc90b469c19d2fadc973e5d438de1975aab66aa3ac9a87d72722", "object_relation": "sha256", "Tag": [ { "name": "89-40-206-73", "colour": "#29C15B", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897731, "uuid": "7e6bc96c-0b41-42cb-985a-979ac4057d51", "comment": "Malware payload", "value": "a0f7d098f785a83981996cb79c6e6b7543974e55", "object_relation": "sha1", "Tag": [ { "name": "89-40-206-73", "colour": "#29C15B", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897731, "uuid": "53c4b1b6-3a60-465d-bff4-2c7cf3a46bfa", "comment": "Malware payload", "value": "34a2d2f0f8f7ca0ec712b628c6452b2d6dd2afa6e016a77bacaa4ab3275ccc58e3622c7015360a31c8ed4a8fb457bc3f", "object_relation": "sha3-384", "Tag": [ { "name": "89-40-206-73", "colour": "#29C15B", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897731, "uuid": "ed6e6696-769b-41e9-8ed8-63e73b42cc98", "value": "T19664238BFDDE4DEC40629DB95955B4CC5C43BB40AF5E90CA30512CA08B19B6F3BD9D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897731, "uuid": "575b6c93-e938-41fa-81d0-ab18dd953139", "value": "6144:UON5SfBp/yrQCWkYOEHDUBvkITpQh21tt+LK/9wcQNwNjcL5YxUKR/:afTCWkPEHyvNQk1tX9LQNwwYWKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779897731, "uuid": "109e7f49-7ea9-4784-8d88-994df16aff60", "value": 313164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779897731, "uuid": "1ca6510c-4192-410b-8cd1-e7f82d4b90de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897731, "uuid": "ababb978-f919-47bd-b3e8-3a662d3f9334", "value": "HVKCORULAVIWNLIJWOAT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c809f837-5a00-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779909482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909482, "uuid": "8166e03d-cab6-4554-a9be-32b00501a873", "comment": "Malware payload", "value": "4a02b8c734242830c6af2d38902a1999", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909482, "uuid": "45ad524d-d795-4af8-ad41-b35c47ed901f", "comment": "Malware payload", "value": "9195cb507e53425a808fc27d3579426b9cf6b70ba2af060ddba36537183e8fe5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909482, "uuid": "df0e0775-35a8-475e-b28e-14e0aebe1a45", "comment": "Malware payload", "value": "1434984a19095413e67064316c2ab7166de86ec3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909482, "uuid": "098c7bed-13dd-4a80-808d-8332dfda2514", "comment": "Malware payload", "value": "120e10bda4b64101b0dad7d2c02f301683002486309a3e71ddf7689a53e6b377f623f51897d518c6449e4a83ca54bd6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909482, "uuid": "de23e475-39d0-4715-871c-55abcffbdaed", "value": "T1E1734B89F7C3E0F4DD070571106BB77E8734DE525124DE6ADB94BEB2AD32B12A11A22C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909482, "uuid": "9356245a-fe7a-418e-a7fa-f52b75552109", "value": "1536:KeqjDqTKnbT5we8PRXo+QlBMXU931fMY1ii6UaGGr:8vqebT5we/+y7iF6DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779909482, "uuid": "063b8104-744b-492f-ad22-577f7a5e712b", "value": 78632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779909482, "uuid": "3591db64-261d-4628-9cc1-83dbe8ec86ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909482, "uuid": "b5224da5-a6ed-4099-b335-a73401065917", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0967523-5994-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779863084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863084, "uuid": "0a26dfff-57e8-4c2a-8cd5-72c4b9600799", "comment": "Malware payload (Gafgyt)", "value": "1786c39fedaa06a7868a7d10b5957b06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863084, "uuid": "ded12e47-2df3-4999-b654-a69053708619", "comment": "Malware payload (Gafgyt)", "value": "9314ebc0a472490f8f5323d86ce92b78bc1486a4c48b26a9f24f2210a93da4f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863084, "uuid": "fe29c2af-3744-4c14-a5d8-d48169df192d", "comment": "Malware payload (Gafgyt)", "value": "30db4f5315fb6ea23b90d3f16b6bbbe4ece54122", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863084, "uuid": "85de7365-f5d7-40af-9468-d27b8da9991b", "comment": "Malware payload (Gafgyt)", "value": "60987724806c799e213b9f5d8c343fa6e69d6d0457ffb52a8019fc7b71c03595769cc9f4a163a11bbb8a5c060dfd8569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863084, "uuid": "bca88ab1-7595-450f-9ffc-0da35cbbc214", "value": "T1D7E31802770D0F43D1633DF0273B2BE1939AFD9229B4A684751EBEC99271DB22146ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863084, "uuid": "59eef757-1c57-468d-8913-15f0cbfe98b8", "value": "1536:kV0Dqs68zu4xbIE5iUv9lvmMtDM9zCF/B14++jjvA/5G1MxRTuB8j2qwxQ7W:4s6l4xcEp3jFM96/wI/e2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779863084, "uuid": "c67b9094-e71b-4148-b632-a14d2b230323", "value": 147240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779863084, "uuid": "5c35f22b-2389-4c8a-9324-2a61cba8446b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863084, "uuid": "e580a7ff-c551-4e39-a39b-186919f6008e", "value": "wife.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d930b6a6-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911659, "uuid": "cd6eeb07-8ca3-4706-9640-73f190e8839e", "comment": "Malware payload (Mirai)", "value": "b05ddab8c1b498b4d69a6e3066239745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911659, "uuid": "c690a573-34da-4e5a-ae2b-768d9df97797", "comment": "Malware payload (Mirai)", "value": "932a7a02eb3c942ccf393142af833392222039b6fa2477804f55dae844093ccb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911659, "uuid": "f2a10b8d-3c9f-42cf-9617-bbc4dc5008b6", "comment": "Malware payload (Mirai)", "value": "c8a8edccfa2a0ea54c0ecf2e98a907bba51f1817", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911659, "uuid": "300572ce-6d2b-4331-b78f-14d7eafa05a0", "comment": "Malware payload (Mirai)", "value": "98122598d2bcba984d21622aa6309925cfdae61979904584b064aee06bb4ce0502c1f030d900278f4010accf95c59da8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911659, "uuid": "a272f4e1-0719-44a1-b11b-e21b7459ed99", "value": "T1DB33F1B599169AD0EBB3FB630D8FDFA4BB211AD5F35BC7858246AB4024670B43214FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911659, "uuid": "eb7de0a9-086c-43ef-85df-e6449cdf4758", "value": "1536:FVaoF8CDX+KpdO7URfCYerKAa5UKFu/AjINniE4u+qgw09A:/aovZsIRfoPaaKYaYh4u+qgwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911659, "uuid": "0024f634-91fc-410a-b32d-74d8331eb2c1", "value": 53116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911659, "uuid": "8c3fe21b-bdac-4b8e-819e-3a8ec3827bf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911659, "uuid": "6a16729f-fa6d-46b2-b7a0-64cc85fc8d29", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db550b43-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911662, "uuid": "1b9260c6-f9a0-459a-937c-58ea7afa2bb7", "comment": "Malware payload (Mirai)", "value": "1ded43fa8a929db823b10bc8a978232a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911662, "uuid": "c04b4c57-c528-4e25-8820-290f83c08035", "comment": "Malware payload (Mirai)", "value": "947b58d9c15da2902b895a62708eed76b43e203b58f4597f7b9802a6342f6dfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911662, "uuid": "6c116c11-eea5-4bf0-bd1d-9b1fc2243afd", "comment": "Malware payload (Mirai)", "value": "f54bee0c736dae7d87087b05241a5770d352f151", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911662, "uuid": "ab1686c9-99f4-47f5-8964-e1f58b98ef26", "comment": "Malware payload (Mirai)", "value": "eb198e4ab1ab7b4b062057a5cccb3a70307f0a337ae0c9bd9e6e4c42d62ab9da3e2ca1d49925cb0e7f65666c2860661d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911662, "uuid": "ef56ec57-5b13-4925-9f85-fb0fd0290d94", "value": "T121043BC7F901D9BEF80BE77648170915B630B7E210924B337257796BEC3A0991927ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911662, "uuid": "fd854568-7d48-4315-a2e7-1e61b019d50d", "value": "3072:BptxBkT/sc9UcMmm+PD64K39U2VXgVijbi0LoaAS8yY0p1uh/FEkf:3txBkT/scm+PDFKNtVXPLayYYJkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911662, "uuid": "ec6a5898-48d4-4e23-85cd-99b0bd00579c", "value": 175744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911662, "uuid": "0c89c160-a989-4a9f-b322-537e36a470e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911662, "uuid": "baa0bfb6-b1b6-4840-a685-fe5491203647", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8995d547-5969-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779844523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779844523, "uuid": "9e207b23-8d42-4a24-a518-a77f5e69ebc3", "comment": "Malware payload (WannaCry)", "value": "78445df5f351d3986f1e709dd0eed2a0", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779844523, "uuid": "c5af0923-ff90-4023-9dc0-a95da5fe8e48", "comment": "Malware payload (WannaCry)", "value": "9487edf9b75f4c15e3ba6ccbae23588ee3dc9c4983417f1b469278af17fc3847", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779844523, "uuid": "bd792a1f-9280-4377-abc9-412d911b6790", "comment": "Malware payload (WannaCry)", "value": "1c630f9ff2c59d8134db8895454f18868e97a595", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779844523, "uuid": "3e807217-78fc-4040-9aeb-9bc1d1953498", "comment": "Malware payload (WannaCry)", "value": "d7921fbbf8ea483406541d120f6e98a68893b937571594eb92ba34227be7d97711251e550c5fd898578fe37fb711b86c", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779844523, "uuid": "bc173f31-7b99-4b35-8841-00a9e01ce053", "value": "T1D736239971BC81FCD106157484BB8E22E3B37C6926FA5B0F9B40857A1E13B46FB60B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779844523, "uuid": "2b71e7e8-da6d-4f02-911b-0c1915fc9ef8", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779844523, "uuid": "addddb53-acbf-497d-ae68-abece50524f1", "value": "49152:jnsnnMSPbcKQej/1Iix+TSqTdX1HkQo6SAARdhnv:DMnPouz1bxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779844523, "uuid": "ca3b37ab-015f-4ae7-8d4e-6aa49f730872", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779844523, "uuid": "dcb596d8-370e-4d80-9523-5b5fe50c689d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779844523, "uuid": "fa00af80-7584-4270-a834-411c457367fe", "value": "9487edf9b75f4c15e3ba6ccbae23588ee3dc9c4983417f1b469278af17fc3847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17cea82f-5999-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779864948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864948, "uuid": "e3d97e21-7d44-46eb-9a94-ae4e91a527cc", "comment": "Malware payload (AgentTesla)", "value": "4e4895a29510adeb5965db75a2b10ceb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864948, "uuid": "4312f610-6336-49ed-93ef-d4980634d6e4", "comment": "Malware payload (AgentTesla)", "value": "95cb211a7db0f30ab7f2f91bd1c3aeb6d57402a12c91832f224dcd9949ff123b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864948, "uuid": "74aa67ed-2297-4007-98b1-2cd77c2fd197", "comment": "Malware payload (AgentTesla)", "value": "d58d49318d23c37bfe98bc8d26356feae1f02a85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864948, "uuid": "71217043-53ab-4d3d-878b-7594c869b508", "comment": "Malware payload (AgentTesla)", "value": "010ad085a26e54e4e36234605dbbb37a07fc6cd3071d11c3409b7a37ff86f26b1dd1a01ed0502d27953ee496d1a65808", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864948, "uuid": "d0b83a93-ff11-4ac2-b5dc-b679b577b30f", "value": "T1340619018657E8709A7DC71CE436A762051E300392B9EF3D35A8A2387B93D97A74F5E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864948, "uuid": "34bab031-c92c-4706-aa18-d3857288e390", "value": "98304:jjyq7XGyLFeAkuThbYSL3OR8+YI8OnU7jox+qCQ+GJvJtVIgdhB1g0QTYxGmjIQQ:77WyLFvThhYXZLNJTLg0smjT1wJ1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779864948, "uuid": "8b7754c4-dde4-4116-a1f4-07cc666b4c3c", "value": 3944922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779864948, "uuid": "9458118f-4fd4-49d5-aa02-c4a9e4838119", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864948, "uuid": "95e116f1-bc46-467a-b35b-c155d447966b", "value": "BL.PL-270526.0000012921.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbf0aff-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911665, "uuid": "f66aea36-d544-4ad4-9bcb-96e68042de1a", "comment": "Malware payload (Mirai)", "value": "9727bb34a4fd309df810046a23cfa214", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911665, "uuid": "a4341260-f10e-4f02-97f2-f7bee6134834", "comment": "Malware payload (Mirai)", "value": "96f16cd9d2a2856bb9f5fde943bec0a6f692d197390a8d1e982b32207475163f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911665, "uuid": "988157d4-b9d1-4182-9ad7-37544ae5cd60", "comment": "Malware payload (Mirai)", "value": "7ef25bd02da1b80620e23ce00692b98c30e1aa45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911665, "uuid": "a2e36b0e-07d7-4ebd-be4f-bef896110d85", "comment": "Malware payload (Mirai)", "value": "6851460c2d6a8b3aae41998641afee89c9a098e3bcf276f9d4cc3d193241a96050e15006474acc1b2c4efac27989c625", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911665, "uuid": "c7d3eddc-2ef0-451a-a004-1a44ea7d92bd", "value": "T124D37B73D8256E98C625C5B4B0648F782F43D1A881436FBE69B7C2B05487D8DF609BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911665, "uuid": "f029ff75-e5d0-4feb-8a30-ea80f547655e", "value": "3072:QOuckx3SPfcjjNr/qDhTdDWIZ19K6hh1Lab6:QOucl0jNri9dSIP9dab6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911665, "uuid": "181e5f85-a9c9-4fb0-991e-65515301c92c", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911665, "uuid": "02f581be-6653-4aa3-95d5-c67e76d25a4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911665, "uuid": "c8b85044-ad93-44ff-9964-a2746bcc3bad", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bf0ae0-596f-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779847067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779847067, "uuid": "bdc05d63-e7f1-4a64-b994-a8e3386d09b9", "comment": "Malware payload (Prometei)", "value": "58e0ead7cc947a7467d5c2bd5e924763", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779847067, "uuid": "9fb8a999-2292-4f6e-9e76-dc36c18e32f0", "comment": "Malware payload (Prometei)", "value": "983dae596526b4a4726804450561656449c1366bcbe9e2268b0928386ba14475", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779847067, "uuid": "7f91eb7b-5e3c-45ec-bf14-eeb738763ddd", "comment": "Malware payload (Prometei)", "value": "d56b8b88d5f995e4666381425f1e8ba8fa13a759", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779847067, "uuid": "9f00f3a4-8bbe-461e-8af2-508fa8af8869", "comment": "Malware payload (Prometei)", "value": "7ca9c504b2903bb3b6bf0cfdddbdaf512a7404a99b75d9a677337a11bf61cbce29e1ee0a8e0c80e876b671ac59c88972", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779847067, "uuid": "5e9d6f39-fcf4-4b7c-a746-304637867dec", "value": "T17F05238538536775E605FD2A834EBBF6304098AB911630942C86E7F4FB7E5FF8919A03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779847067, "uuid": "24b515dc-8d4b-430f-b331-bbf839fedb75", "value": "24576:rn3RAqko5EOVj48pYSM9dAtD3cJQGbfxdKVGx:zRAq9Zj8SmdMD3iQ8fxdKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779847067, "uuid": "b24a3d86-18e6-4eb3-8f5e-f424f3cf5de3", "value": 800000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779847067, "uuid": "2cd78618-f7ac-477f-910e-f038a0158d1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779847067, "uuid": "0bc2eafd-388e-4519-90ab-658685bd1d87", "value": "983dae596526b4a4726804450561656449c1366bcbe9e2268b0928386ba14475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdb12be-5994-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779863083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863083, "uuid": "82a0e4ba-d5f3-48e1-8a16-a061c12ac0ae", "comment": "Malware payload (Gafgyt)", "value": "c4f943a17a6942e866387af863459733", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863083, "uuid": "e776aedb-c2bc-4bd4-a26d-fdf8f92ff09b", "comment": "Malware payload (Gafgyt)", "value": "98d6278d24cb86e4b141aee1551b13fcfcea1321545837518d64241c2f5aa8f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863083, "uuid": "e7bf2d66-d2dd-40d4-8352-fe0023386448", "comment": "Malware payload (Gafgyt)", "value": "17c38b8e86851452e02d4e43f3736e5e8b89ab81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863083, "uuid": "ffd76940-8e40-42cc-8d00-12ca6f8f3afa", "comment": "Malware payload (Gafgyt)", "value": "5a39c47b314bfc4936c3bf04321b02a334201408d83fcad9ba74ba5dcdda957a250b504a7634785ae5934bf4ced071a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863083, "uuid": "2aed5bd2-a0ad-4493-88ff-92e7d80ffad9", "value": "T1DCD32863ED269F1AC527A0F0A2F18F342F52FD2649471EBAA466EAE44143DCCF1057B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863083, "uuid": "3fe17840-6854-4975-9aa8-83e9cf0f04b4", "value": "1536:IrGD0G/LhCdDKm1vh7JTGM+Z7qOyawWr9VK5QmdyIK:kGfLhEmm7MM+Z3NwWZQDsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779863083, "uuid": "f91d02a8-9cd1-41fc-8d6d-9ab037da9c7b", "value": 130780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779863083, "uuid": "023965ba-b6fb-4ccc-a9a7-7d9f865be756", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863083, "uuid": "af0fc1cd-72e0-4ee1-bc4e-bae9f276d93f", "value": "wife.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabe0d62-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880791, "uuid": "4a7ae734-e1d0-4319-b2fa-6b54596c9ec9", "comment": "Malware payload (Mirai)", "value": "190def9feca971d63c4c0b3cdaa5bcd7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880791, "uuid": "670c5b25-7823-4d3d-baf1-8885a6790c2c", "comment": "Malware payload (Mirai)", "value": "9936762332aaf087ab863a29e617cb711476a373dd34352f3f06ba7a96a385e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880791, "uuid": "e025a4d2-520d-4bde-8263-d6c9a9047cf2", "comment": "Malware payload (Mirai)", "value": "6fd7128ef2dde38e2748b34a8eb37070a5ce1441", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880791, "uuid": "e79afdd5-f0a1-4764-b5d9-fbbb3da1656e", "comment": "Malware payload (Mirai)", "value": "346e6bf152139c36789ac20e6f26e461bd9f6900ff124179a95d3742d5b09a0e95a90c3673c439028d2ab16abed8da80", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880791, "uuid": "708cbf74-bf76-496e-bbc4-8106a39d538b", "value": "T15743F132D235607AD4A7DBBE851284C2FFBB4C473B10965159E442FFB9BF0A10DE1A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880791, "uuid": "3bbca92a-812f-466d-ba92-f6ce91f8e067", "value": "768:vkQ8ocGDNiKzG9rVf21fDBS3bsCc2iI3OVJVvtY/pi572uTLYRQjLFij8vxi3TBf:vkQ/9iKqFRWdI3e1YxMyRQlzE9UI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880791, "uuid": "297dce8d-6c23-4f28-b070-7a054be8c0bb", "value": 58536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880791, "uuid": "12ef5b6d-8f73-49a1-8f77-331ab9b3ff0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880791, "uuid": "e540ca10-2340-40d0-ab2b-1822782a3d01", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1c3814-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913757, "uuid": "5cd16f57-c530-4348-af5f-340faa763e65", "comment": "Malware payload (Mirai)", "value": "2258673558d836b7ef71860865256dbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913757, "uuid": "cdf2dd31-01e0-438b-ab84-9cdfe963cf25", "comment": "Malware payload (Mirai)", "value": "99e31cea9228ad18ecfc145c0fe7d168634657b004045d765341a46d26b08224", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913757, "uuid": "903f8f8b-b149-4587-a535-7a901294ce05", "comment": "Malware payload (Mirai)", "value": "b9f0d5ed3dad8ff6701ce209f85be4aaad79ebf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913757, "uuid": "ed56faf5-f4d2-407e-a7e2-1abd5f1f18a2", "comment": "Malware payload (Mirai)", "value": "1d95d0588e695b209a122ad46aa6ea95d5b07cdceca426f27d56b0fb0bc8b0c717d7f4358e6cf0fc39cc21ec839e28c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913757, "uuid": "ce7e10b9-2acc-4cc2-85a8-7a091496b3a4", "value": "T1F173930ABF215FB7D8AFDC3745A61B4525CC641A21A97B397E34D828F60E24F19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913757, "uuid": "7468a30c-7b82-4952-bce4-c21f86b5ed5b", "value": "768:3R92dQEYlDoxrPAxsFgnculawLX3U61oQN6PNgY/C5SSeQe1qeZnPoNdpkz/6XiJ:3R92d9Yli7wwhQwPpCtRoqenFr5ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913757, "uuid": "9cacce7b-49f2-46ea-8c51-873bb2a51f44", "value": 75624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913757, "uuid": "b68b2db1-76de-4161-b2ba-cbe01a8fa690", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913757, "uuid": "dade1240-f439-43cd-99d9-1c12f7d2bfaa", "value": "Akiru.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1016c499-5a01-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779909603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909603, "uuid": "f095ff89-7bb9-4f1c-bbec-a310c8d61977", "comment": "Malware payload (Mirai)", "value": "68f53c752530e87f383a77876b4d84f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909603, "uuid": "41e5df3a-3dbd-4a39-9c31-2ff9e0fe529f", "comment": "Malware payload (Mirai)", "value": "99eacd0d28bda2f6c906bf642d42aea8b308d2ca6a2329fabb93e18db565447c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909603, "uuid": "6ae467c5-d99e-404f-b1c1-c7291eecb445", "comment": "Malware payload (Mirai)", "value": "43b88b9ab0677bad97b6961be7ed0da960340b02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779909603, "uuid": "798a949e-690d-415c-bafc-16774228beb8", "comment": "Malware payload (Mirai)", "value": "0aafdea3a4c3b6bfef65f5b63a82b75334a34457789940175db121460658a5e2c8cdb90665f60ba2779848700902ecbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909603, "uuid": "13a0dfa9-5e3f-404a-b2f4-a6d79546c18f", "value": "T187055C06BFC16FBBC46FCD30492EC30600DDD89796D5662A71FC8A8CBA9D2590BD7588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909603, "uuid": "5e246a44-a91b-4b91-a1dd-5cbb96f011e1", "value": "12288:+b744XvNsQz3pqT4LHj1xGOd57Ha4m9+kEN+jDPTfVN1YDejDZSMm7rNQ3Fu0pBf:Wzpj1xfkHfnu336I6SnCJB3QhJ8Cob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779909603, "uuid": "91c13096-e811-495e-a92b-3991a0ddbaf1", "value": 837964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779909603, "uuid": "30fd9ba7-1a42-4a82-a509-44cac1643a87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779909603, "uuid": "8fc1caa8-3e1c-4ede-adf8-87ce7e9b243c", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bae28bf-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779881007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881007, "uuid": "fae065a2-363f-4548-9130-ec5a60d2ec75", "comment": "Malware payload (Mirai)", "value": "3e9821c728f74c26783e8654171f38b6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881007, "uuid": "a550cd7b-05dc-4477-a761-deced9a7890f", "comment": "Malware payload (Mirai)", "value": "9a4e8f26487d7c1c2727e3843056869a861e16a15314e104009179b7d2196bc5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881007, "uuid": "3d314f7d-b091-418b-9449-e72a20516394", "comment": "Malware payload (Mirai)", "value": "c910eac13eaadc5ce79c119236b01b3fe346458d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881007, "uuid": "12a505e7-fd2d-4bc4-a520-8c57454b19c5", "comment": "Malware payload (Mirai)", "value": "e0dab3db78b0d18a35aa0457b4e7c0435d87c4b250d08f6cf995bcf4a21967cf50a5e90cf9a434d9719b3342f9f26561", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881007, "uuid": "ade7dedf-3c7f-436d-a5a8-e25e274573b1", "value": "T16FD47E6DFF4E3C42E3CBE3389B4993E0632B75E1D32392A23942021C95D6ED9CBA1551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881007, "uuid": "1b2d1a81-a3ee-4f70-abba-b4d1695b2081", "value": "12288:zTGRhN9i+nB513F6IJtF9mqmM9c+4gYn54x/mAq:CW+X9DQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881007, "uuid": "f779b3ee-45d5-4c9d-be31-de3d8b6b76e8", "value": 608704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881007, "uuid": "4bdd3f40-74d3-445e-8e69-e9c59fee17f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881007, "uuid": "634dd865-e906-434b-a82a-2a95a8776c3f", "value": "bot_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b540b8b7-59e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779898713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898713, "uuid": "59006dc8-e497-4e6e-a5ac-9d4c73c13d9c", "comment": "Malware payload (Mirai)", "value": "00500e0c53c01035d5bdcedad6bc49ae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898713, "uuid": "820b3170-78db-45dd-8415-9cdd4471992c", "comment": "Malware payload (Mirai)", "value": "9a58ba76e3bf79104b90d4d93d8af4baee31764084533b98fa9f5a2436834ad1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898713, "uuid": "ec78c6a1-9e2b-4374-80c2-3475090a0ed8", "comment": "Malware payload (Mirai)", "value": "d8f9ceec2273ba1162734d8871faf5c932ae9fd5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898713, "uuid": "ff57d28b-88e3-4569-9b55-01898bb22d70", "comment": "Malware payload (Mirai)", "value": "3457b95ff069eaa493a6cd4db8efa09b7520b4cc9d55c857a3e242ba32343c4eea7d6addcc3a8a2bf184c0864fdead54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898713, "uuid": "619b4dd5-ff79-4ac8-838d-725164945a0a", "value": "T1DF140806AF510FBBD86FDD7302E90A0134CCB81726A53B757674E928F64A58B09E3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898713, "uuid": "f42d3304-db5a-43e6-963d-283fa40cb076", "value": "3072:7HiSCUasBYarUj3U3OH93Nq+FyVzI2DY:7CSCdsTYN93NDyVzI2DY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779898713, "uuid": "c8d11d58-a1e9-41b4-a846-c7d8ed3487a7", "value": 199872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779898713, "uuid": "a304cc3a-cf34-4863-b0d4-1e999aada453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898713, "uuid": "59639a38-1e79-4024-bb0e-b3e4a4330370", "value": "nova.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46c886b-59da-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779893128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893128, "uuid": "e57dd6be-49ba-4fc4-94a7-042b87334bf9", "comment": "Malware payload (AgentTesla)", "value": "726a62d7c7150f772bff314e080437dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893128, "uuid": "62197e5c-8b7d-4b37-821c-76cb0afd475e", "comment": "Malware payload (AgentTesla)", "value": "9a69ad1b616d4cd2d475b2d4ddf98f3446ea9da715cb1ec7ac263c1f853eeae1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893128, "uuid": "faa125aa-f2d9-406d-9cf3-29e7e092a398", "comment": "Malware payload (AgentTesla)", "value": "f339e5f4edde2d5ee7bbaa9f897bc9c94ff3b138", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893128, "uuid": "0644b992-1192-45ba-9641-6f3e0d075ad2", "comment": "Malware payload (AgentTesla)", "value": "28f8631db438cffcd05fc774d17b65f1d738ad6dc7613e7b95d7f4628c94dba5d7e451c7444bef94d60e72de4e4d4e3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893128, "uuid": "0b1d4d47-b3a9-44f1-b5d7-f6bba94b5de2", "value": "T14BB5BE09E3C81AE9D527DA38CB059333D2B1B8524762E18F0AA9D7061F77A918F3F715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893128, "uuid": "05427643-a5a4-4dd3-a4c9-25c5af480777", "value": "43b8601e82f11faa2d49719652771de1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893128, "uuid": "f116a8aa-01cf-40b7-9d73-651f41fee11e", "value": "49152:ljG8mvrRC8cZvKuxyvWupHp/w/yr+qv2MPj6HclQlil4h:1a8SuYplr+qv2MPj6HclQlil4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779893128, "uuid": "eab4865e-f385-4961-9f7a-89d1e4ca2bf2", "value": 2469888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779893128, "uuid": "d3718d84-ba0a-4373-9231-8cfbc0cffa34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893128, "uuid": "cb8e2cff-230b-4de5-b54f-96fd7463fa56", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799bd265-59ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779886158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886158, "uuid": "05561696-4279-4826-81e9-43c2bb96a2d8", "comment": "Malware payload (Mirai)", "value": "047dc9f11c7f47a827212957aabe1ed5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886158, "uuid": "8b37a292-64e8-4320-8682-ae6e903bdd25", "comment": "Malware payload (Mirai)", "value": "9a7e18bccab0b0b8fe3dbc1ab173e263a720f2ea418fd84a853aa7765b0f6026", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886158, "uuid": "d4e6708e-c2f5-452b-bf66-19d7d14bf6d9", "comment": "Malware payload (Mirai)", "value": "ba21e020cea4b8a4aa2c48556c900365b71ef842", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886158, "uuid": "e5d79f9b-deb5-4c19-90f9-205c792a7c36", "comment": "Malware payload (Mirai)", "value": "c0055424d689345eb37ba90bb383bbd84471a92cf0b45d3cfa1e6691cb4041d2125ac6ef6bbf00ee507329527c477b6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886158, "uuid": "7c8694b3-45af-4671-83d3-3aa08640584b", "value": "T184363A57ECA551E9C0EE923086629253BA717C485F3523D32F60F7782F76BD0AAB9304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886158, "uuid": "38bbd455-3ab5-49a1-97fb-becfb56cc5cb", "value": "49152:XTNTSB1n6vt1FMqAha/STqBv8fP4hbSDf/Y5Ep1gC1OjAzmxqJ:DN3N0hD7fP4trEpTz8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779886158, "uuid": "bb9d83b4-39b1-4dd2-acaa-445a299e42d1", "value": 5050520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779886158, "uuid": "17490ee8-beae-4653-a9ad-72db581037fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886158, "uuid": "55df53dc-8383-4950-9704-d60cc5cc956d", "value": "9a7e18bccab0b0b8fe3dbc1ab173e263a720f2ea418fd84a853aa7765b0f6026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47aeca97-59ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873619, "uuid": "464140cf-b262-4949-b1b0-8ca2b6555fb7", "comment": "Malware payload", "value": "3e98dc4ee39948b36844cb67128b66ac", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873619, "uuid": "3c5f809e-243c-43c9-8202-3faffb81dc15", "comment": "Malware payload", "value": "9ae7b9875bd058460def0c5868a8a99a5782493aaf0e565a8305a5a9633cd96c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873619, "uuid": "5f5ae20a-f804-407d-919b-a72a54c1f5d6", "comment": "Malware payload", "value": "bc37520709c7cb7ed2edd1f8ab86abfec194d51a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873619, "uuid": "62db7e5e-c143-456f-b609-84a7fa804373", "comment": "Malware payload", "value": "9786c141d5a3297a2065ba7316b85eac26e287c0b9a3deb97216d93814300f22554f5452b13b5eef0b6192d467b43613", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873619, "uuid": "30b963ed-2257-4c8a-9f6f-283b51f10913", "value": "T16BE07D2BC42CF0A7D0525234474A8711825E7007B9493E0B9F9557043444C41CE67BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873619, "uuid": "74f8c4cf-dd82-4afd-837f-558d20c55dfb", "value": "6:5jHUMSgkrxf0P/K8pyxqDKb6Kr7PpCdXNDuMhM87CzTxy7qItlktSgkrxy/+lk/:5j8gQf2/K8piqKDr7PpKikM87Cnxy98d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873619, "uuid": "4fc99e41-4714-4abd-8b0c-7b1bed880363", "value": 348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873619, "uuid": "54d3c6d3-c7d0-4944-9b47-f178a103ce58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873619, "uuid": "730a7837-8252-4d47-a132-9ce2ce592edf", "value": "9ae7b9875bd058460def0c5868a8a99a5782493aaf0e565a8305a5a9633cd96c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59288ef6-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924758, "uuid": "8ebf6e4d-15af-40b5-b90a-65a12d97aa0b", "comment": "Malware payload (Mirai)", "value": "7de63639d1c73156a48a539f09e34637", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924758, "uuid": "6791f9c5-5b2c-489c-acb9-028f0602136c", "comment": "Malware payload (Mirai)", "value": "9b1a0e82d4b1f594292d30a01a9b76f2d2c1a6164ed042cf83d2e51fae6eef9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924758, "uuid": "a77dc0c9-5096-4c79-9a3a-82cdf9776614", "comment": "Malware payload (Mirai)", "value": "5600387f2934f89d6543eb00c4d1e9e06017855c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924758, "uuid": "36b99b0d-2266-469c-b55c-b93378a24f38", "comment": "Malware payload (Mirai)", "value": "0f8ce7ffc493583d7598550634bcf128be20a911c40d4e3908e8ff63da86ea3ffa65097e8edbe33938b807568aab5881", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924758, "uuid": "b93c930c-5793-49c4-a030-5428a33e6226", "value": "T1CFD32A06730C0A47D2632EB03A3F67D197AF9AC121E4F640355FAB8A95B1E335586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924758, "uuid": "b4ed5c0b-dd8e-4b28-89b0-4e1652b99ebd", "value": "1536:troGHNTUZNHlIBUiCxfytmtewMDNna/w4o7lbEJvAhh3rp+JuQfqAg87k3p:3mWUiCxttqCwZ7lLhrIQ3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924758, "uuid": "610a0102-6bf3-4d4d-ba4d-16561ad29ceb", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924758, "uuid": "ea863593-8ac0-41c8-9018-6d9dd299daaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924758, "uuid": "f70f25c2-63a4-40b9-8e84-3933fdbe2b71", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae39b9b1-59a7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779871214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871214, "uuid": "f9581e18-b51a-4913-9c90-4f7ae178e2f5", "comment": "Malware payload", "value": "33438ddd8d93f07a380fca16205f400c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871214, "uuid": "0baca891-9890-4155-8c14-53a6274353d8", "comment": "Malware payload", "value": "9c4f62b69acc90d7feb2a52dfeefbaef7da6a2d09b257fcebca94654f2c8ecde", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871214, "uuid": "e538a7e3-ab10-4742-a01d-c9e900268838", "comment": "Malware payload", "value": "85b6ceee5b26e92a28d68850599c76a9c9197987", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871214, "uuid": "1654d3d3-1e80-420d-8830-ee1891c4d890", "comment": "Malware payload", "value": "7f194680a4cf5d45afd459cf40ebcae055a1358ff803ba24fa0c7cefce630a7943c2cccb3965cff2097bbbcda521ef97", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871214, "uuid": "fb12f0e4-e740-4bdb-a592-b513225fa635", "value": "T1EED31214F7AC2DA4361A86306A105FBB331611FD66B650BD0E14E4FE0F68E9D7BBD221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871214, "uuid": "414770fd-2aae-42d5-bfde-505e018d1ee6", "value": "3072:vEaWR/cdMHKGKV2u0b+52hYWkdqCneqAQrm04ISgvghuw:v949HKGK2Ah1qCeqAoR4gvQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779871214, "uuid": "80c6aac2-9d34-4794-92ca-dc2a41a44abc", "value": 133361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779871214, "uuid": "b3d4648a-3604-45bf-bbce-86388c7d1678", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871214, "uuid": "864a653c-796c-461b-8cfe-7928f8466309", "value": "Product List For Earthing System.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152ebe86-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779911330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911330, "uuid": "55a67602-01e8-4c16-a679-48d20a28200b", "comment": "Malware payload", "value": "2fc77dd03197d7f1a0ef1bb3ad62f3d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911330, "uuid": "aece278b-c4d7-4130-b72d-7864cf8788c8", "comment": "Malware payload", "value": "9def647eeb647a3ca85416ccfd2da4864f72cb6585677570e02911f34f642944", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911330, "uuid": "71d9fecf-6686-483a-b0fc-470a3ecd115f", "comment": "Malware payload", "value": "e40cc2a27dfabf09bc80848dfc8f4d01817bcc98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911330, "uuid": "46be2bb8-46e3-4365-ad59-d4ac5b3cfe08", "comment": "Malware payload", "value": "37d4338b553071ade8dfd1e2ab86b73c111ef725dc6275ff90c57122a8c6dda2f49e3d6a5aeac7f4ca78067c444e1d4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "minneapolisseor-com", "colour": "#4F572D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911330, "uuid": "ffc66ec2-b8fe-400c-959c-025afdf88177", "value": "T11BA402ADA8E323BCD8F7E236A6573192FAFBB44455309E2BC365D1312436E60052EF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911330, "uuid": "7caaefed-eeaf-46bb-8af0-6aa5e2a0ab6d", "value": "101e9da62927c83ffbe9363e7b60b054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911330, "uuid": "19aa0ac2-5ab8-445c-83c6-531912c49c12", "value": "12288:wUR8mbmFSmZ4KrtVdXFmdaoJy8blouFRom:HR8mbmFSY445AjVbloyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911330, "uuid": "11309ce5-c12d-4bfc-95af-404219cebcad", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911330, "uuid": "cd2ed128-be11-4b17-abde-d2b45149d7ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911330, "uuid": "dada1265-1b6c-4446-916a-2eee1bbb1e49", "value": "accelerator_b59c94.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfe5c9e-59ce-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779887722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887722, "uuid": "b00d6284-f964-4956-9c09-b7504202a526", "comment": "Malware payload (WannaCry)", "value": "2fd4eac3d9036ec1c41a44c761a9d44a", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887722, "uuid": "3d636ae9-282e-4130-b9d3-d932440bee08", "comment": "Malware payload (WannaCry)", "value": "9e0e61dfd8783dce6bde57af2ad4c892f481149426b229ecfe20242ae6b88974", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887722, "uuid": "2a32d411-454a-4552-8dce-65cfb0823ef8", "comment": "Malware payload (WannaCry)", "value": "9e395fb0dd2d0a44634a8b6ab4004193ca14a5b5", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887722, "uuid": "f520d5eb-d8df-4ac3-a522-854007a9250c", "comment": "Malware payload (WannaCry)", "value": "0cbd91f6b3224746ace76e8c475ce5642d38bccd7e71d1e9d04b24310b3a85030a2bcefbd7b516064edfcfd3d2116a52", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887722, "uuid": "5985929e-6a5c-4585-81f2-bb99bf3e5894", "value": "T1FB362322E11850B6E4A302B444EEAB25E17F7C20177791CBAB54476A5C227F37B38F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887722, "uuid": "26cb2ca8-b7c6-4287-9343-8c610127afca", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887722, "uuid": "a6045d97-601e-410d-af6c-2dbb906cac72", "value": "49152:jnXnAQqMSPbcBVQej/1OhnvxJM0H9PAMEcaEaue5c/bXZROAx:DXDqPoBhz1OhvxWa9P59Uc/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779887722, "uuid": "ae843d74-78a9-4ba7-9ddb-f021346468c2", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779887722, "uuid": "9be92053-81a7-4937-8121-f8bea698fa71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887722, "uuid": "29477a50-6839-4b18-87ef-51d0277ef0bf", "value": "9e0e61dfd8783dce6bde57af2ad4c892f481149426b229ecfe20242ae6b88974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d26594-59b3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779876379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876379, "uuid": "593e606f-1088-4f5d-9ede-908a04bc5a25", "comment": "Malware payload", "value": "82036d9f33b6a4f1993d8e19dac799c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876379, "uuid": "570753ec-f094-4a8f-9a60-ad0c6a6d9cfd", "comment": "Malware payload", "value": "9e2a75792b2badc447b7a9e8a87260cb4d6ea56294f331058e3e47b5f36a16fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876379, "uuid": "63d43f72-6e93-4fd2-b1be-86f55e68355f", "comment": "Malware payload", "value": "b96dae52641926b60bb01123a8ca80eb793e7e91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876379, "uuid": "990c50ab-9b1e-40e1-8acc-b4e360c9fac6", "comment": "Malware payload", "value": "1561fe77f0f24376de3bef149be89ba66ff7c7222a20df5e27482f2c76217bc4e7e074097601485152f032b72622366e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876379, "uuid": "46052f28-e528-4794-a45a-7aa89d39d8ff", "value": "T15CC402C3BAD99722C41559B1C4A7892413F2E5CB26B3D30A3B5862971F803F4CE5ABDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876379, "uuid": "3ff18acc-d3bc-45b8-bd75-4534e480cb74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876379, "uuid": "d589abba-e83b-4e07-854e-636e256545f8", "value": "12288:kPojFs+Y/FaoQYAFZ8FbRagJ0Y0lkrJ9QwQiC3fT/VY:9jFBRCRagIkAZikT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779876379, "uuid": "364e104a-4bd0-404d-b3fa-625912bdb131", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779876379, "uuid": "d90b4ac5-0bb2-464e-ab03-83e4e0a0a8ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876379, "uuid": "b2984925-ca55-4e17-853d-af62724bfbb4", "value": "VALORANT HACK V\u0130P 2026 PANEL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5183891f-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880937, "uuid": "553ddbbe-79d1-4707-a3ea-0418d1458849", "comment": "Malware payload (Mirai)", "value": "fbcf56b1dd5dda6b6679d3aeafa0cbbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880937, "uuid": "1676499c-53df-4576-a5f7-65264952e155", "comment": "Malware payload (Mirai)", "value": "9e576831b4fc2a7ce214bcd43b1d5548c5ff2b67649b54988bbe94a7b944fde5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880937, "uuid": "f6e34b7d-2dd3-49b0-b2e6-4eee6868aec7", "comment": "Malware payload (Mirai)", "value": "78335ff2c78905acc757c51b7f0e3eeaa8a1fb88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880937, "uuid": "1155d360-7cbb-4d03-b5b4-3a8a538f0fb6", "comment": "Malware payload (Mirai)", "value": "3abeb0ac6cc1ce62a95c349489d3df23160e1a160333eee50b8a4986c971ddb0949e088cbee3646a67e05256f032cb60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880937, "uuid": "92eb742c-5e08-48d3-94d8-62510d55d6b7", "value": "T18DF31946F8819F15D5D112BAFE1D028E33271B78D2DE72129D24AF707B8A87B0E3B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880937, "uuid": "4444b324-b139-487f-8c5d-f7d260460c2d", "value": "3072:sgr/kU8kCQV6GdXhgUaS58o8nWKU6HHqk6u:XknXuTXhgUaSuo899qk6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880937, "uuid": "ea90d291-9f50-4365-968d-d4447eacfd2f", "value": 159760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880937, "uuid": "980c30be-c26d-4b6e-8489-241b1924b282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880937, "uuid": "83b77d49-3ba1-4d37-ae78-580384a4b5b7", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe652c6-59ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779886168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886168, "uuid": "82961948-514e-4149-b611-0eeb0efd7908", "comment": "Malware payload (Mirai)", "value": "decc5180fd9f68a1e935815c5a38a4a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886168, "uuid": "e9f511a9-d23b-4408-8ebd-816f41764885", "comment": "Malware payload (Mirai)", "value": "9e6b6683911678cd13a686ac038cfd335ebc62438992ace60be3ee2bfc927b45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886168, "uuid": "2229f0bb-fddc-464a-a17c-1ff845bc5421", "comment": "Malware payload (Mirai)", "value": "21f28007dcaee6afc18312f25b275c3b6503b15e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886168, "uuid": "df8d72cd-5b10-4fd5-aff3-89121850a17e", "comment": "Malware payload (Mirai)", "value": "5d652b1fee86bba59fc5ea1913f48e61f3f5e18339b8b0d512c887d9792e04c11182ea86ec49bdfe0d8eb4550923003a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886168, "uuid": "d4128b38-3dcd-4620-bcdf-cae9a965a3bf", "value": "T1B4360997B9824A82C4E43676BCBD81C473A34EB99B97135A6D04FE3C3BBE1990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886168, "uuid": "5ce9c536-09ad-46be-956a-baa0671b1065", "value": "49152:KUHlp+BgCG/LmDiz2oC/KpCkrHClPmbwJyxf/:KUHf+1G/Lmm2oCkrHke/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779886168, "uuid": "fb5164ef-99e7-4455-8f6f-35053da97f4e", "value": 4980888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779886168, "uuid": "20a5d27c-9695-48d4-9447-8414c28a2e57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886168, "uuid": "f4694005-e6a8-4eb0-95fc-c2f3aef5f4b8", "value": "9e6b6683911678cd13a686ac038cfd335ebc62438992ace60be3ee2bfc927b45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87d2081-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911657, "uuid": "8811bc6c-fe67-4e92-8e99-8e2c8be7de5b", "comment": "Malware payload (Mirai)", "value": "e7271983859436e601d3ea1e5a40746c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911657, "uuid": "e043f959-4618-40e6-b671-742d20cb0e16", "comment": "Malware payload (Mirai)", "value": "a046753a95e33d7de2230ce73354e22fa7e6d0a027c4f0ea93af2ea2e339e269", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911657, "uuid": "7aa00d58-1da3-49c1-b65c-226286f0e042", "comment": "Malware payload (Mirai)", "value": "afaf89fbeea2599e34925272a52e331348237c58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911657, "uuid": "eda2ac4a-dc8b-4007-bb83-e707f6165aa9", "comment": "Malware payload (Mirai)", "value": "946390c891547dd0af4a0de089ec0394cc59c2a3b1f8f2ff0649ff53c821722b1302a3411dc2cc34ef30d754863daa06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911657, "uuid": "c4f173f1-33a4-4a23-8ab4-e1d4b5425dfe", "value": "T1C143F1593253DAB1CBD05C3BC65084132F9D2EA5D458390B19E467ECF6AFE88C9F29C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911657, "uuid": "ba0ea184-f6da-45d2-a469-cfbd1e916380", "value": "1536:ZoZVdjMI2ANMTdsJb9e8Q4Y87ejMUeQNXnP3LB:ZoZbb5MTdKxe8Q47ejln/LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911657, "uuid": "e1fa9045-f6ca-4777-b85b-b1c097ad12fe", "value": 59012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911657, "uuid": "453e3aca-c469-4de0-b34d-3526d4e60aa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911657, "uuid": "50eb5e0c-cfa7-4af1-915c-edf074c04590", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f03c421-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913574, "uuid": "e3b70d26-bed7-48f8-ba1f-19f653082b14", "comment": "Malware payload (Mirai)", "value": "f8aceba66f564a88e2614f1bdc8a8c9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913574, "uuid": "cdb4a94a-3cb2-455e-a165-b848e9459ff2", "comment": "Malware payload (Mirai)", "value": "a05cb235c23eddc2eaf30abdfdd9d88c205763f7dec1611ddbb8d2496bd2809d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913574, "uuid": "350a524f-b777-4bba-83ac-fcd0b8041812", "comment": "Malware payload (Mirai)", "value": "58ab37fdf88c34ba9c5cb0d3c32541c04d2dc491", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913574, "uuid": "97418174-40a0-46f4-9599-0a5e15baee5e", "comment": "Malware payload (Mirai)", "value": "869f69ea10a46548c11a64de85ec0e8ecdcbc1af39320db632c7a8c258d943bdd15e53113e94d7ab4823b05790cfde71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913574, "uuid": "f5b66f28-dc71-4525-aa9e-9775db01f614", "value": "T1C621FC09F2496D8FE9AB1178142F022634207A0EF5139113F3659E3FBE7B5E4221A18E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913574, "uuid": "23af2241-b4f6-4503-8dab-14cd21492d24", "value": "24:3va8DzSWPpbP78Pwy74+CiCTHFhHWJpD8ECAfGfioc3rpLNT1oB0:/pP3hb/mkTFh2Jp8DAfzRrhNhoB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913574, "uuid": "2ecb1047-0079-4ce6-ab35-7991c2d580ef", "value": 1256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913574, "uuid": "93464957-d3ad-4429-9003-3e8301b47e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913574, "uuid": "abd51277-802a-44a9-b2c4-ff42e42b96ab", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83182c95-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878872, "uuid": "bd8adf2c-39e8-4709-91d3-958a89108fa1", "comment": "Malware payload (LummaStealer)", "value": "6d5d5c62cd35f47aaa84d9b8eeb641dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878872, "uuid": "6f6e1613-9531-45ff-a7e1-c463d811366c", "comment": "Malware payload (LummaStealer)", "value": "a07b54e8f1b0552f35ec59a088f330e28c452368327e4064da8784793f79dc29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878872, "uuid": "42d19df1-d073-496d-9f75-d8f2a2036e4c", "comment": "Malware payload (LummaStealer)", "value": "9f1604fbea42c1068c1eff82b276e93c93d68f30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878872, "uuid": "d639c598-7dfc-4f08-b268-28d4e4bebf58", "comment": "Malware payload (LummaStealer)", "value": "abc8e67304a54f6c1d2803700d9dda2b746f3bc2ab96c75d2eb3d1924e6036a791c212b40ae722cfb27dd6937753ecea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878872, "uuid": "85184839-d830-4504-8691-fe5af3c87f81", "value": "T177748E9AE3B758B0D5470979216F733FDB241A168728CECBCBF0DB4079272A26535B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878872, "uuid": "4bd93925-e3ca-49e2-b2af-3fe3d77a80fc", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878872, "uuid": "0dfb1a7e-c02e-400d-80a3-93a4b35ba8ca", "value": "6144:LYZ1hfBjV7gE7gVPMBa58tvPES6x6vZLE579QPv1ebx+ifZG:UPh5Jst8tUcV3liRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878872, "uuid": "fde64ab4-957a-43f0-ac1b-d195930e87ec", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878872, "uuid": "21d34625-1d75-4c79-899d-bb7f424b591c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878872, "uuid": "0e4f4084-59a8-4ab7-932e-7ec8abc5432b", "value": "a07b54e8f1b0552f35ec59a088f330e28c452368327e4064da8784793f79dc29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca5dfe6-5a1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779922402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779922402, "uuid": "df265f7a-6471-460c-9d17-8a9b6a3b8afe", "comment": "Malware payload", "value": "ca359a0546aba91114479e18b083e9e0", "object_relation": "md5", "Tag": [ { "name": "bromechoku-com", "colour": "#6FE32A", "exportable": true, "hide_tag": false }, { "name": "bsource-bromechoku-com", "colour": "#108C62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ip-bromechoku-com", "colour": "#DF9009", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "lurlsource-bromechoku-com", "colour": "#949A4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779922402, "uuid": "c163b586-8f09-4058-912c-a42f9139e5ae", "comment": "Malware payload", "value": "a1243fd3a9015ca48cd8852d5631ea76439d90437700e2318d280b7befad39db", "object_relation": "sha256", "Tag": [ { "name": "bromechoku-com", "colour": "#6FE32A", "exportable": true, "hide_tag": false }, { "name": "bsource-bromechoku-com", "colour": "#108C62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ip-bromechoku-com", "colour": "#DF9009", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "lurlsource-bromechoku-com", "colour": "#949A4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779922402, "uuid": "624f2929-6bbd-439e-b750-ae674c7ce7b2", "comment": "Malware payload", "value": "05ed3698d8afb8dc3851528cdfe89b5e8f1bcc0e", "object_relation": "sha1", "Tag": [ { "name": "bromechoku-com", "colour": "#6FE32A", "exportable": true, "hide_tag": false }, { "name": "bsource-bromechoku-com", "colour": "#108C62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ip-bromechoku-com", "colour": "#DF9009", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "lurlsource-bromechoku-com", "colour": "#949A4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779922402, "uuid": "ecc8192c-9037-4eda-a9cc-eedfb0137858", "comment": "Malware payload", "value": "d77800fea17925a15f8af9ae95459db1dbd66aa5c060c32336d1da1502f30a88da6aa9ad6d6f4f2ca670d0399f6d8693", "object_relation": "sha3-384", "Tag": [ { "name": "bromechoku-com", "colour": "#6FE32A", "exportable": true, "hide_tag": false }, { "name": "bsource-bromechoku-com", "colour": "#108C62", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ip-bromechoku-com", "colour": "#DF9009", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "lurlsource-bromechoku-com", "colour": "#949A4E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779922402, "uuid": "e4241862-e665-46f1-a7f5-dac146e125cc", "value": "T13B266C137388613FE06B5E3A983BDB50583FB66825138C4BA7F40A5C8E763416D2E767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779922402, "uuid": "246335ac-24ea-4f28-a258-8147a3822cfe", "value": "796dd1c786c846b84580b81c932df83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779922402, "uuid": "1d2a63a4-9e78-4cf4-ba17-ec3e41e2a917", "value": "49152:rudaZRrSlf/qHkhySxZvv17QK+mrvGH5MFAUym0HmG6Nf3d:Kdeyf4kdQK+mrvFFAUyk93d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779922402, "uuid": "e8e85135-5324-43d6-973b-0552b861c268", "value": 4775440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779922402, "uuid": "671a3d3d-d362-4919-a5fe-acc1c2ba5d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779922402, "uuid": "65221589-8db3-4245-95c6-36172a1764ad", "value": "bin.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71de6b4b-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878843, "uuid": "274d7134-16f6-4f19-beed-8818e050e599", "comment": "Malware payload (LummaStealer)", "value": "5e937fd90d27d1ed54ae950f69d85a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878843, "uuid": "aa10b45a-c21b-4b5f-931d-2ebd1c25e745", "comment": "Malware payload (LummaStealer)", "value": "a156069e81cc53e7dc2786090b53bf7febd6e2f5c68d07ad8289819a718e0cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878843, "uuid": "36f2efd1-15c3-4023-9e40-9897c09ca799", "comment": "Malware payload (LummaStealer)", "value": "63f1fcd9d1d77cd31cdaad5a9773d80fe37ed58c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878843, "uuid": "117c3cd0-babb-4d65-aa49-fcc05f13f4c5", "comment": "Malware payload (LummaStealer)", "value": "0ed5c6acbd7425fd4b583517e5279c755a69edd4abde6711e285370beebe9392cd10adca3633e6cea16c04f4971e02c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878843, "uuid": "338a5aa8-4af3-413e-b6ce-e60aa8430e17", "value": "T18B748D46E7B748B1E54B0975229FB33F9B2416144328CDDBDFE0CB447A33AE26539A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878843, "uuid": "6592aa6d-1f44-4cd0-b9e4-675c96c19297", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878843, "uuid": "5d4f9843-11cf-4e86-bd56-225e41b83b3b", "value": "6144:sRLI6zZvCw5/8m5RtUHD2zSnK90dK7KDhAoK4Yeh9bDvJFeoI1WX:0Tj50mhUCzSKGPlAoK4YehVvJFe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878843, "uuid": "d35fff0c-922f-4f64-8a98-cea3b456e731", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878843, "uuid": "53fb29a4-e5e3-4fbe-94a6-32ae94b127ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878843, "uuid": "6c3a2986-6877-405f-a4c3-7565156386d6", "value": "a156069e81cc53e7dc2786090b53bf7febd6e2f5c68d07ad8289819a718e0cbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007586e4-5a03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779910436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779910436, "uuid": "b217cd72-9928-43bd-b2ea-520b943dffcd", "comment": "Malware payload", "value": "d729e647da2cdabcd99407513b8104dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779910436, "uuid": "0014209e-6125-4b23-9c50-f9a902ef56fb", "comment": "Malware payload", "value": "a1930444b255e4c7c2cc87777867db7787fe19ccd78edad7a1b164d30d0eaf79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779910436, "uuid": "1766cc51-8687-4121-8743-3242af0457ae", "comment": "Malware payload", "value": "9e43c821dc91dffa012abdf05386513b73fe92c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779910436, "uuid": "8315e1ad-c451-4d30-862b-60723c49967d", "comment": "Malware payload", "value": "fa141025f2df45483c02f5247cb38332df881d9e82f872736348f095cfb9b7ab24743f56318afbf60185c17fd2d74547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779910436, "uuid": "f623fe0d-f87a-4e08-9720-2755d9514139", "value": "T132C349B3DC256E6CC664D9B1B0719FB91B639961908B1FBE1877C2748083D8DF6087B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779910436, "uuid": "957fdd7c-be1d-4b5d-a53a-1fb172b87886", "value": "1536:D4vhUUtFtZwu+WCQK/38U7btWE02R4H/6SWmdNbzLQVXFhFL1:cvqUtNw9W6/pcE02qCSWkNLQx35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779910436, "uuid": "4da371f5-25e9-40dc-ac87-0d8c1cba3351", "value": 121468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779910436, "uuid": "610b8b0f-d941-4376-b5d9-759a2ac12354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779910436, "uuid": "91d04126-34de-4f5c-8baf-0490fd7c0af2", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f530392b-59e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779897103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897103, "uuid": "1bc7c8e2-8340-4a7b-8841-4227d5edb583", "comment": "Malware payload (Vidar)", "value": "fa8914474d4285ebd2046017c4df81b8", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897103, "uuid": "899c7a09-2e2b-4873-bf6a-0922986a7d3a", "comment": "Malware payload (Vidar)", "value": "a1ed2e00bb2d10f62e29f91ae4ef5685578ee9eb007be82f1d6f5dd1beee6b64", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897103, "uuid": "e58a6166-c21a-48d0-bc51-9231491913e2", "comment": "Malware payload (Vidar)", "value": "c2555e32b054e259008f73f2ff25e10cc0bc74e7", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897103, "uuid": "f9195c59-87ef-4662-86ba-5e110a88c756", "comment": "Malware payload (Vidar)", "value": "071a083382bfacc4ae261007867c8271e927e8854b8dd75e4da3987656c16a69a8028be604ba4437903fd324cc9970bb", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897103, "uuid": "25a069b1-6194-4f81-86a5-b3537c9fac21", "value": "T1E0A5AE87BC8054B9D5AA923288B6A2D07731F8490F3127C33B55B6BA2F777D44E78358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897103, "uuid": "7453ec99-b012-4eb0-9ea2-345ccb34f3fc", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897103, "uuid": "4623fcab-17a9-4da4-b88e-82f5eeb46b57", "value": "24576:ekDDMd5ArW34Pxw2F0bhQS9gni+kHJBO5z3HRkUdb53mvFu2Ly/6TjQ6OgLP88WC:ekeCa34wlbyFnBkHcrFdcFjegLPOkD1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779897103, "uuid": "26b989a2-6d02-4be2-8962-978ba87da93b", "value": 2221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779897103, "uuid": "9a6a0323-c1e7-40bc-b7e4-c29b5ca3b16f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897103, "uuid": "ca8e006f-1ba2-4a33-a62c-6ef8a02c288a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f29540b-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911534, "uuid": "7082db05-b453-45fe-92b5-be26c4ea3678", "comment": "Malware payload (Mirai)", "value": "1a70727cb6a77046ae7d77e07d993528", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911534, "uuid": "d6066c53-eb57-41c6-8c98-d80d3d412555", "comment": "Malware payload (Mirai)", "value": "a2184027dffdfc72d1b53ab6798cf8fc91a01d58c7ee6c9fb85e59a2355457ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911534, "uuid": "47a3f608-7d87-4996-b4c6-b943c2624b0b", "comment": "Malware payload (Mirai)", "value": "fbb4cb6f1f96d80d8e2420f955c479f6055ac923", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911534, "uuid": "7cbe0dc1-2ea1-448d-ba1c-3c89465176f7", "comment": "Malware payload (Mirai)", "value": "5b9ca7a0cdd1ee9329c4ead122811f9f8bc69c28bc66007981d54572ec35bb58d94eb56b345414125e713c27c2ff33ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911534, "uuid": "92a8a5f6-516e-4b1f-b30b-d2726150e167", "value": "T1DCC62B87B9924942C9E43A77F8BD81C433670EB99B8796565D04FD3C3BBE1DA1A38310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911534, "uuid": "5ed672e9-0f17-419c-876b-cd744dcb91dd", "value": "98304:izWE8oXkE6E7RlvXN8ANXZe+dVHz+SGitOJTZvkhQ54Eu3:dodBaAZZe+dVHz+SGagTZvkhQ5xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911534, "uuid": "bd8a6344-d5ee-45cf-8cb7-9a15d50682b0", "value": 12255394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911534, "uuid": "80b7958e-c449-4e0b-b950-2ff793ecbad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911534, "uuid": "725c2c73-f3fb-4012-a219-7ca3d56ae8b0", "value": "wife.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58713b00-59af-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779874506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874506, "uuid": "7948e1ab-5608-4926-b972-0b3dd237dfc5", "comment": "Malware payload (NanoCore)", "value": "a3bf3b8d6e8242de1859665f9272e4fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874506, "uuid": "952ac8cd-cb27-40f0-9e65-6fc3ad992c8d", "comment": "Malware payload (NanoCore)", "value": "a2a68b45676bf44538f2effae4064ba2124ca759b21e801bc7dd855a2bd9f254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874506, "uuid": "ba19ca43-3e51-4af9-9416-8f256b433daa", "comment": "Malware payload (NanoCore)", "value": "7a97ee0624781c95654ca4641d4c3a3e14276a1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779874506, "uuid": "50543a3c-364d-4809-b4e1-b2969382d39c", "comment": "Malware payload (NanoCore)", "value": "73dc9fce6b35d886ab51a613aaa968f7a2e7915484504c60c136d27866a2815420416afd2a040e9861f97d6acf9c029b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874506, "uuid": "9c1bc987-cf75-47c3-a56e-288cde39ef60", "value": "T18D14CF1A77A94A2FE2DE8AB9611212579379C2E3D8C3F3EF28D454B34B163E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874506, "uuid": "519d1475-5eab-4dcd-8076-58c27efa1d07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874506, "uuid": "5c02386a-f60f-4b52-adf9-622435a74d62", "value": "6144:MLV6Bta6dtJmakIM53MluAJDAxGJg09osS:MLV6BtpmkIRAioJgzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779874506, "uuid": "d1627c7c-1ed9-4e1d-9dbe-d370ad2ecc44", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779874506, "uuid": "2243b949-2700-4869-98e2-769d20f877c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779874506, "uuid": "005b5bd3-a66c-42ea-8419-98c49c5d32c5", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8330d6-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880932, "uuid": "1f71328a-ae8c-48d0-b173-3f3721169b61", "comment": "Malware payload (Mirai)", "value": "851ec3b6a12b1e558c8b02302c70ba06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880932, "uuid": "c2e5bed3-2568-49e2-977d-fdd5a36725c3", "comment": "Malware payload (Mirai)", "value": "a33b34243c205a7bdecd393ce8b15a26bef3bf69cbdebbad580a3ebbb6c57ae9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880932, "uuid": "ad30e7ed-06a3-4278-9500-68ce48eb43f9", "comment": "Malware payload (Mirai)", "value": "bc7d5e6ecaec8ea81c8adccb6a700ff9a67279bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880932, "uuid": "346f7262-ec0d-4f41-a2fc-36fb7ef2bf26", "comment": "Malware payload (Mirai)", "value": "b69f3b555496d510e5ae0cfad2bec9ae3b031a6ae1cb039b2b1f7a96ebec98e81abd9e31b232228208e0f4d45aa4e8f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880932, "uuid": "a6aafd66-b871-495e-ae71-104c3b3d7965", "value": "T108142B45EA414B13C0D627BAFA9F424533339B64D3EB73059928AFB43BC679E4F22605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880932, "uuid": "61c8374e-74dc-43c4-8add-cebaab3b1101", "value": "3072:f+7xTruvDniBDRbQraUgaodckJc8k4RoEJOjCiaMbooM/RcBa66:qTivTqRbONgaOckJc8r6jCiFEoM/RUb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880932, "uuid": "d0343103-f7ef-4f27-b5b3-4db42b14d556", "value": 200744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880932, "uuid": "6a2bbdb3-6343-428e-892e-dbee27b490bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880932, "uuid": "d97d259f-d4c2-4a34-91cb-74fd4754e665", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcf30c2-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911690, "uuid": "453c93d9-b0c3-4e38-b9bf-2616c60c0b40", "comment": "Malware payload (Mirai)", "value": "2321785a171dea5982a6a5607aaf054a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911690, "uuid": "3701d784-36aa-47aa-b3d5-5fbfcb4f9188", "comment": "Malware payload (Mirai)", "value": "a4292087a888e80cb5f9484820386db4a0aa13b81e09992081d24fda698dfe48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911690, "uuid": "24d0a8c6-62ff-4862-9f91-d655a705fab8", "comment": "Malware payload (Mirai)", "value": "d9721b7fe9b3e7600e694bb8b41199d1dd0df3af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911690, "uuid": "c1adfe6a-a56a-4142-b97a-002f04540fbc", "comment": "Malware payload (Mirai)", "value": "ca7f3ef53f8372fe35cfc8b577a8f4c581b48e3b77078a5a056d5ca47a63684d7ecf0047f2ee7345a7ece9fea306cc4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911690, "uuid": "aaa988b1-56d9-485c-b207-fdb71cbe5f9d", "value": "T181F32981F9414F27C6C712BBFB9E428D3B2A13A9D3EA7103DD215F203B8695B0D7A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911690, "uuid": "ba7f902c-c50d-422c-8207-cd52e6147d0b", "value": "3072:tQC7toK0cm5aWW/i4SXdAcTvEG7kJ6hh19OMa:tQ2PoDUi4sd1T80kmOMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911690, "uuid": "ad12ca91-1052-4f1f-8ab7-ddc817900b81", "value": 158848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911690, "uuid": "c0c4af88-813a-451f-be56-53122171bf16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911690, "uuid": "5af0585c-98e5-4936-91a5-e559899da4b6", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30aa041-59b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779876000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876000, "uuid": "052dd36b-1a4f-4ee5-b3d9-2633e548347e", "comment": "Malware payload", "value": "78ffc37f17c2f34b7062375e0deaa4ab", "object_relation": "md5", "Tag": [ { "name": "instantwebupdate-com", "colour": "#D2FC37", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876000, "uuid": "2f833d2c-4f68-49d8-aaaa-9556e28bd36e", "comment": "Malware payload", "value": "a5fa71f44f186f93d914dd799164b3e07914948f182959bec35bfb5d3c2c767b", "object_relation": "sha256", "Tag": [ { "name": "instantwebupdate-com", "colour": "#D2FC37", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876000, "uuid": "1337b29e-9b0f-4b45-88d2-f555f4c3864d", "comment": "Malware payload", "value": "393067fd00b2b17aad5069d2aee0bb06f7e41046", "object_relation": "sha1", "Tag": [ { "name": "instantwebupdate-com", "colour": "#D2FC37", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876000, "uuid": "e3f5fa8e-e3be-478f-9b37-e1f5c4ca0303", "comment": "Malware payload", "value": "e340687eb01a8fda06736e7d585f9e77248007239733bd9d9ef28d5cf7f89c6562c936aae1d7c6ba4d0cd12078a060d9", "object_relation": "sha3-384", "Tag": [ { "name": "instantwebupdate-com", "colour": "#D2FC37", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876000, "uuid": "09816f69-9018-4683-a111-405347c1f37c", "value": "T134F433921444F0FF8F9297E7AFA1A1111BC8D88504BA46EE90C0FD9337E674D5EE1E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876000, "uuid": "2974a5a1-d7b5-4316-b51b-925ba27b8747", "value": "12288:lneFSXz1FwxHrlNWEt3nVa6VE/Q7zZ7fxSuK5PlPeiso+Zcg2OotKVeTRdSRyBHK:xXz7WXWaY6VEERfxcPleiMLATuRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779876000, "uuid": "5820b4c5-10db-41e9-b3f7-ff8a75654875", "value": 762825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779876000, "uuid": "17707385-4068-487c-8d83-92340893753c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876000, "uuid": "fcc71f6d-67ee-4a7c-9000-ef373076dff6", "value": "update.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab5b8b0-5971-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779847908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779847908, "uuid": "1dc91682-2026-4399-8e06-dd8094a8859f", "comment": "Malware payload", "value": "cab48b5a32f878810e5c48a35e094d75", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779847908, "uuid": "aceb8a82-8af6-443f-b0f8-434e34cdfb2c", "comment": "Malware payload", "value": "a5fc60e7de58f8a08f0f71cc549cd706b1fcb7a592426cc08cfb248d3f927d86", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779847908, "uuid": "0c904dca-8abb-4041-8160-cc25c36f8f2e", "comment": "Malware payload", "value": "171518527ae6d2a68222220e9385ccd779b894b3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779847908, "uuid": "d22c0c02-cc2f-462d-8664-d38dd04d0253", "comment": "Malware payload", "value": "78ab74a5a5aefd8bbe04c083e05d45b84ca27941b16423d510a341c4eaad1c0cf13e166d3a0639b431442b35570eb9e7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779847908, "uuid": "9ab218db-7e1b-4095-9b67-f288b0e2fbac", "value": "T1DA137D6956857C24AE99883B1C7E2F0CB9A983E1310851DDBFCB3CF58C49A9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779847908, "uuid": "85c3d6a6-8b5d-4cb5-ad33-d64fddbbb38e", "value": "768:8+J9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:8+Ccy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779847908, "uuid": "3f42b820-867b-416d-84f3-dc1aafbba401", "value": 45526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779847908, "uuid": "c1025f27-949c-45f3-b46e-fda5425f8f9e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779847908, "uuid": "88644aac-74a9-4ad9-8811-cfef2f25e3a8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4841134-59e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779898712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "caa90b08-7b00-4f48-9c7e-18d63112816f", "comment": "Malware payload (Mirai)", "value": "1bda989925d43bb88c9ebe7a66d4abc0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "f019747e-4c27-44ba-8651-ba51caeed4d0", "comment": "Malware payload (Mirai)", "value": "a5fe5a498063d796481d1066c6f196a1fc8ac5daba156a91ff1bdab1a0fe1a86", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "dce2b01b-bba6-4599-bb8d-98007404c76c", "comment": "Malware payload (Mirai)", "value": "eac3315c815634e85a7cddfaeef3175056a6f9ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "35370828-6ee5-4407-93e6-bd99aa9f7d0a", "comment": "Malware payload (Mirai)", "value": "8b50a541686d9c54124d1b3b1bb66703c10238dd5a175a2c7b40794f77e5f87d1ac3872bdc4c6d65da4aea21f33d5926", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898712, "uuid": "36336cdc-69df-40f9-9800-0a63fad17f2b", "value": "T1B914B81E6F228F6EF269967047F34E30975832D62BE1D584E2ACD5501F202DE641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898712, "uuid": "84852d05-a9c9-4d19-9581-d6b49a2e191d", "value": "3072:OyboWRFNwC14T3XOAP2mx088uUP0kgW/AuI:OybGCAeK2G0mHkpLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779898712, "uuid": "a70f2a9b-3acd-4402-84bd-a015c262ca29", "value": 198432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779898712, "uuid": "952a1a13-f2fd-45e4-a130-f83839704962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898712, "uuid": "96ffc271-4c21-4849-9e53-309dc17e35d3", "value": "nova.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345c04ea-59ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873157, "uuid": "057af331-1a43-46a7-8158-e31433c78410", "comment": "Malware payload", "value": "6c82c1f6bdb5cca943203bea08ca628d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873157, "uuid": "d4ab1833-dbe2-497d-95e0-530498df0e87", "comment": "Malware payload", "value": "a6bf321c1643c5a6626cceaab9886b788ae566fde982a8af96704b059b3ca5a9", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873157, "uuid": "73d3517d-1ddc-4e63-8678-ab39c3c978c1", "comment": "Malware payload", "value": "b5d922a9a6f205fa0b63228471af3811b6e76378", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873157, "uuid": "d85869a6-f341-46d7-bfbc-ade39d0d558e", "comment": "Malware payload", "value": "6de08668ea70c2bd81e3672d27b6824beabe365856e1cf6ce3a181f67991f54322c7bcf2e7991570a52ecf3b6c689cc5", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873157, "uuid": "67207417-b4e2-45a3-8e82-1cd77202482d", "value": "T122217B456A6383C87DB12A64C37DA202F0D7912BA4D0FD58F7CCA042BF21653EB092F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873157, "uuid": "7b4dd81d-afab-4a93-ad34-b24c929b949a", "value": "24:k42cLLhJwYgTjMTGqoLldp6XlH0RY5lTlqh9TAKUZFBKG40xReyereYlESjLBKuY:k4lL7wbTzBMXva4ZbRereDo9y8hNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873157, "uuid": "15963f91-20ec-4dbd-859a-7a646f04e98d", "value": 1327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873157, "uuid": "0c9c8630-799e-42b9-8f9f-d0cddc56bb0d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873157, "uuid": "4c2eebce-21cf-4ab9-95bc-a48059edfd7e", "value": "Nota Fiscal Eletronica-Y848H8.hta.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a789ab79-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880651, "uuid": "ea8a0b5e-7403-4b5c-b211-846c29735396", "comment": "Malware payload (Mirai)", "value": "62291c3950190f397687fe80edaaa510", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880651, "uuid": "8642b80b-41ad-429c-a27d-298f13987e49", "comment": "Malware payload (Mirai)", "value": "a785a21ac4aa139e3e27216fd6ddbcafe0aa40e8fa307c1249977de28e645753", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880651, "uuid": "932b73c9-6e9e-405b-9db2-5fe4f39a269a", "comment": "Malware payload (Mirai)", "value": "39c472edeed9863987bfdf3a138f4154c5d987be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880651, "uuid": "683be4ff-aa81-4661-877a-9c2c5c2484ac", "comment": "Malware payload (Mirai)", "value": "279b68fc70a59d9d4ce03c2d09ea2fc8613bbc53bd3c9f6ea4d9315f5de6b855faa3b3ce6d45b676bb126cd1fe788a65", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880651, "uuid": "55ff46b1-b6a5-48e3-9e96-84cf31c72848", "value": "T159C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880651, "uuid": "dc452f69-9e9d-4f6d-99aa-7a0b8233fd4e", "value": "1536:6qB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3d/J:6oB4exMF7oZKJnCNYaxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880651, "uuid": "9266b2e1-6ea7-4149-8f5c-106c3ad7602b", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880651, "uuid": "c7a1c62a-6254-4e33-a5f1-d9f5a4f88e0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880651, "uuid": "5cec6330-7fd1-4f29-9c75-b85783b16e70", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af9f30c-59fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779908521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908521, "uuid": "44c4cd43-6581-46ec-be9c-ee08c3950178", "comment": "Malware payload (Mirai)", "value": "823dbfbe789213a69732612caab8661b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908521, "uuid": "417e4ba5-84bc-4086-b21c-e48e0406fcbc", "comment": "Malware payload (Mirai)", "value": "a7f188fdacac94b4c77f623ff42a5e32d14904268fc75d7b379d0e17ba52e01d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908521, "uuid": "0bcfc0c1-7011-4d28-96f1-42ccbf66f5b7", "comment": "Malware payload (Mirai)", "value": "86c23a175bef87fefdeb3ed1e0ea1b731bd978f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908521, "uuid": "50ccf911-fd6a-4f48-bd5e-2f734719c4aa", "comment": "Malware payload (Mirai)", "value": "d13a788656f9aa1df0928ba36ad3ac9b272191812d497985b18c039a8cbfe80bc973315d55d8fd7368389611aa1b8065", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908521, "uuid": "0690fa09-6539-4add-97e5-610aaf3a2f3f", "value": "T150933A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908521, "uuid": "b9071476-4514-4e25-b2bb-1e9f68ee5516", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1vMbnIh0vAi2k2xPSUUN4J+LQR:KvjLrKGG4syfcIhXiuxpUN48LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779908521, "uuid": "3f24c2bf-def9-4fd8-8d82-f60417742901", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779908521, "uuid": "0b4557d5-94a7-42b3-b3be-7aa526e007d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908521, "uuid": "147bd0af-0970-4f4c-9167-597609889e97", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f1c598-5991-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779861677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861677, "uuid": "dbc805ce-7533-4a1e-921b-b8dd69c07f35", "comment": "Malware payload", "value": "8df02f8fc209f727c2f2b36c0e6bf9ad", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861677, "uuid": "a5cd14d9-701f-4faf-ae1e-2dcfa098a757", "comment": "Malware payload", "value": "a8602645ad4c7a9d4ee7e150e6a30102c32b38e5ae82349169e5da51db5b5927", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861677, "uuid": "ceead5d1-d12d-4f50-b885-fd4470ad7fc8", "comment": "Malware payload", "value": "8d29cdbd79747a1f1fa4d9321ce41a50b69fcd6f", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861677, "uuid": "8788e59d-1ff0-4009-841f-744aa758d775", "comment": "Malware payload", "value": "0f8b5141e6c5f1ab2bfe59aa7a5cd297baf23301f63762e577de83045d4838c8fcbe01d002c97057524c69798a463cf0", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861677, "uuid": "88ab16d4-5054-4499-bb23-5979824e548a", "value": "T1F4E3D872601A353F93A3C6C561B127017E67985FFD6700ACB99DC3780BE6EE2AD2B144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861677, "uuid": "14c76fee-0b6c-476e-91e3-b23689996d7e", "value": "1536:FTlpuFz9JAqPN1r86SuBoXhRBvrw4GDU4H85ne95n1rg++h5nei5nQkTU5nei5nC:CDcqEpEdEMlAsYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779861677, "uuid": "4af880ed-214d-47c6-8b68-2ad4cc62b04f", "value": 154616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779861677, "uuid": "b97fb7e6-7940-420e-a63a-50ab8091cbaa", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861677, "uuid": "742634f4-b1ad-4dbb-856b-ec41fa1df1c5", "value": "zcgbs460.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c17618-5999-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779865106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865106, "uuid": "8cfbc233-7d45-40aa-a790-8f3967ed886f", "comment": "Malware payload (Mirai)", "value": "192d4a12e6de212d183a89d3abda002e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865106, "uuid": "0069f136-65af-4d05-a2bc-beacbdc67dd7", "comment": "Malware payload (Mirai)", "value": "aa1a639fc4e5cebcee75add0be1bddc928b7c8e121dc1043b58ca278028a4e63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865106, "uuid": "ca4e4e47-6e7e-46cb-a896-c1e5182533be", "comment": "Malware payload (Mirai)", "value": "4c7237c26fa489ea680d59a6f6dd40859a701d31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865106, "uuid": "9049e20b-2c38-483d-9cb9-6f34b8fa629b", "comment": "Malware payload (Mirai)", "value": "a516210cb6348db2df78122f5bf43f09225b16c1c77d2610bbe0858af67235b460dffb3bcc73a3a1dd20ca8825023db6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779865106, "uuid": "cdba1309-a2b8-44c3-8591-291c04eed317", "value": "T14153017CB40809DCD4DDD13063D71B016A6F49E8EC2EC2466ADAFB05CC4657264ABEEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779865106, "uuid": "e188d1e3-bb53-4e19-8c4b-9a436c5c27fb", "value": "1536:4GYPO162IPgfE6X2lZJEgji47LyAV4C8F2cijmjX0VJuUh:mWQiuZZyANT6EVQUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779865106, "uuid": "088d2970-d333-4efb-aad3-1146f89b2ba4", "value": 63344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779865106, "uuid": "320c8f1e-d10b-4007-a863-76e4375b93b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779865106, "uuid": "2ad35fa1-4d0e-43fa-beb7-c0b2156a200d", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6665f9e-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911654, "uuid": "23627a1d-58c4-45f9-a4cf-e9c093e5206c", "comment": "Malware payload (Mirai)", "value": "a7eacfc4f272e10cdfc3eb48e3fb64e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911654, "uuid": "f55decb5-a0e6-4213-87c3-0e60d81a0c1a", "comment": "Malware payload (Mirai)", "value": "aadb7858dab75b0a43e9a4fc4ccc9dcb7e394cd3a2ca330ed97b7eef6f6711df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911654, "uuid": "ca193afd-7110-4afa-b048-7cba60f4293d", "comment": "Malware payload (Mirai)", "value": "7484aae783b7fddf0e79a0870198b357371cb913", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911654, "uuid": "fc0fc9ca-8017-483a-ad26-fa3b58554380", "comment": "Malware payload (Mirai)", "value": "0b5ce23b1dfb192ba6527ff90dcf9562b15a462454923cdb15549ee9171b619496e467c3ad015f7c88e75d25a1d49886", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911654, "uuid": "3a62cd9f-78bd-404c-bdf3-d34aaa3c7fff", "value": "T1C733025005DBF340F6302D3EBCBD8D1A2DD4A7ACCDB4B0B255944B821F43A5968B9E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911654, "uuid": "7ec54d88-35f3-49c8-972d-6b8fdef7646f", "value": "768:n44O4eyC217SuUTXZazr6s7PvQAdpakxue6+t0NGX06/OnhqolRRN1iZ20njShIj:nbdAsKU64hp1uGKsKR4M0IBg2qWzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911654, "uuid": "d03c64fb-f5c9-4eaf-9d10-dd446208cb60", "value": 53776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911654, "uuid": "c6559651-8e70-48d7-b67a-bbc4a60b6535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911654, "uuid": "64bc8804-5dba-486a-a714-6cb62c1e170e", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6052aed-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779880703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880703, "uuid": "1f05030b-4a56-4e34-b02f-bdc3ff012ee1", "comment": "Malware payload", "value": "118a4a38666b652b4648f5b2e6a8a351", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880703, "uuid": "affc9e04-f981-4b57-9ade-8363f9af170b", "comment": "Malware payload", "value": "ab5342d9033898270f8671b88d03182e3cc5a1f3cef2c2b3f1ebbbff0af8da68", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880703, "uuid": "5ea724e8-5686-4160-9555-51c3bb4d5b22", "comment": "Malware payload", "value": "6a9e3f0acf6d7c432104627ea96b026c99c0f7e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880703, "uuid": "e610837f-b3e7-4309-8429-59767eed0200", "comment": "Malware payload", "value": "5c57c0c40c3974556ec4e359f850d15d90b7fe8dc18081f1fc552510db5667880aef1f99829fc25e6fc4107677848dea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880703, "uuid": "b075beaa-963b-4620-806e-1fc677776859", "value": "T1891833AF82DBBDDD12946D820CA35FBA8F14B49519F71498AC13217EE204F4233DDDA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880703, "uuid": "df8c59f7-f299-4b59-8ad6-2469ee7dc353", "value": "1572864:ZfA6qZBqsTxdkfCjzEKYC1mSHaAR8d53JFcSUiTJ25X8IXNUZJQ/9v9zYBvcXZ0F:9gBtTxGYTXMl5ZDQ5X8KNX/9luO0jmp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880703, "uuid": "72fd2e9a-485a-45a3-bd66-babcbb6c1be2", "value": 86729364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880703, "uuid": "44f4a909-d6da-4d40-9776-3469220051c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880703, "uuid": "2702ea77-9058-4af8-b377-2e9953480c9d", "value": "USERENV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4702eca-59da-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779893155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893155, "uuid": "89b9b4fe-21ff-4b5d-a6f5-6a202a57539f", "comment": "Malware payload (Mirai)", "value": "03887e7c1eb273d9d664348af39a7790", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893155, "uuid": "b7c02daa-8556-4bba-9060-6aa3328cf254", "comment": "Malware payload (Mirai)", "value": "abe8474ab4a5c14c9ec8c557393c4d78b9e591d15e6472455465aa82dd198cc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893155, "uuid": "7f06ff1a-c979-445e-a81a-91de41996b82", "comment": "Malware payload (Mirai)", "value": "144957af74eab3a495464c28bc1c74ebcd9cc510", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893155, "uuid": "fdc4c75e-3613-4544-840a-ba3fae63d987", "comment": "Malware payload (Mirai)", "value": "0180bb74afc9e9ba8dcf4ec2964c3000201c973656392ece5f2e11a6694c7e6229c2aed9d985e8ea5874fd14210ae1a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893155, "uuid": "4b546bde-7a9b-42da-8a26-81a3f57356f8", "value": "T1D7C33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893155, "uuid": "8ab5186e-76f2-4523-9a7d-8859f82b8984", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPzO:LzhWutxBaORaebXQd+mzBzlkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779893155, "uuid": "a0140174-8506-46f8-a4f2-a23a58ae1b6e", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779893155, "uuid": "aadc7bcd-d75e-419f-bfe8-7877eb833279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893155, "uuid": "a14e6908-eee4-431b-8e67-a453d8891323", "value": "abe8474ab4a5c14c9ec8c557393c4d78b9e591d15e6472455465aa82dd198cc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe0e97f-59e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779896550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896550, "uuid": "60ce2277-60a8-48c9-9966-c3402f4bf7da", "comment": "Malware payload (Mirai)", "value": "606a8b6a06eac290ae9499cfbb583132", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896550, "uuid": "7fdea7d5-e08d-4699-b830-7e36b260c7c0", "comment": "Malware payload (Mirai)", "value": "abf6582ae7dbba7f369981e45de58284fa002ed9dbf8e8059435c28c2031ef8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896550, "uuid": "5398ac84-24ce-41d9-a1a3-49a716029d8e", "comment": "Malware payload (Mirai)", "value": "78302c3b75e972b3a866523d2adba9b5e68af778", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896550, "uuid": "c97af9b3-230a-4684-84b0-768d632d83a0", "comment": "Malware payload (Mirai)", "value": "f614f48e3200a0ad5f2c08f23644a27c24208334417d815985883897e247701f23dc237316dbebfedfc453fe69a4dfe6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896550, "uuid": "6ccfe3b2-732d-4c2a-af2c-1f4ceb664aa8", "value": "T1F5632991B8819613C6D1127BFA6E028D3B2613E8E3DF72079E225F2137C696F0D37A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896550, "uuid": "3616433b-b945-4f07-936b-cae9eef388d8", "value": "1536:xZ1ltKm9nMtfTa7/KrV9YsxzLvkuyCG3wfqvfW9:xZkhX9xzLvkyEbfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779896550, "uuid": "cdf316bc-d591-4778-8eb6-9a5314664da6", "value": 66900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779896550, "uuid": "1f32ce47-d6b2-42c1-97f7-81db8b9ecac8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896550, "uuid": "0acb362b-a10b-46ff-a28f-081fd99f9b7c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce761747-59c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779883723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883723, "uuid": "1e7cf72f-edcd-422c-b5d3-9fdbcb98077e", "comment": "Malware payload (Mirai)", "value": "4371cb24e2578152e89ab50183f89b98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883723, "uuid": "c52c66f0-e062-4278-828b-660287fa9e90", "comment": "Malware payload (Mirai)", "value": "abfa5a25bbc6bcc9daae0df29fa384bfd6839fb2d5ed8db2b2eade94df14ff19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883723, "uuid": "3bc952bb-df15-4e1e-9b0a-533a519a9d69", "comment": "Malware payload (Mirai)", "value": "1c7185e95076805372a5e80330cb22a78f4debd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779883723, "uuid": "f91ce70d-b4cc-4e4e-a399-99dea2c7c5c6", "comment": "Malware payload (Mirai)", "value": "4016f02b1d8db2ccf0ee0031a3beced1e235b5ea44bd21501b1e562acc6b5f93c672f43a1b405b4545188171317ee755", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883723, "uuid": "7907e5bf-ea0b-41c9-878a-92eb3fc6738e", "value": "T140361790FECB51F6D9031E3144ABA23F63315D058B24EB97EA547F29FA3B691193620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883723, "uuid": "415c9ff5-6726-47d2-9619-6f7acbd09257", "value": "49152:GuWxM1Tn/6Lo8vzL2zV7ZGsX6b3xpt2qet6qKJvwvc2ReU:qM1j/Xxq2qqpvVeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779883723, "uuid": "c96b3b65-b7bc-4f33-be07-347aa6e528b2", "value": 4878488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779883723, "uuid": "6c35f7f3-ae85-4c10-8580-abc2666fc00f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779883723, "uuid": "1d386eed-7926-40c3-aa4d-fb31fea88a4c", "value": "abfa5a25bbc6bcc9daae0df29fa384bfd6839fb2d5ed8db2b2eade94df14ff19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e620172-5a27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779926055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926055, "uuid": "34a10f9b-a109-4be3-849a-68704b0fb48c", "comment": "Malware payload (Mirai)", "value": "2b91bd638e919def36f22fda48805530", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926055, "uuid": "01280f52-013e-40b4-a875-ca406cffb105", "comment": "Malware payload (Mirai)", "value": "ad831f1ff636c6073172de6d7bcedc2b3479c2707d28cc287e34fbf85cf4692c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926055, "uuid": "a4829cf9-5c2c-4d42-8e9b-f81d0577b300", "comment": "Malware payload (Mirai)", "value": "3b2d2581a35c1802741127718d1276cfe5561fa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926055, "uuid": "5d6b451a-ddeb-45b5-9118-24271b5a9966", "comment": "Malware payload (Mirai)", "value": "63f1c001cfdfdd161c9154fe4c7608a3775ba2312114a45c2e971260699c5bf8698f5e22e8783b67fcd7271ea5d74946", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926055, "uuid": "28f9f2c4-b3d3-448e-a24c-ec4afe0ea358", "value": "T1D373023397241951C1806CECC58AC4C8BBD74B3C746DE9D44D53CB194EEBE961ABA84F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926055, "uuid": "d1d9ae1b-90e8-4cf6-b0f7-2e94dd89e3c3", "value": "1536:BwlA6v5tG93s4+COKqN/50mtHMtXqmHQ0jgL/i0mfFOrO+xs3m6MVH:+vC3gKirstXqm70L/i0mdOKQs30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779926055, "uuid": "38d8852a-0822-4796-a5fb-e8b231cf329b", "value": 77332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779926055, "uuid": "b9cba94e-e51b-4298-a6fc-591ccbf24f4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926055, "uuid": "c22cd729-328d-4502-be92-584cd7edf4e6", "value": "SecuriteInfo.com.Linux.Mirai.9816.12186.9680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51a1901-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880647, "uuid": "545b0e82-4d7d-4c49-9cdf-ec52e25b69d3", "comment": "Malware payload (Mirai)", "value": "3264709129b43ccddc53d9a3a8e9c1a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880647, "uuid": "b9585e09-ef60-4bce-8314-bc872b8395c2", "comment": "Malware payload (Mirai)", "value": "adc2686aa79b7ab85a594ea8b59355dfb087b961b958ef434aceb722c51f5fe2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880647, "uuid": "9bcafeb3-4ec8-4129-b7fb-183c64fdb4f2", "comment": "Malware payload (Mirai)", "value": "d35039cc94b7f38456b3d172b1b219c7e3e27bcc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880647, "uuid": "9b69feaa-166f-4266-8326-de35d85c42b8", "comment": "Malware payload (Mirai)", "value": "361f8b39c9791cd0c54fecc57f8652d7d4c18cd1b0375e184d511ab0ab74a7afdecff823cb54452f9d0a9f8896d67596", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880647, "uuid": "69d4b060-5294-446a-b941-898cdebcfd3b", "value": "T1C7A328A3CC762F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880647, "uuid": "49e8873d-88ce-4232-b836-f9225963f7cd", "value": "1536:7nufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAh:CbU2RC4kPCtSzWu3/3L1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880647, "uuid": "131cd524-7396-4c03-a706-9bfc73c1516e", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880647, "uuid": "6c162d07-938d-4120-a156-f6ac19438ab5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880647, "uuid": "e4c04fd1-f5ef-4b97-a98b-65f1f36eaa22", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9098300e-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911537, "uuid": "21da3b82-a3a9-4032-9ecf-bdd5298b2c07", "comment": "Malware payload (Mirai)", "value": "dae5bcd06c8f2382fdec3576762c9691", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911537, "uuid": "1a5772a9-f850-434a-887a-a98035ca9ee9", "comment": "Malware payload (Mirai)", "value": "aebef572d064f2d387e3383fe9127d5ea84d731bac5c7ca9b5f79a459edc9626", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911537, "uuid": "c17a78fc-34b7-468d-8c93-b3dd53509749", "comment": "Malware payload (Mirai)", "value": "5087ab987bf5e05a62d7b27b52b24f94444d5398", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911537, "uuid": "c7043ca9-792a-42df-8ef1-a868761782f2", "comment": "Malware payload (Mirai)", "value": "52084a89abfcf89e5f5dbef34d919e83321c0305e8b7728789ddd83bc9081d1e799b7a8dc2cce8ae4518e337cb908df1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911537, "uuid": "0655ae36-c695-4442-8928-533af5037ffd", "value": "T149E629136A1CE74ED629213059B1CB986B391C8542D6D467B3A2F318F9F307D4AAECF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911537, "uuid": "cfb827a0-d0a9-4b4d-ac16-f475e0c03154", "value": "98304:nNOnwSa20aL++91nz+SG43SG7ksqepjzQYlLrz8CjEP:NOnwS30aL++91nz+SG43S4pN9rz8xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911537, "uuid": "b20905d9-8697-49d1-b793-82637a5e8911", "value": 13893825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911537, "uuid": "aaaf2f52-ac84-42f4-af2d-080758b5024a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911537, "uuid": "ecee5fea-95e0-4ed8-a6bb-8febe9cbf512", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c6cba4-5a0f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779915981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779915981, "uuid": "53fb6df7-121e-4933-a3cc-50bb09ddeb79", "comment": "Malware payload", "value": "8dbfc994eb62d8ad88673a1fbb513d67", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779915981, "uuid": "d53b43cc-858d-44e4-a56a-b44e0b5b97f3", "comment": "Malware payload", "value": "af82c1823d0a7096670cb3060f42fe6781f0eedeacd46b1ac96180ed1e33f2d0", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779915981, "uuid": "11eaa8c1-b207-4866-8109-0a9712246cc7", "comment": "Malware payload", "value": "fcf4d277d0b2bcb4dee77308f11c0469fc78dcb3", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779915981, "uuid": "0d3da9b2-d7d3-45ec-a8e6-ddc22eae7881", "comment": "Malware payload", "value": "a208bb43eceb0d021578d01a39219b6cbf7c81e09b18f15428a16a9e83be12ce221b8610aa9ff18b46f8bc8df84c775b", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779915981, "uuid": "0a40dbe7-4d4b-4942-8075-1a5d79f87111", "value": "T15C34392BC26374FCD552C07892266212F771B63D47349EFB4293D3359E21AC0AF7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779915981, "uuid": "98e8bbb7-2fdd-461d-94e1-fa09d1e5a28a", "value": "8b41a1754e41495e9695410df2f316c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779915981, "uuid": "79b6215b-4b05-42f6-a3d9-7c4b91e05e8f", "value": "3072:XViy11UtEMh/5Rn7gZFe6UV8gmCqkePNIqHrDZtqFPo2SPjMXDojm:My1jMAFe6XrPNIqLDzqFPM6Do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779915981, "uuid": "fd5d12a3-8af4-4ef0-89d4-bd5a5bbfef3a", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779915981, "uuid": "c89cd3c9-3670-40ba-bea5-5ef07c725726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779915981, "uuid": "75139adc-89dd-4195-abdb-d905ea73ad45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25346ab-59e7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779898708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898708, "uuid": "7643ffa4-3f87-4c55-adec-a6ca88d5898d", "comment": "Malware payload", "value": "618d44ade6b3de10b5e2de051ff6b89e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898708, "uuid": "95100af6-bb08-4cae-b559-f6bcdd01ec1d", "comment": "Malware payload", "value": "b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898708, "uuid": "23b381aa-e373-4320-b42d-719795c8f708", "comment": "Malware payload", "value": "d9aae21eb9980aa694320654d5f379f7651d39a8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898708, "uuid": "238e9adf-16d2-46cb-9715-6fd6f98005f0", "comment": "Malware payload", "value": "06daad281cf26e85ee2e008de48cde4ae4e45edc6799a9bd6ce43b8623c41ee55b2ae13d869711671b707ba0b9022072", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898708, "uuid": "5dae8606-b7f1-4ded-8929-4617fa6a1ed8", "value": "T16F51FDE2B835D435F98DA439EB9D63987482241F0A18BE14758F783C0B8C94C23FE679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898708, "uuid": "17b8f806-fa54-48f3-aebf-ade905383bf6", "value": "48:q994zVz1FbRL9uXuHVjHVKQlnv8f1nulDtrGDErfyX/HFd/E+MG8hJ:694ZjJ0twl+XN8G8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779898708, "uuid": "51d8120e-9b09-4e2f-a785-78c1c0f7a4d6", "value": 2453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779898708, "uuid": "5f6f29b3-dd2f-48c0-9458-5198e836daad", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898708, "uuid": "7d64847c-be0d-45d4-93ca-b908e692c884", "value": "nova.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8be737c-59b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779877781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877781, "uuid": "7a11e65d-7711-4aaf-a1f3-b1747e0c624d", "comment": "Malware payload (Mirai)", "value": "b2ecf12003ed0420326b3045481deb95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877781, "uuid": "9f1a1660-876f-4149-8482-d572dcc1ebda", "comment": "Malware payload (Mirai)", "value": "b04e0db700ea057ac9932ae9273e419bfae168ee109572efe1d5e72281bdfdb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877781, "uuid": "83545d5f-1e37-49fb-9e61-a47a47ff6be3", "comment": "Malware payload (Mirai)", "value": "24c3a08af7fe7deff12d43f56855e143765f85be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877781, "uuid": "835a1705-9440-46dd-89f5-afa32227ae23", "comment": "Malware payload (Mirai)", "value": "d4c5f8dc39ef8c735635fcc30efd54cd56129fba963b3d6f802c902e8f9208298309f90d0a3153e6ffd4e59d338befca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877781, "uuid": "f7e6d113-2d6e-4f6a-8f1c-3f5f048ac6a5", "value": "T17AC35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877781, "uuid": "f3f08777-595a-40c8-93a5-968b27edef50", "value": "1536:URAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK33:UyFmSmviqS1Bs0+Nd6lAqktNMxSNbm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779877781, "uuid": "4c2edadc-ab0f-4097-80ff-e0186a915f4b", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779877781, "uuid": "61b60e33-c9c1-4170-807d-26ed309d3ef0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877781, "uuid": "8c65e65d-dedc-4892-8268-d26f6b1510fd", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5138302-5992-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779862206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779862206, "uuid": "69264775-370b-46f9-bf0e-e0297cc46903", "comment": "Malware payload (NanoCore)", "value": "fa542cb215c0d0eb4d98c7ec185de941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779862206, "uuid": "e44d6905-a7c0-4e58-ba18-4df4d7d97791", "comment": "Malware payload (NanoCore)", "value": "b0ac2c5c45ad01464cafcfe863c9c7ac71b6c9034b7ceb410d3917eb2c14a6a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779862206, "uuid": "90a40410-3983-49ca-a0a7-68b1c7363c68", "comment": "Malware payload (NanoCore)", "value": "92c614008364f574c37a7193bb945227e84ccba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779862206, "uuid": "006e88f8-675b-4753-bab6-28f008d49ce0", "comment": "Malware payload (NanoCore)", "value": "af3146656f23183b38e1aba7deeed72c88d45de151ad001cad3c8404f97c10ad163eaf9e614f6b483e73be44420ce466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779862206, "uuid": "997fda05-7d2e-4d25-951b-d1b4835223c1", "value": "T1AB14CF6677A44A2FE2DE86BD702251168379C2E398C3F3DE28D451B78F167E10A472D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779862206, "uuid": "435992a2-c69a-4867-a7b1-a70a6b6f9e51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779862206, "uuid": "02dd360f-7661-4f62-b924-c6afd9b0d23c", "value": "6144:sLV6Bta6dtJmakIM5Is7UBmOKqVotp/wK32S:sLV6Btpmk0QmGuAK32S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779862206, "uuid": "c3804490-5ede-494d-acad-7174dcaabc2d", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779862206, "uuid": "0eacb4d9-3237-4237-a31e-ef2f68cb76cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779862206, "uuid": "3f97f297-f26d-4385-9cb8-02d1683795de", "value": "goldenscissoreindhoven.nl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898686e5-59fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779908518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908518, "uuid": "c74daaf9-257d-4ebb-99f8-f76be61765c6", "comment": "Malware payload (Mirai)", "value": "8ef363912ead93360c641c3da2dab11e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908518, "uuid": "5750d45d-cf85-4d07-96df-f457dd35b025", "comment": "Malware payload (Mirai)", "value": "b1bd316c5fb6a3fd724ac2eaadaba2cb48a5733868c4416d3b2b7994edf8d3d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908518, "uuid": "e03edf93-27a5-470c-8dbc-991939ec6307", "comment": "Malware payload (Mirai)", "value": "eb0c98e6a5660778947519c3da5b6f5b4ae60506", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908518, "uuid": "3ea9a560-cd20-44bb-bbe8-ddeaa382a059", "comment": "Malware payload (Mirai)", "value": "d60fa70d865562ea1761e16b45702d58c91e68e9fed071f4ff08d3e7775301a6dfd2f5bf601befcf13db7f903f79762b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908518, "uuid": "11eb1022-beae-4045-86a4-f7ab4863bd77", "value": "T1B6732B81F54B80F1D847487090BBF33FCE31D6954175D66EEF689F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908518, "uuid": "d29747de-a607-449b-9307-6dc60678dadd", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+ZsbSSfFWLIk1Q9j+Lxty4AHk:uVFrPNQn+WVQ3EXVUk29jgxOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779908518, "uuid": "84886b86-b647-4eaf-b9e0-7f63005f66ff", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779908518, "uuid": "f09fa5ac-7bbc-477e-a8a2-f1936c1bf0f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908518, "uuid": "486f5bf7-422f-47fa-afad-61d105a9d4fb", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a884354f-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880653, "uuid": "3e7c254c-81f5-4738-85ec-220f78e93b01", "comment": "Malware payload (Mirai)", "value": "99b10288d1f7c50e96d929b0c8fa64ab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880653, "uuid": "373ffb23-0764-4de0-8da6-ca740a6a3ddd", "comment": "Malware payload (Mirai)", "value": "b1e91dc6f2548a7cee963836ee59d78cb31bcb016f26f0273c36284b2bfe6957", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880653, "uuid": "c49718d6-5469-4d07-94f0-2293046d8836", "comment": "Malware payload (Mirai)", "value": "1286902a08ba983bbe62bb6b61eda3b2ae0321d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880653, "uuid": "d5672053-d83a-4758-a88c-6bb37f115f69", "comment": "Malware payload (Mirai)", "value": "af7e033106094dfd81fc23abf81201493aa97675c55c6820fce37be90fef7ae61a26b34c33f49d1e7e12646c1342923a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880653, "uuid": "b0ecfa44-e11e-402a-b6db-e9002155a2c4", "value": "T1CFE3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880653, "uuid": "12b378aa-b5bf-4aa5-883b-d9828c2d5be8", "value": "1536:p+5TcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxPdbK:pWlybKpzEOfGQ+vEubTt4ouftL4bdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880653, "uuid": "cea24bf0-ccf5-4c9a-bc35-e2d95330c3e9", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880653, "uuid": "9ed0d025-7b47-4a68-8439-e1e4ec3b56c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880653, "uuid": "0438208a-d9ba-4434-ab02-8f1ee908d3bf", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb48320b-5a02-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779910320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779910320, "uuid": "63350ca2-b879-4d28-b1a9-2685e847b2e6", "comment": "Malware payload (Mirai)", "value": "afe9c086d37b76165b0d2e33c133d974", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779910320, "uuid": "e6cd3934-4d76-4fd4-a4d2-d033a51134af", "comment": "Malware payload (Mirai)", "value": "b2b94def9498c06eeda051def224345e602ad6509caa770472c9b3c83ae7ce0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779910320, "uuid": "c89e7f03-7d06-4954-bac8-5fd0997993a3", "comment": "Malware payload (Mirai)", "value": "363ca9783d69027fef174d020d2ef706c2ebd4f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779910320, "uuid": "603f20f0-944a-4d97-8d22-6051978f968c", "comment": "Malware payload (Mirai)", "value": "482aa8c31f9ec8fbafae166afacebc3f8136181a417684be659b9389f90818a971018ca7364c45a5cfd7aaab1b64d9b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779910320, "uuid": "84709f92-00b5-4a38-b861-8e45aa501ba8", "value": "T16AD3AD97B74F1450C82106F81BC76BAD3E2325114E2B9AE67C2E373E6B779DA18063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779910320, "uuid": "46fafca0-5750-4621-b84e-c120a7304c1f", "value": "3072:M7N3D+eh9pCO1Qi3VR/f3mKiv3YKgXC3vZDadRq:qNSxOhVRnuvYjC3vZDqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779910320, "uuid": "abcc6427-3abf-452a-9bb0-9c1a8b916659", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779910320, "uuid": "1261c1d7-29ea-4e9e-920d-88d2dfa35cf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779910320, "uuid": "b40208cf-bec0-4b7b-9501-cfa92a7a9f45", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd2fac3-59d2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779889707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779889707, "uuid": "4627e5e8-7e05-497d-a111-871df83bd2d0", "comment": "Malware payload", "value": "8b5c178958f2383b7a8194351c67ec03", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779889707, "uuid": "4a5503db-33d2-4f7b-a171-6a281c1e5352", "comment": "Malware payload", "value": "b2bceed4ba41a4ca792e45c635d72012e56d0964e13eb6ed23e21a5e249446e8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779889707, "uuid": "32aba1e3-36dd-4da7-a370-df0cd3298513", "comment": "Malware payload", "value": "a9d8c6368a7c7eeb82d738baa11e1a2e07997b32", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779889707, "uuid": "745b18e9-f8ea-413f-8a2b-c50760e855d1", "comment": "Malware payload", "value": "f58323d98d181eb6421d4043f5e483c2ce8a6049f74160933e21dea3f2eb0b96f08e4b61bc881a105d33fc6d4a2ee5ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779889707, "uuid": "cf3a6bc9-894b-4a04-90c3-f6731edddcd4", "value": "T13D137D6566953C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779889707, "uuid": "4a589e21-f934-4624-a039-df040cbeab71", "value": "768:GXRWNGxVY9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:ilxfcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779889707, "uuid": "96ac4148-5bb1-4845-9382-71515c5a69d9", "value": 45526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779889707, "uuid": "193ff3fe-63a1-4de5-b673-953b4465f6e5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779889707, "uuid": "28424eb1-5fbb-45db-b1fc-635ba4a0027d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e668ef9a-59de-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779894930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779894930, "uuid": "fc1bdc95-2e6e-4623-a279-83f650bed9bf", "comment": "Malware payload (WannaCry)", "value": "040ed1613a8aa0d8caf59474ec94022e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779894930, "uuid": "62fb4296-28ce-4990-b25f-9b14c35996fb", "comment": "Malware payload (WannaCry)", "value": "b52a8049ef2a2af8acfbfc2fee8613bff13244d6c9e45c96370febf929ed72eb", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779894930, "uuid": "2fdb7755-7397-467c-9cba-dd3b1c64398e", "comment": "Malware payload (WannaCry)", "value": "e6ef839a42ac99c83356c95928f9a619c6a56dc8", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779894930, "uuid": "9404dd0d-d1dc-433c-88ed-b2a877a558ae", "comment": "Malware payload (WannaCry)", "value": "3f58aa550c66355f802ed5af85df60c331d247c900164d7b2482175a6bc3ed5dca2e2e18b25374d026a66094d6420fe7", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779894930, "uuid": "c60f522f-d2bb-4db7-b7c8-6ca272495e67", "value": "T1FA363358726CA1BCF0450EB444B38E1AF7B37C5967BA4B0F8780866B0D53B9BAF94741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779894930, "uuid": "82596505-73a6-4e04-a7e6-58dec1d5d551", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779894930, "uuid": "8e41466b-f398-4ba0-8843-0cc2434ce514", "value": "98304:D9zqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:D9zqPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779894930, "uuid": "13aeba0b-aba1-4e61-b48c-feac920df656", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779894930, "uuid": "9b068192-ba73-49a1-9b44-ba0c73232ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779894930, "uuid": "233322de-2564-4c07-9ae8-5fe2f27f8d91", "value": "b52a8049ef2a2af8acfbfc2fee8613bff13244d6c9e45c96370febf929ed72eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6349ec-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880906, "uuid": "c9288a48-1c8d-4b0d-8c83-71dd135b0046", "comment": "Malware payload (Mirai)", "value": "a69c727a8ffc4b9eace8e73fc3138de1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880906, "uuid": "64c214a6-e264-42d6-99d0-f5ef4d1fa6a7", "comment": "Malware payload (Mirai)", "value": "b5c95b8faafa79e760acd594d8d02e08cca0a2d321516cf956902c9dec79351a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880906, "uuid": "6b57bd9a-152d-48fe-a2ab-3009fe76eae4", "comment": "Malware payload (Mirai)", "value": "b576b5cfff3fc4cbfea6ce181ed50610b3d8b3a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880906, "uuid": "288450c5-4848-47f7-a1d1-756e37c46ba0", "comment": "Malware payload (Mirai)", "value": "89174f09e4543f7b3d8d003a908cc7f56576650981ff43cbaf248fb824da6bc9a18f5eb2bb1e741a266cb44d0100117c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880906, "uuid": "be893e1d-e111-406e-a049-ec62db4c8394", "value": "T1E52422A7427D586FF04083F584705713808F6FEB2A569328FAEC1C92567E2904EA95FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880906, "uuid": "729c5c42-c741-4282-a792-c4bf864cca2b", "value": "6144:0B4vGU1sZwfQKzqYEEhY+QN3vAEKOrVkXgrmlERIPJlZ2:0dESwfQKOnEO++3YlQVkX3m6XE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880906, "uuid": "ec2c3a62-38f6-45b5-9db4-d090ce30029b", "value": 225732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880906, "uuid": "2545760e-17d4-4f62-91c4-bfd1eff86232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880906, "uuid": "651d2194-15fb-4191-bb40-bea35e997294", "value": "dlr.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3dbf983-59d9-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779892805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892805, "uuid": "faaca895-6015-4b2e-b846-3bbf05d55f6e", "comment": "Malware payload (NanoCore)", "value": "2944fcbdca7ad0939db2088fc8a49dab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892805, "uuid": "996d192e-346f-4f3a-8af6-34a6457d9880", "comment": "Malware payload (NanoCore)", "value": "b6008cf64e5ec8d7756cd1fc8e0e76b7e420529d41e83b66022b76ebb26b1eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892805, "uuid": "dff618d6-3763-4f99-9770-7d06b8146669", "comment": "Malware payload (NanoCore)", "value": "5d1bf37e7b005d4ccedc2ee390f0816631c2a888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892805, "uuid": "af1dc039-67a5-49dd-b069-e6d5823d56c2", "comment": "Malware payload (NanoCore)", "value": "57640deefb1b1300f7391879fa3b98b63d7a0a463f1b251961b3aac2fc2e2c6470f811e66f8ac9789aabb9bcabe2ee1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892805, "uuid": "49091909-6c73-4986-ab13-29e64d013f5d", "value": "T16B14CF267BB84A3EE2DE8679611202179378C2E3EDC3F3DA58D454B65F267E40A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892805, "uuid": "51cb9576-6101-4f5b-80a0-16007c9eda89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892805, "uuid": "1e29dca2-dd51-4b15-ac8b-2192416bd85f", "value": "6144:MLV6Bta6dtJmakIM5zplNzULgm7SB7e+3:MLV6BtpmkQzcb87ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779892805, "uuid": "144fbe94-d26e-43f1-87dd-a243f01c5f89", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779892805, "uuid": "0feb4e73-705b-4f5d-8d74-e22e548ba2c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892805, "uuid": "ee179254-c1c2-4344-b960-89ee9356278f", "value": "mmdx2.ru.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1fb8243-59b1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779875569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875569, "uuid": "d45e9a79-db9d-4c99-b86c-760451a9dc36", "comment": "Malware payload", "value": "615b81f01c83afeb34c82c816b51093b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875569, "uuid": "af51fc30-a22f-45e8-9159-d0d7ee0aa285", "comment": "Malware payload", "value": "b7635ff656e7caab0c33132506be6b1a503e62b374e7cee2b580c64c2768b7b6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875569, "uuid": "e5bea578-0106-4a47-9879-a675be22c1b0", "comment": "Malware payload", "value": "83bb03961aca611d7ce45f43a84be1d5abba8c86", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875569, "uuid": "008b457e-1d6f-45b4-af6c-b0195941e3f9", "comment": "Malware payload", "value": "51d0ee8058a529cf296be698b5625c04d55d8f76a10404c0a59862b903c690206aac4499247a3c62306769043686941f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875569, "uuid": "edcad3f8-ea4f-4c33-8333-0afdab6a7e33", "value": "T147137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875569, "uuid": "0ee264f4-05ae-4317-9178-ab2dc7208a7e", "value": "768:7+39GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:7+Acy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779875569, "uuid": "d58a1c27-89e3-4e27-8730-bfa07c4593f7", "value": 45506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779875569, "uuid": "68e5ab6d-c46f-4b63-93a9-37eab83e3bc2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875569, "uuid": "5d827dbf-ffab-418d-b318-8111a50cd1bf", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f499434e-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880781, "uuid": "16dbed8b-f21b-4933-8140-26a45a887492", "comment": "Malware payload (Mirai)", "value": "b24708eed2e17923a8401aa3e38c8f56", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880781, "uuid": "9888221e-04a9-44be-b6f5-fdcb3b0926ad", "comment": "Malware payload (Mirai)", "value": "b781e670292817f410958bb92c88ce608b207ca896f02e945e4b13cc99e37c88", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880781, "uuid": "8d6715eb-f837-41ed-9ab4-564285148625", "comment": "Malware payload (Mirai)", "value": "539088b267ba39dd3f7f7f7537f17fc62ccaa3e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880781, "uuid": "9ae3e7f3-09ae-474d-8930-92719c16f563", "comment": "Malware payload (Mirai)", "value": "f831185461bf4d9282622c21747c52d5050ec8b281d175bce3c933b3e56c991a63d41d00479586974dd62b6ff440fcb1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880781, "uuid": "8b58d3e6-7149-4ae3-845d-ffff237f102c", "value": "T12DF33BDBF801DDFDF80AE73748130819B130BB9260924B376267796BFC3A1950967E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880781, "uuid": "0edbaf74-c9d7-4d51-9917-30530c456b05", "value": "3072:+ZF1b4TPQI8gR3YQRfrFDDLjaqG5uVOjbixLucF0HJvNyElqX:C18TPQI8afrFHLbG5ELucUNyEYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880781, "uuid": "bcbf4cc0-d2d6-4e85-b7ed-2b2a8ffdc103", "value": 163692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880781, "uuid": "88c5a808-e221-4ee0-94eb-419ba69e468a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880781, "uuid": "c9b9afb3-42bb-4d40-97be-aa3e77fc82f6", "value": "micro.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba44139a-59ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779887984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887984, "uuid": "d93edc5c-a418-4117-b7a3-4e47c441fe90", "comment": "Malware payload (Mirai)", "value": "2b2b110a48b9863a5122634c357df3fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887984, "uuid": "0495c5e7-1464-4147-ab5a-08ad458e9ba8", "comment": "Malware payload (Mirai)", "value": "b7b4026232f5086a15a148ecc5d9db7f847f46672f4eb20d870fdb3dac894562", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887984, "uuid": "cb55699a-9bf5-4f71-bdc4-6ec90d06260c", "comment": "Malware payload (Mirai)", "value": "20a7e5a873853290d5403c38a1e8ad645b1a822e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887984, "uuid": "a076ee73-3fd2-475b-9061-115a16e77af4", "comment": "Malware payload (Mirai)", "value": "0354f2ceb4320e5b901f41a4a5c458b8167db1580aeeec989b48b12cae1aa3525d58811184a83439e60f951f4926cb4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887984, "uuid": "29331d68-1a7d-4fb9-81b9-1370fa665a2b", "value": "T1E933F1F34973A7AAD9362939070A4FC8A51F7CC2E7041E67572550B3EAFB2A41C01997", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887984, "uuid": "793b07d8-ba6e-4428-ae2f-5dd8f707c426", "value": "1536:TXVnOHPoJ9gUf5OxTlzJQ9is+tfJ5wP9F:pOgpfsLps+tx5wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779887984, "uuid": "83729980-344b-4c1d-befa-db765a6e1f7e", "value": 54916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779887984, "uuid": "9ecf0a13-3dd3-4eb5-9553-28a523d859c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887984, "uuid": "5bfc0f3f-7d9e-48fe-bcd9-6d2231db9aa0", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eec1524-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880959, "uuid": "05fba9bc-e157-4773-9278-e18dfd716a71", "comment": "Malware payload (Mirai)", "value": "9fcf296c8762a98cdf4d48eaf66ce57d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880959, "uuid": "932ab8fd-268c-4611-9eaa-62b9805a5df6", "comment": "Malware payload (Mirai)", "value": "b8b2608503deb361648c7a3b0ff4fcb29f5f72ce22fbc6f28b8e074ffc6b943f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880959, "uuid": "23039f32-a0c1-462e-adc5-244bfcc6407c", "comment": "Malware payload (Mirai)", "value": "29f62e2875b23694a3f5df7d8f786ea8c5a89ff7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880959, "uuid": "f34e5dcc-e58b-4775-acfa-0ead5155ff2c", "comment": "Malware payload (Mirai)", "value": "5c8a61869f306a780a89202a525aca827300d6756179ef7b21ec754abc9e16e31bcc84d22fa68222a2c49fd6ad5d6391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880959, "uuid": "1ec0fc49-8e5f-4308-922d-4ecfa397a39a", "value": "T1EAA35BD8E683D4F5EC0301715137EB73DB72F13A6129EE83D7A89D32D9A1940DA1929C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880959, "uuid": "7056564b-8178-46c8-b66e-204a8ad21e05", "value": "1536:xAu6pZ4cUY06F2e5F48omTI+HwYKHVf5UQxzvNuX1QQ5mH8AEVF2SO48:qf2cUn6F2GmYK1f5UQJgXWQ5VAEXPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880959, "uuid": "089b2a79-287f-4e7d-9849-c84d1946b91e", "value": 106920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880959, "uuid": "9964dfa7-73f4-4742-9e48-6d0224e2ed14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880959, "uuid": "58b76e48-6195-4f90-85de-4b84e1d87ea5", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c9d998-59ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779887873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887873, "uuid": "d9269ebc-c6e4-458d-8895-dc2552cf523c", "comment": "Malware payload (Mirai)", "value": "6551f4b3ba46026853a7f748ae667142", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887873, "uuid": "ca0aa061-c61a-499f-97a6-5cc6134f22e3", "comment": "Malware payload (Mirai)", "value": "baf44775d080d5db33d8c1dabe497488034af713b939df2800df112cd4c1b496", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887873, "uuid": "32d658d1-f7fc-42ef-ab5c-38d234beffc1", "comment": "Malware payload (Mirai)", "value": "bc27c3fd7d131fdfbe6d6a076bc055afa1630fb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887873, "uuid": "d735f377-73f6-492a-a281-b0dc353360e7", "comment": "Malware payload (Mirai)", "value": "47496085e9a412599ad1a78ec55aa3f9d551803e919ab96c55830c84b1a48117b083a4fb417c2c9874ab0a64441f4a46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887873, "uuid": "40fadd14-2e62-42ed-8691-55de960a4c76", "value": "T13BE31956F8819F12D5C151BAFE0E128E33131B7CE2DE72129E246B74778B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887873, "uuid": "6acbcaa8-287f-4e19-a904-614c2bf6a68c", "value": "3072:pgJifHQ+MiEtZLayK7YVJMX1er38P2D3q4SzHNhjp:F5gtxayKUVJyS39D3gzH/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779887873, "uuid": "8fc82315-68b3-4ea6-86dc-43ed62e4501d", "value": 147828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779887873, "uuid": "fea0157a-86cc-4281-a66b-f032dcb5fe1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887873, "uuid": "370291ee-52e6-4aa8-a3a6-9b9d72d8e0d9", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26f1818-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779880777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880777, "uuid": "80eafaeb-9a17-4fa3-ab14-d6b55555da94", "comment": "Malware payload", "value": "5b9361f7f13adae0a221b942743f9c34", "object_relation": "md5", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880777, "uuid": "ffaf9727-c7ac-4ab1-8b04-b4712c814e04", "comment": "Malware payload", "value": "bb7575dfa84314fc58f49675aef0ea51ef6020ee1d70866b6b4ba4412b7fdbad", "object_relation": "sha256", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880777, "uuid": "1f5577e8-b63e-4fb1-a326-d13dd25730c7", "comment": "Malware payload", "value": "4e98352e31b89dd0f56fe768723902b0053f73ae", "object_relation": "sha1", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880777, "uuid": "0fc84021-c8e4-4ed6-b4b9-88fbfa165fcc", "comment": "Malware payload", "value": "de275f6fcb2db8f3aca2653313787d91038e9738e059fc39e82ec1119b44f516b3cad88608ec688f6f6113a23211455d", "object_relation": "sha3-384", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880777, "uuid": "45101858-c49f-4710-ac1f-440f7b31abd6", "value": "T17AF63323FF496F68D293BF3E60544B034E1CA5B112AEF79F983945C29C975C35B0A622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880777, "uuid": "640ce099-64c4-4288-8560-ab5332c091a7", "value": "393216:xpLSqCB+kkfkr1HE4v+C/BIBRk2wLDTbQ3Y0K/wi1k:TW0krZE6+ye8vXYYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880777, "uuid": "cc413030-db47-462d-9a5e-b8560ad9c084", "value": 16059412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880777, "uuid": "5e771423-6532-4f9e-a906-4c42361955c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880777, "uuid": "ea1c445e-cb56-4c22-8050-24a01359a68f", "value": "config.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e734fc38-59c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779885912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885912, "uuid": "a0d2d0f8-3151-4dc4-b1e7-807c9994d05d", "comment": "Malware payload", "value": "601db819a34f05696ab9542794667fc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885912, "uuid": "dd598d52-2a28-4ba5-84a4-4c85e17ad5a9", "comment": "Malware payload", "value": "bba436a7970f31cf3f15a6cb23fa9b3e13d82a9ac65416843e2a81ae852c63d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885912, "uuid": "ba45f2a5-87e9-4a2a-b224-0be8e0c8b568", "comment": "Malware payload", "value": "faac5a6abe926956f18bfde7bcad6e4bb772c51c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779885912, "uuid": "c55c5924-4d31-40c3-a2b3-952cce955e3e", "comment": "Malware payload", "value": "df5754d81d8bcfe42d68df4c3585446e7a71b8a1d8b635786fb3c3776e04ae5f8aa7423fa5d78dc8f70663605c9ea59e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885912, "uuid": "52853de7-1282-407f-9e12-15a74569e777", "value": "T1AD24B215BE32078853BA172D4DD89F3AF496349F13748A3C6D0A80F1A9751FD6E9832E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885912, "uuid": "edffdfd8-c377-457c-a991-c5455748ee39", "value": "96:pTpUp+jKGvC/TNxdzHCPP57iEfbFb+0pDaXqhjpDnb29QZp9Mv2aXqhjpDnb5+jp:ppksyiEpgqHkH63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779885912, "uuid": "f829aba0-9393-4678-a5f0-e0c77ca862d7", "value": 219458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779885912, "uuid": "df2417f6-6c0a-4477-ba3d-1325a7fc0c7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779885912, "uuid": "6de49743-9c3e-46db-a07b-7e802266c83d", "value": "glutatheyongoodforhealthme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b79e43e-5a27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779926077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926077, "uuid": "83f6e577-6997-4eba-acfb-f150273c28f9", "comment": "Malware payload (Mirai)", "value": "2a4ff0be6a18b3a52e3a0716f6961dc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926077, "uuid": "b580dbb4-b84c-4aff-a569-fa6230912de8", "comment": "Malware payload (Mirai)", "value": "bc6b1d13c0d93af10915307a3796a3f10229e24a4f4aa0b1a759e87c8af10b1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926077, "uuid": "fa7a32a2-8a83-4918-a1bb-c6846445c7d4", "comment": "Malware payload (Mirai)", "value": "eaafec7164bc353ba0ceb2880ac2c2fb7a9b75e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926077, "uuid": "6b9c9993-303a-4323-b6a4-bd1703c908de", "comment": "Malware payload (Mirai)", "value": "d09e644aa5a1d7984ba64d4a11c4eaf57014d05d44af54cb76472121dd6aaaf4fcc53a3e6f049b57be01945cc88aca5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926077, "uuid": "f5c1a2c4-d85f-4e0c-994f-fb8fe8d538da", "value": "T19914B70E6E328F7EF6A9C77547B78D209B5823D612E1D641E1ACD2111E2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926077, "uuid": "456b9b16-b8a6-4055-9b71-1c83a08d9bc6", "value": "3072:HaH1thRaWW4NV/CTaorDCb+bxfSDAsw6hh1PrA:HaH1thgWW4NdPktbUDtHrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779926077, "uuid": "97cbb609-d3f8-48ee-a30e-1d9e3cf7107e", "value": 207860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779926077, "uuid": "09cc44c0-c471-47e5-9ce7-185709bfafce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926077, "uuid": "6840fe90-bd01-47b2-b93b-0dfa22378c96", "value": "SecuriteInfo.com.Linux.Mirai.9816.2221.32376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc61578-59cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779887269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887269, "uuid": "cdfd60d3-2e92-44ad-9a8c-445e5b389ab9", "comment": "Malware payload (Mirai)", "value": "af09d31365a5b6a1f3348cd6752f5452", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887269, "uuid": "de0e44b5-2e95-46df-96c1-1e267cc10837", "comment": "Malware payload (Mirai)", "value": "bcbddecad79870f20212118c8a2bff054d4e42a47fa14ce0e16157bb82ac4f4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887269, "uuid": "37415c63-7348-4650-8d9b-0ab80427e3b4", "comment": "Malware payload (Mirai)", "value": "8193edfe8b248f8850704c8696dea991c876b8e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779887269, "uuid": "8d1bab43-5e92-427e-9bf4-51889751c355", "comment": "Malware payload (Mirai)", "value": "cb268fa132f26ab1b03efc14c56bde4a06d270bb271dd741535afce5b621d93b127aae6e39c7c600e93838830060f820", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887269, "uuid": "febfb0df-84bc-40e4-888d-059d65448aae", "value": "T15C734A89F783E0F4DD070571116BF77E87349E121124DE6AEB94BE72AD32A12A11B72C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887269, "uuid": "4bd7b87f-9d77-4348-8fc3-d7aeb2b1599c", "value": "1536:j/hbkIpnCQ/1DxmW7/92BU731M4XoeYqAQNGP0L1r:tL9P1DxmloeneN+KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779887269, "uuid": "37063567-6069-421c-9040-ce9a7cb6b19d", "value": 78176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779887269, "uuid": "96a0964d-f696-4d25-8147-5b855df32cdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779887269, "uuid": "09f87803-d857-430a-9354-9d8520402d1a", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e6a131-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880649, "uuid": "53e18f3b-85d0-4713-94ee-49fcbfd19d27", "comment": "Malware payload (Mirai)", "value": "fbe0ac701ab3fb6e2ec53c925a39d234", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880649, "uuid": "712f9a9d-c311-4a2c-b46f-2ce8cc76239e", "comment": "Malware payload (Mirai)", "value": "bd1ee337714829b5c51d9c5029e65cc993382725f7db2964c49f015e077d1432", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880649, "uuid": "438a8e43-d211-44f4-aa3e-5a7019e56c93", "comment": "Malware payload (Mirai)", "value": "eb0fc1df0f72ce27ec8078bb429bfb0b58720069", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880649, "uuid": "a3d6aea3-7a05-42b5-adf9-d1b71cdfc2b1", "comment": "Malware payload (Mirai)", "value": "ea7c102c414ddef2bc54dca9b855e214be655044fb8825828ee3ed0a43dc558a9c8f4b825e7546a5783839b6d3fd2a11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880649, "uuid": "92199f75-1148-40b1-a334-636eecb14f2b", "value": "T1CCB30945F8405B17CAC666BBFF4E438D7B2A1758D3EE720399256F30379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880649, "uuid": "43d76642-a036-4c54-ac31-e59970a6f1cd", "value": "1536:P8KBP98SMw4VgooT047vy6OuMDFVPpNCF73el0qRwywwQ3wQ8fyYchpP1Jsh:0+P994poA4jYF9vCJ9CiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880649, "uuid": "1361f377-f565-462f-abca-e83737a70500", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880649, "uuid": "04f7adf0-1153-4344-86a4-c6dad9a4c689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880649, "uuid": "e8788723-56e0-452e-b197-018dad21dbee", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d067fa7f-59b7-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779878143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878143, "uuid": "606b8c95-ac3d-40f3-97e6-8ed5bb53ca88", "comment": "Malware payload (Phorpiex)", "value": "3f98e4e882842a7ff68be9900082b467", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878143, "uuid": "402f943c-638b-43d5-9ea1-a0253a8fc9eb", "comment": "Malware payload (Phorpiex)", "value": "bd75e4b71bf4768562738ea8b8f961cd451ad771f75f0e120cf781abc5ff81c1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878143, "uuid": "9fe3a40c-4650-4ea9-821e-1bbc207365dc", "comment": "Malware payload (Phorpiex)", "value": "0af1c9f299080cec43efd3dffc3d81729f955865", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878143, "uuid": "79dbb467-b2ba-406d-841c-f66feeb5ddbf", "comment": "Malware payload (Phorpiex)", "value": "ed8ab7366509f809b3678929547ce4cf1ea7da667c14f601a739998b5ce2786b0def63dc676d6aab55366e7cda52cd7b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878143, "uuid": "c293e616-20fd-4470-be29-539d09619adf", "value": "T1FA824B0FB9428216D1E210B05676863BD979987237C854DFFBD18A990FA82E6FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878143, "uuid": "cfddd215-321e-4937-ba37-a780328b30d0", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878143, "uuid": "db8c528f-b278-41db-a4c3-656041b3a5ec", "value": "192:GKSSCngTBv5/dVfTHD5DIS8qkle6I93fKUSvu9zw+ggSmOiMbO5Ot1EdkF4U93mj:QI5/dVf+jqk0RSu9JgPL7NWav8U9c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878143, "uuid": "89dcd9ff-d0f1-44ad-b209-2b07fe757d25", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878143, "uuid": "4533e426-04ed-4578-9a35-0064ad9b43e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878143, "uuid": "347b9b9a-cadf-49eb-ab84-63e6afa294bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506b5c52-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913577, "uuid": "196e6c60-8a55-440b-8549-3149b35e9211", "comment": "Malware payload (Mirai)", "value": "e02733b0e3d4f4c0c92f0218fb49dc42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913577, "uuid": "77740c22-6d26-44a9-a526-f82c9a9e72f5", "comment": "Malware payload (Mirai)", "value": "bde97d3f82889b6d801f3164cf571a705b0b4fb0155f3534920282f62041a9d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913577, "uuid": "4b3de299-2b24-4fe2-ac2b-6f5dd21755ac", "comment": "Malware payload (Mirai)", "value": "58fb480880193a3396d392156362fae31eed7aa5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913577, "uuid": "6b20d30d-1773-486a-87c8-57d95ff9226e", "comment": "Malware payload (Mirai)", "value": "a20fe41e30c916bbccfeff8299fd6a53ebaa45b126b32358105897c5f467c4dc5723c6319dedddf51443a9d28f51983b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913577, "uuid": "d4700635-50e1-4b9a-82f8-0f8f67485cca", "value": "T14273A70A7E219FBEFBACC23947B78A205644339522F1C585E15CEE015E7034E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913577, "uuid": "f14490a6-bd81-4695-b83f-1baa863db5d6", "value": "1536:SBNyFFDulIZ/ZBlBJf5eTy/U0vuTdcTwYDT1I8um0DUx3:sNyLDYOp/U0GZcsW1I870Qx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913577, "uuid": "c58212bf-0568-4568-b5db-f18e2c846699", "value": 75624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913577, "uuid": "7e72ece5-9c6c-4c57-bfaa-fe8e5ecc9508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913577, "uuid": "b7adcd09-c710-40c4-9ac4-d0f9944d6410", "value": "Akiru.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5536c8fc-59ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873212, "uuid": "0657b8e8-69e6-4baf-9dcb-f4dfe4f1d68e", "comment": "Malware payload", "value": "94ce98e93400a8a25315600ccef4e699", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873212, "uuid": "cb694429-2896-4719-a4b7-ad26e73b812b", "comment": "Malware payload", "value": "bdfbc0a1814e531c201bd7e1ee1aaff3ccad212da81435233adb5becfbac2a57", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873212, "uuid": "2c53b50f-d3ba-46ae-bef0-80fccf47c487", "comment": "Malware payload", "value": "7a747aef0d7ec7a0dccfa7dd6b740017315340f6", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873212, "uuid": "e750b51f-0df1-44cf-9040-5e6db1cb0c14", "comment": "Malware payload", "value": "5f11e54c79f4cdaee75eb3bb08fb62fe83dd647b9f6b494ad0cf0b5fc95f8349ecdd99bab08d573ffb1b502739f78208", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873212, "uuid": "f5ebb462-7686-4f49-91cd-4a01ef35732e", "value": "T169217845696383C87DB22A24C27DA102B0D3521BA4D0FD64F7CCA042BF21653EF0A1F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873212, "uuid": "e6377eb7-ce88-42dc-bc0e-fc2e2613c60c", "value": "24:k42cLLhJwYgTjMTGqoLldp6XlH0RY5lTlqh9TAKUZFBKG4i19OerhlESjLBKuYj5:k4lL7wbTzBMXva4Zf1h0o9y8hNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873212, "uuid": "bf8e59af-beef-4f9c-a908-0d4288be51f5", "value": 1298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873212, "uuid": "966fa04d-3500-4c6e-9939-d99b73b1bdf4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873212, "uuid": "6353ab2e-5579-4ce3-b2ce-c0a5aa6ba62e", "value": "detalle_deuda_correos.zip-IQVFEM.hta.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd6ca9e-5999-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779865064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865064, "uuid": "1beb35ac-1100-43f6-bf47-6ed77a67787d", "comment": "Malware payload (Mirai)", "value": "ddb189eab3938bfec66a8aa4574cb802", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865064, "uuid": "1ee9a1fb-aadb-471e-abbc-4ad8e3c1e67c", "comment": "Malware payload (Mirai)", "value": "be69a4cad8d9d8ace9254b1bd375e83dbf97a7111862515ae20085a70ac9070a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865064, "uuid": "f9401aeb-bfdd-4663-be00-d85e901802e7", "comment": "Malware payload (Mirai)", "value": "ac810aec793a8d4480128e466d044ab1e067b0cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779865064, "uuid": "357e0c11-7dc1-4ad5-a579-ebc200ca1835", "comment": "Malware payload (Mirai)", "value": "45c1e370590fc21b5b74685ee1f7be9e1139af48f6d205d9b4cecb03686bf7d4da14455e7dc19119688ba63d838c5fe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779865064, "uuid": "ed846f85-9360-443c-bcfd-f4b55e91da17", "value": "T183645413D9154595E1648CE222773385AD4B83BB88E732D3ED5B49A1FF3182B41BEEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779865064, "uuid": "86b3a63e-9595-4f83-a5b3-b07acef1ef92", "value": "1536:/LcwTSeuXPgKwiANPOkfIwjN/VTIQjVxFoKFbM1YYHejTstmGbLcZNHNuX99Uc0:/YwTStYDNPBpjfTIyxla+joCI99j0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779865064, "uuid": "bba844ba-806c-4240-902c-caf8f1b4ecac", "value": 317660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779865064, "uuid": "b7388bc3-6766-4b7b-8582-f9a0f2bc590c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779865064, "uuid": "6514e423-af6e-4a2d-b01b-18505fd28aa1", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ff29b5-59e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779898710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898710, "uuid": "f1ab98f5-5f17-4601-8d7a-ca8d85c30733", "comment": "Malware payload (Mirai)", "value": "47ea2d1e415a7a75e57533a82499d1b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898710, "uuid": "dc22ed7f-adcb-447b-8497-c9080faf178d", "comment": "Malware payload (Mirai)", "value": "bf5f932aa8d36a44863ea7f91e2b0ca2cae8dc6726683dd5d96f8d4c498e8921", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898710, "uuid": "e915b8c2-9b8b-48a3-8d34-72a19e336d48", "comment": "Malware payload (Mirai)", "value": "8e00b9afac53d018f50596977246d2bf3b1dfd08", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898710, "uuid": "df6cccb8-2b81-4b79-bc63-f5fe9c749147", "comment": "Malware payload (Mirai)", "value": "c9420153a06d42029791be93a1d340e32dab6cc709d695e43dd5d8abddbf6766c671bcf33fb480aa99b5c2f43b19d16c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898710, "uuid": "873d4301-2fe1-488c-be4a-616d61844c2a", "value": "T101F32945BD418F13C5D721F7FB9E4289372A6B6DD2FB3103D9256FA0378A8D60A3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898710, "uuid": "b6b98063-be1f-4d84-8f75-e5078b90d8f7", "value": "3072:NCweNVDEXz6s3O4JiHH5rAsR0t/W0ukM8q:1eTyZ3O4JsH5r/C/W0JM8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779898710, "uuid": "f0d9f8e2-8084-466c-b5b8-97a46d5eb9b4", "value": 158796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779898710, "uuid": "a0b13e8a-7455-4835-a1e8-68209db627eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898710, "uuid": "1f32ce48-ae5e-40a2-8ffb-b3d9ae425bf3", "value": "nova.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9f8a79-59e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779896551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896551, "uuid": "f7ce7dcd-e4c8-4d67-867e-e078e766ff71", "comment": "Malware payload (Mirai)", "value": "cc4523a7c2c4e5fa7329e29e3e7a0ab8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896551, "uuid": "2f5dd922-7994-4cb5-9d04-b81bf1f7fd7e", "comment": "Malware payload (Mirai)", "value": "bf92258111bd04544de0b669835236be93558993e680998b9499d8af603a8b3b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896551, "uuid": "4ecac1eb-0ddb-4320-b225-01f69f0756b8", "comment": "Malware payload (Mirai)", "value": "b7f9bba0a97402e3c0efaf7c5b90677a70d7462b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896551, "uuid": "bc157006-514c-42d5-99fd-85c46db795fa", "comment": "Malware payload (Mirai)", "value": "e5063a2fa3802e10abc6c05a884ee15d3f723276b7f302fc68c07df40fce39c48b36cba91f6d48440a05a218e55869ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896551, "uuid": "8c6cfd9f-d6e2-48ad-a47f-98a995e41301", "value": "T14FE32B56EA418B13C0D61779B6DF42453323ABA493DB73069928BFB43F8279F4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896551, "uuid": "e8cca1de-8639-438c-98ac-eb462af8a9b0", "value": "3072:iJLceVpExfBRc0aAHbz4Nb4JJXpIe1F2EXMknM/98wAY:iJLcdG0aAHbz4NsJJfH2EXMEM/93AY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779896551, "uuid": "408c3261-8be7-4f51-b05d-9e111894ad53", "value": 150610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779896551, "uuid": "4298096c-2ee1-4e4c-8043-d45c99988af1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896551, "uuid": "9baac0b1-a48b-4247-9a0c-ed5bd4c0fdbd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30724442-5a06-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911805, "uuid": "effc8f02-66e9-4120-a66b-d1f603b9e52e", "comment": "Malware payload (Mirai)", "value": "0bb1693c6f77736355cc7548e51990ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911805, "uuid": "acfdc093-dc9b-4bfd-9253-d936c3de5eff", "comment": "Malware payload (Mirai)", "value": "c01796bdbe03e1271c2c5cb4bae14c81590cf56165959f63f6820ba5f96b8b9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911805, "uuid": "d20d4cd2-bf0e-49b8-97a5-7605bd3d07f0", "comment": "Malware payload (Mirai)", "value": "9685cf0e86842d22c2be0bdd4dce01306d687321", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911805, "uuid": "ef11f6f5-e92b-4ab6-95b8-0d66ad3569f5", "comment": "Malware payload (Mirai)", "value": "fa56b1faa92c6c548d843ae68a5ef7292a8d37c3cda648f828d6f92956b8ed299e45e54e764daeac3219e64b0c3bf9cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911805, "uuid": "acdf7c97-ff84-40d7-8681-83bbeeeb6247", "value": "T1CC243A42EA408F13C0D717BAF6DF4245333397A593E7B306A924ABB43F8679E4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911805, "uuid": "11cc0bd6-c6bc-45b6-8d07-e4ea712f85fa", "value": "6144:tvERpNp86wShWU3NmaDTsOZWuv7wKemxrkQ9M/RBGnwmH2WBLB5n:iRpNp86Z3NmaDTsOZWwMgyQG/enwmH1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911805, "uuid": "30f010a1-36d4-4d4d-8f9b-cd44c1104d7a", "value": 225035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911805, "uuid": "32ecc6ce-3f95-4235-8c6a-2619cf63604f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911805, "uuid": "8536c193-741d-4e1e-93f3-7e3cdf52aed3", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73fc1f6-59a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779870424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870424, "uuid": "6ded4d99-64ba-44db-af83-6deb499e03a5", "comment": "Malware payload", "value": "fee167cd670b3ef21fd7cbd1b5dd8a9c", "object_relation": "md5", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870424, "uuid": "4f46c544-a1dd-496e-b280-e679f470a51c", "comment": "Malware payload", "value": "c030d66960163ba9e819ff8d379d0f58ad227a3f2b1c5e013236e7bd756d8263", "object_relation": "sha256", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870424, "uuid": "6ed36e4a-0338-4e29-8bd2-856f6dc690b9", "comment": "Malware payload", "value": "1df5301426916c80e04517d88f38f624d1e9956c", "object_relation": "sha1", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870424, "uuid": "a3c71c60-3cce-495f-88b2-cc2ae389cfb9", "comment": "Malware payload", "value": "b93883cd0303d83bbe835b88b3e4c486fc2731aeadcbb67a07ca735a5e396e2fb79dc1a11e25acb632aee9fa3a93fa45", "object_relation": "sha3-384", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870424, "uuid": "45153f67-5a70-4fe2-81ac-4524f43b27dd", "value": "T17241AE187E40B3D513E6DAB7D83B68CEEBB9C8D54486CD86B226F406EA00615F5E1337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870424, "uuid": "6d694e5b-b186-4eb6-9089-1ab47daeea58", "value": "48:6yAuGFcaJNqZeFG2VG1t/XyADYnbOZEagA46i+0Mu5:OuGFcahFG2VG1dC2YnbOg7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779870424, "uuid": "06535211-b914-4ba8-b764-26d5aae06565", "value": 2185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779870424, "uuid": "5f101b32-3e3a-4478-ab8b-b8eb8e570fd5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870424, "uuid": "6896eb72-ad2c-4df2-b53a-e5ae9fcae819", "value": "c030d66960163ba9e819ff8d379d0f58ad227a3f2b1c5e013236e7bd756d8263.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef62f6b-59d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779892019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892019, "uuid": "7f83c93f-d910-4056-8c8f-b6bf379ae666", "comment": "Malware payload (Mirai)", "value": "9249ed59ea3cb2cb7d4d4d8ea8318758", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892019, "uuid": "803fd5f7-4b8b-41bf-be70-751c2be79d3f", "comment": "Malware payload (Mirai)", "value": "c0f3d3ae6e668e99303e447f21e1bddd403f31c7908a642622a12a7a8f0ae391", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892019, "uuid": "266d84e0-0d5d-47a3-97f1-93ae0bab8374", "comment": "Malware payload (Mirai)", "value": "66c62132f1ece4464fefa309a931e9477b52d81f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779892019, "uuid": "13942314-f817-45d6-96c6-e2b6a9198dc2", "comment": "Malware payload (Mirai)", "value": "62111ae95b7cbc73b5d9abe9c41c7a10f7b125073b83c7d24e534e04325e45d453df2a905b6c672658e9b34d8363dee3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892019, "uuid": "365233f5-35e2-4f48-a508-4241a369e86e", "value": "T1B146D914AC842BA6C06C8B7490E9CE9622745E144AF14B366664FFECBC763787F47C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892019, "uuid": "19581c9c-2cbb-4375-9e01-79a75cb722f6", "value": "24576:7QSCclJPyuqiGiwJlqEAAVR0mlj1tKHOEofNYoR/lAHV06UpUANHsh/RawqJJ1Ws:bl1FEDncd7XY30V89pmn5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779892019, "uuid": "3b62e31c-b376-4e98-967a-81eade8faab2", "value": 5636279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779892019, "uuid": "3c54a0f2-fd45-4a12-9d89-1c10991e2f72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779892019, "uuid": "39c9066b-32f0-4791-afc8-371fe085e41f", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cae5cb7-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880902, "uuid": "ff84814a-9a9f-4015-a983-1d6327a22972", "comment": "Malware payload (Mirai)", "value": "1485aa9bcf0dc7056de70edc7243475e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880902, "uuid": "59e820c8-1637-46cb-85eb-3e3466f71786", "comment": "Malware payload (Mirai)", "value": "c114882e914503d64f15b2c28f2f533a25a85b5229126592bd4795db4856d964", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880902, "uuid": "0c351f17-a293-41b5-936b-b2ae0323867b", "comment": "Malware payload (Mirai)", "value": "942d1e917ffe803b9c414d6403618d46e5362798", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880902, "uuid": "672d9ad6-f6d7-4280-b7fe-68efa847329a", "comment": "Malware payload (Mirai)", "value": "1d27ffc481cedeed395dafed466ee46ddb58353dcf6f5b7590e5352d457e7705739ae1f281099ec4a3c7f89361fdce9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880902, "uuid": "73b27276-e494-4cf3-ad7e-33cc0f7d6579", "value": "T1F2B13B8811D258B1BCFA9C237169C854B5D4B143AECA5F08D4DCB4F9988CF09B955AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880902, "uuid": "ef5586b6-8042-4bc3-b327-3147e21ecb2c", "value": "96:IKhEcfEnsTE1O2vj2v5Uc80Ig4wUcQYoA+m:dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880902, "uuid": "9e2cceff-5c38-4cee-bc33-70a713693824", "value": 5158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880902, "uuid": "b285e5ef-016c-4d4d-8550-7524ec7a98d2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880902, "uuid": "37b39916-72c8-4a80-a7ab-52bf2c0aabdd", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a7af6f-59e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779898711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898711, "uuid": "dd006c63-943f-4032-954b-92c2d40d2933", "comment": "Malware payload (Mirai)", "value": "b9d0803e52fc51494ddbc06c0e78f0bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898711, "uuid": "a75d5142-d2be-418f-806f-d7ead4c9d057", "comment": "Malware payload (Mirai)", "value": "c1753ce5540e81a23012f60a53832877cf9b744e4e4c5356472ca45da59994a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898711, "uuid": "cf5d94ff-3792-4fe8-a0f0-2792f2be9040", "comment": "Malware payload (Mirai)", "value": "e61bb6716d9bd155f4119d58ba27158215e4160e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898711, "uuid": "8ed943a2-1ae8-44da-b3bb-89e5508902e5", "comment": "Malware payload (Mirai)", "value": "929500db984ef56712d71e505803cf74fbae016efabbd25a6f469a9c582ada342f8c299572afb5bf1216303bde645eac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898711, "uuid": "adfa3c99-2596-41bf-93a5-672235eadfb9", "value": "T1E6F32A06E9819F12D5D211B9FF5E414D37136F78D3EE32029D24AFA0778A8FB0A3A615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898711, "uuid": "c6fbc911-9d4d-4b88-96e6-61524c8029ca", "value": "3072:VB7RQkd/DU1dghLXblaoh7fRFrbq42yCzL/vQ1sAuePOu:VB7RQkVDOELXxaoh7fRFXq4g/CsA1POu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779898711, "uuid": "725b8a3e-4a14-40d1-bef1-dffa1cdb87f8", "value": 162992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779898711, "uuid": "12ca1c76-898d-431c-b619-a2e357b429a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898711, "uuid": "b97023ab-b8a8-4c71-95da-a3590f3cc8d5", "value": "nova.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6374631c-59ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873236, "uuid": "562be3cf-9d28-436e-97f8-8996eb714080", "comment": "Malware payload", "value": "6179f819d09ff5d0249aaf1c2dc5319d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873236, "uuid": "8ad4e1a1-e2e0-4f69-a850-68c0146ddc91", "comment": "Malware payload", "value": "c2ab5404c2e2e7d15c58a1bbab2a6daa857f43aa4137cce738ed5139e77310ff", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873236, "uuid": "4ab22116-deb6-4631-b7f5-0d92f709e2a5", "comment": "Malware payload", "value": "c76c691ec220016b576a9189302bc8c9db1cbbc9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873236, "uuid": "90c32f59-eba3-4e57-8082-fd2b292edc8a", "comment": "Malware payload", "value": "6c585fdc0e2521498725768c60facaa736794ebf07424a2a671ce13a0e36ab565c8e7cc09f18c359c795268c16e84ed9", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873236, "uuid": "837d8dcd-8a94-4d9d-aa4f-269ab87c5b16", "value": "T1F951B61847E80195E2B3CC76E87F5780583F79C6AD718D0D0081459C4862B05E2EBF6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873236, "uuid": "8cb36d73-6d93-435c-9a80-b2c038f01ce4", "value": "48:82S0EEleeHdLXuHfab/FCGCbtIDICV+gi0T:82SnEleeNu/wCbtI8Cf5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873236, "uuid": "b2a4134d-818b-4743-b938-0427da250665", "value": 2849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873236, "uuid": "f0301de2-62d5-43d8-87f9-31e9b86ed3ca", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873236, "uuid": "8194f19b-1a85-404b-8664-1d5ec6a7dba8", "value": "Nota Fiscal-YXATPC lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78f5e23-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880786, "uuid": "29474a98-03ad-4db6-98b3-a289a7d6ef82", "comment": "Malware payload (Mirai)", "value": "b5b2882516ef2f146b789e237d23286e", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880786, "uuid": "12afb0e1-e49f-404a-91a2-869dcf91750f", "comment": "Malware payload (Mirai)", "value": "c33b17f6634f554cc65770d936949b6626dd5919141f345fe76a2f3df35e2149", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880786, "uuid": "61dac4fb-6b57-4c44-aaa9-9112a4a03923", "comment": "Malware payload (Mirai)", "value": "dc5352023b44ef64000a96357524133ea929f5c8", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880786, "uuid": "84b3338f-4198-47ac-90b9-ba915ca10b21", "comment": "Malware payload (Mirai)", "value": "c33177730480f3fa177a925ce6ead379520d18d0bed7a773c9f3abf44afdfb422d9d62af68f91579e110654c37bec047", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880786, "uuid": "83bca007-8448-4357-ab0e-36dd728c0af8", "value": "T1DC43F1751BF7E9B0F2B069398E3D0D86E6CE0B18A0D03272157827747499E4A31F548F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880786, "uuid": "5e133f5a-abf9-4ff9-a7c7-d5c8bc0f4be9", "value": "1536:mvKKGHzSfO3x8ndB6WAsXnAXvSlQuX4LtasKYg6bOUPdzq:eYQ0kPAQAavXYtDX6UPdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880786, "uuid": "275920c8-6fc1-4700-8b13-b3e9f2e6477f", "value": 55332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880786, "uuid": "446cf861-2187-4c27-91c1-ed0937c0ffb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880786, "uuid": "bbe0445f-8ba8-4fdd-81c7-06c25fa5704c", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fc7931-59b1-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779875364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875364, "uuid": "9deba359-e1d3-4a72-b9a5-6326392367c5", "comment": "Malware payload (ValleyRAT)", "value": "8c51bc13f1173d425fd090e62b8c5d51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.f", "colour": "#3CE308", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875364, "uuid": "752832f2-70c0-47c5-b290-a9153b173cc1", "comment": "Malware payload (ValleyRAT)", "value": "c364699d04795827b20da93a3ada6543e3cb7751088d4e856412e1e7a1488e3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.f", "colour": "#3CE308", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875364, "uuid": "7d93ce3b-c040-4526-a1c2-120ee22e56d1", "comment": "Malware payload (ValleyRAT)", "value": "da53b0d3fd62872ae24b1863d30628db1afb517e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.f", "colour": "#3CE308", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875364, "uuid": "ff80a27c-c1dd-46db-b6db-922358be04d0", "comment": "Malware payload (ValleyRAT)", "value": "04accbcadb26515f1ee967476484c71e25f863feac53753505a6367d28c3ef1be9095d17b4e09344534bff1115f06166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.f", "colour": "#3CE308", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875364, "uuid": "88b0ef00-f6b8-4493-bc7a-425f0e407d41", "value": "T1BB953857BC9544B5C4AA923189A692527A31BC490F3227D73FA0F37C3FB6BD06A79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875364, "uuid": "5aefcc48-ff42-4aac-ac52-be227c796c5c", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875364, "uuid": "43481fbf-1260-402a-beba-40ae9069395e", "value": "24576:3CGPir3rAoxx7xXOXdSVPGtcf923LOusWNcwDtAryF:SGPO0ov7cXdSmKEAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779875364, "uuid": "baeb5c3a-f55d-438c-ae60-427509cbde66", "value": 2045952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779875364, "uuid": "0cad49c5-856c-40a4-ae25-1fba5dc9e8c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875364, "uuid": "39ba7882-fd5f-4b8b-b809-f98129d9ffd9", "value": "release_beacon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa0d1c1-5994-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779863083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863083, "uuid": "59b50a82-9fab-466f-8f0d-5fc5e706a4fb", "comment": "Malware payload (AsyncRAT)", "value": "ea4181b632b3b3f1fb10c47bbd010a01", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863083, "uuid": "a09793c6-8643-4ae3-a761-b58e719b0194", "comment": "Malware payload (AsyncRAT)", "value": "c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863083, "uuid": "230e0694-06fc-4364-aa57-a14ea1983ceb", "comment": "Malware payload (AsyncRAT)", "value": "ff64cb7d27e1ba9ebeffe6f06e7647a814c64632", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863083, "uuid": "965f91dd-b6c4-4a5c-bc88-acbcfefc5ded", "comment": "Malware payload (AsyncRAT)", "value": "ee78c4607d2310da5a66a77f05f41b282ed6a6f9ebf239fda4b14751856614d6610a1bcecdae4c00bc000583c1e5e2c2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863083, "uuid": "af5d6aa5-0e53-4744-a46f-fd0648379953", "value": "T1F8F53311F7C08AB2D437243E86284E75F63EBC206BB689D763D0952DDB511C0A73A7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863083, "uuid": "fb052293-bfcb-430e-af6b-85429d75c993", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863083, "uuid": "1effdb62-5ee6-495f-bd6b-28aaedd9f831", "value": "98304:wBlPdxSb3E1URuFm0zrXYvc1RP+iAyieZu:CSb3EmuFTIvQRP+iAyn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779863083, "uuid": "626da6eb-8020-4397-a3b5-9aa25f0a5ab6", "value": 3383375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779863083, "uuid": "be07b5c1-1201-484d-9720-4bcb3487e847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863083, "uuid": "92c708ff-4f96-4670-8a90-124e6d456b4b", "value": "c3693a465b935ce368769f456942fba955512cf77a421db5bda2a5f4edbd117e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e16290e-59b1-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779875321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875321, "uuid": "75f9ea66-9143-4540-aaef-dbc6ab8f859b", "comment": "Malware payload (ValleyRAT)", "value": "74acb58716649782cbf620cd9a0f57b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875321, "uuid": "0809b720-f402-4683-bf03-9c8f0d10f63e", "comment": "Malware payload (ValleyRAT)", "value": "c4811924e39c74edff125ce7b8ddcf302287099451e4b5c77f18aebe102ebfed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875321, "uuid": "bc8dcbae-17e7-49dd-b36c-b692bb9e65ce", "comment": "Malware payload (ValleyRAT)", "value": "9e8aa43124333c006b4aebd236ad049773ed4a30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779875321, "uuid": "993e6770-9d51-4daa-a318-0235b82a11ce", "comment": "Malware payload (ValleyRAT)", "value": "a68ce636e15980827e331f439f176eb50a7a0e206153bda0ad09daacb7c17b35df4ccbd771e9d413d119ba3312fa1ffc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875321, "uuid": "9e4b72ad-b2c9-4efb-bb1d-9699df584f15", "value": "T188836C1275C1C471E97615311874EAA08A7EFD501F619EFF378813BA4F346C1AA32DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875321, "uuid": "fa9abded-3eab-451c-a372-e14587a8e8a4", "value": "9f575ee1236a3fe7e8a756778f735f13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875321, "uuid": "ebaa45a7-3f7e-4dd3-9695-69b224c3af59", "value": "1536:bRkJVZFoGPr0nM2Fl/hoLfUfo125N38WyGQsAv2P9O0y1gmGsWc3cdR2Zwr1ioSd:2nmnM+gLfUfog38WytsAv28n1lvGR2ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779875321, "uuid": "5fb708ed-267a-479f-8d92-cb177d082516", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779875321, "uuid": "a4426b06-1ce5-4e24-9378-a4511249514a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779875321, "uuid": "ce329c4e-a49f-4f8e-a6be-f17c00ba28cc", "value": "1779860206_dv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e339399-596a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779844827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779844827, "uuid": "e85695d1-acdb-4025-ada0-e095122bf2fb", "comment": "Malware payload (Mirai)", "value": "f1f72e1ae6f276333e3636c9200df22d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779844827, "uuid": "dbc35ef7-641a-4de7-b776-d9f5e684937d", "comment": "Malware payload (Mirai)", "value": "c48e90bf0b336d05f0e18994c0d5be637ca123d6fdeeceb6a83ad9c393e78b9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779844827, "uuid": "34bec5be-156f-41fb-919f-e22ddf840107", "comment": "Malware payload (Mirai)", "value": "a1f4ccf008b998b88f37be39f7d634dd3259ba86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779844827, "uuid": "74872ce6-4e50-474f-bd09-0469e1a8d771", "comment": "Malware payload (Mirai)", "value": "207ababf35b9d7140fce0462ed5513eefd86b7895efec831c3c92ab87551d922d1bcf2689abb306beae6c6d63338a2d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779844827, "uuid": "f35524e3-704d-4dbf-9c20-a24b2f1abf9e", "value": "T151831795BC929A0BC6C5137BFA0E42CD37267798E3DE3112CE259F2133CA56B0E6B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779844827, "uuid": "2a87add0-cd55-42c0-930e-c5a97c4f971f", "value": "1536:vY83Z6l1UIALLw9s2d14eey4w+8SlkrFYvq:g8oAvLLwqyr+8LUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779844827, "uuid": "1ea73dac-6ed1-4c38-9ba6-e8b8e432198b", "value": 83296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779844827, "uuid": "744fcd86-ba3b-4b99-a8cf-bf0e18f09b10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779844827, "uuid": "1dc6ec78-c727-4b6e-81ac-396d82fd9d70", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7256f517-59ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873261, "uuid": "25f01b77-324a-4dcf-9672-97a01ad92cd1", "comment": "Malware payload", "value": "b3f64892e9382d273dde4cebe7b9b8bd", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873261, "uuid": "6b8135b1-49d0-40ef-801c-a16c2108d562", "comment": "Malware payload", "value": "c4f98d80490b1f6da80da88d6a99bfedf324b8ec67bff437f233feb8746a5bcb", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873261, "uuid": "ecd74656-6091-4407-a984-d822f4f8b15a", "comment": "Malware payload", "value": "d2678df091103a73566eb186f48f0899823bef3a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873261, "uuid": "0b666064-4cce-4ab8-8472-6843dffd4e25", "comment": "Malware payload", "value": "e959e07a088982c3b58d110c9fe7c0caee81e98f0392adf32eb5d8249e9edd19209e7272cb9e84a836526d0d09df3c67", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "remoto-ddins-click", "colour": "#E4CFF6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873261, "uuid": "a0265110-b26d-4ef4-bbfb-036a0f8f6d18", "value": "T19A51B6002AD601D0F37B9D7756BB9B02C57F3D12DE908E8F0491459905A1E0BE27AF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873261, "uuid": "cb8b2b80-e606-4191-86a5-565113d85276", "value": "48:82SOMpExI9dLXuHfab/Qe8d2XklLsEXDe8MSCr43QWyNR1:82SO1Izu/n7d2XaDd7u4S1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873261, "uuid": "ec03fff9-e265-4874-9643-a59b13a4027b", "value": 2867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873261, "uuid": "e5817bc0-801a-4018-bcbe-c01a455b8769", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873261, "uuid": "e4a97d80-1427-4514-9a0d-f4dabc26113a", "value": "DOC-A25C-DQ2TN5 lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02a1a87-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878948, "uuid": "a2532112-772a-4a93-8a6e-80125d858359", "comment": "Malware payload (LummaStealer)", "value": "34a72baebd23a96fb6ecdadc0ffc67ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878948, "uuid": "d7f40d1f-1788-4bf9-b6a5-d85ab43113e5", "comment": "Malware payload (LummaStealer)", "value": "c4fdc9375ad641b8c06fc8b47b969d60f3abe623f3103775a4420ab4d78827d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878948, "uuid": "687f5560-58b0-4042-b153-997cd18cc7cb", "comment": "Malware payload (LummaStealer)", "value": "0b2cd9860edf11c8d0337ac493f01774796d2013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878948, "uuid": "ecd5b3bf-9da7-47cd-a51f-37fad5477d5c", "comment": "Malware payload (LummaStealer)", "value": "1467728eae54c05cb1aea77e65be2bede4decfb1bb616aa26b6602e02a2ae3ed4331cfd727fdec47211462911b9753a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878948, "uuid": "2e9f8820-6d42-44b0-a19c-0afefa4380cc", "value": "T1BF748D99E7FB58B1D9470938215FB33FDB3416158628CE8BCBF0DB00752B6E26639606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878948, "uuid": "dd5f7612-7534-47aa-8b75-153a148efd77", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878948, "uuid": "43bbdc63-711c-4e05-bcb1-1be5212aba63", "value": "6144:Jq59DxVbJnraQYg/MqPUZ52LJlEfsX/quQhqQmWWuI40ANKwywe9IHyaQvRegSi/:gPDx5JnfvU2l5sWuG4Kwywe9IHyaQvRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878948, "uuid": "cd8f6484-8733-4c80-8994-70a1cef68e34", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878948, "uuid": "e00a8b54-127a-4952-b489-dbdcc412fd83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878948, "uuid": "fc086b40-96ce-4702-ac50-952b184be9fe", "value": "c4fdc9375ad641b8c06fc8b47b969d60f3abe623f3103775a4420ab4d78827d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819d3adf-59be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779881017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881017, "uuid": "6afe09a8-2f87-4188-94b2-64744a0475c4", "comment": "Malware payload", "value": "a84d714697335087bc81c4d487f7a6ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881017, "uuid": "2b21f9b9-772b-4be5-a2aa-44807ab6ec37", "comment": "Malware payload", "value": "c5252b0e3181242977fc7b1d961c63ab8247a685b57614bac05acb1b4bb0e4d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881017, "uuid": "78029099-bff4-4f1a-a50c-e4ec8b757361", "comment": "Malware payload", "value": "3962e361f13425bc67d333b74dff5a77ec89957a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881017, "uuid": "192d1094-1e1e-447a-b37e-708e5e87cf9c", "comment": "Malware payload", "value": "3c0ac75de6b1c8c12f17acc530f190e29d9e1a85c22cf8be53ee4644926e6b126bc9903c81ed9fd8c06d4e75603d95a2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881017, "uuid": "a5fc24f9-44bb-4aa2-9708-ca38029aded7", "value": "T13565AF41BF2C989BE5704FF068FB13F5B329718212A5160B761EE31B6221F35AD476CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881017, "uuid": "df4eaca7-b884-46dd-9281-ffe0f70aeda0", "value": "24576:2Fmwmaok6fSsvKrH1xN4WwTh/HEq0IOWnEa01ai9iTJI6cZ9JuBY:2Fmwma96fSN1x8T9HEq0pWEau59iTJIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881017, "uuid": "2eaab85d-bfcc-463b-9697-da0c12ca354e", "value": 1479948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881017, "uuid": "0381abe3-ef1d-481b-81c7-9a966bbe78b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881017, "uuid": "02f8ff6d-f365-4f96-9502-a9dd04d484fe", "value": "nig.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ea5e6e-59f4-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779904241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779904241, "uuid": "1ef3a7e1-34a2-4899-ad5f-ee1083797860", "comment": "Malware payload (CoinMiner)", "value": "6b9eb2005e7d4fd397f4ba17a97fbd84", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779904241, "uuid": "e381e424-2c1a-43a9-97cc-d170a4c84776", "comment": "Malware payload (CoinMiner)", "value": "c54f1b879831427df3973aef781823ab70fdf1db77f0fe20b12182de91a7ec55", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779904241, "uuid": "fd65af20-3db2-4374-b983-5528a546bdf2", "comment": "Malware payload (CoinMiner)", "value": "40deb59e9d81b1cd8a57186dfb339e7c99b84919", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779904241, "uuid": "9f967627-c2a7-41ce-8b16-6eaf3d78eefe", "comment": "Malware payload (CoinMiner)", "value": "a8ce1bb9a2a4442a1a42c02868f3ed0b78d761a2625b179951dc56248af7b3a4ecd6e363d9dad892450f11dfd5f297b4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779904241, "uuid": "426e800e-7a9c-4f5b-b8c6-36bb601747fb", "value": "T140466C4BF5A364FCC1ABC434475BD9A7BA30345802257E7B7694DA302E23F605B69F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779904241, "uuid": "b6dc83a8-2dd4-4696-b2c8-93c52fbec330", "value": "98304:aI6MUZuk9I7rX0G0weD2IzSkw/EvQcm7XMo1tLc+SR34CETbNf56Py+GN2fBJJJs:aIZiULKUThIPdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779904241, "uuid": "58633db5-8806-4da0-8164-02624dce257e", "value": 5564896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779904241, "uuid": "78e69b81-d893-4c16-8340-11049d772406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779904241, "uuid": "d5bb5f1a-89e2-4333-ba1a-e3f625ad2db4", "value": "javae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4fbf9f-5992-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779862007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779862007, "uuid": "0978175c-3a16-4c0a-80dc-ad0d60724f3b", "comment": "Malware payload (NetSupport)", "value": "19cc377a0e660af2cc401eb9ff3d1caa", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779862007, "uuid": "7967e8b8-600b-49f7-ada8-471eadb1135a", "comment": "Malware payload (NetSupport)", "value": "c5732e595ea5e2cc2795c4fe599c84d688b95d09e8a3271b4a55f697364034d8", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779862007, "uuid": "dba03c48-34e2-4a7e-9105-3afc0885da5e", "comment": "Malware payload (NetSupport)", "value": "6f7d110abd81bd708f4cd02e8a4285878cba5737", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779862007, "uuid": "238e7649-1520-4ea2-bce0-948cf60675ff", "comment": "Malware payload (NetSupport)", "value": "5928bbf86fe1156fa3118a484e51a27c97135eadcbe86bbccafb29ceb9cb7bb3b5dcb3f9b31b7fe768c26dba8e1f2926", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779862007, "uuid": "ee75993f-6786-465f-8aed-b7468046d8c3", "value": "T1F6C52365AE34DF58F7D16134BDED928982C4DCA3A9B33526600BFB498B77801B34A770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779862007, "uuid": "84918759-458c-4a15-9f81-53da87b6891a", "value": "49152:jHsFxp8PUGLZwBQSGMQ2AKCBBb15ud/kC2aCzEJwAiv1cocVIqi:T087ZwBzW7KCXbjuq1ZOwAivqVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779862007, "uuid": "98b5d41b-ba75-4d76-a633-912d5530e180", "value": 2519040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779862007, "uuid": "1834c467-655d-470b-9e48-00ecceef260c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779862007, "uuid": "9c4b131a-b3a6-4572-9831-82d75d4e2980", "value": "edc15.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f8b99a-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924771, "uuid": "926654ba-54bc-4343-816e-e7f683e7bd82", "comment": "Malware payload (Mirai)", "value": "a6d716708f2f5a6eab3ef7d1297536d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924771, "uuid": "c70105a3-4c08-47b9-93df-c42df2c644a8", "comment": "Malware payload (Mirai)", "value": "c5b16bb1ba95d6717d85e8fc0823940a7728db439451eb88eea9b7b9322f71cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924771, "uuid": "0e7a640e-3fce-40e6-8692-6ddd3efea95c", "comment": "Malware payload (Mirai)", "value": "a78128225423251bc889dbdaa2f1a8a4f3c825da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924771, "uuid": "79710153-f76e-41c7-ad04-1f1be303e079", "comment": "Malware payload (Mirai)", "value": "ade290faa6b647dd2c614a688a66108fe5b2374d9d156d1861c3f210f6b1416d22c6cce3f5207b78739b07713a7fead9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924771, "uuid": "8194c2f8-ad0d-4427-a8c8-4e685f7acfa6", "value": "T1F7E30B46F8418B12D5D111BAFE1E528E37131BB8E2DE73029D246F647B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924771, "uuid": "1bd58e39-2c9b-4edb-9364-50bebad8181d", "value": "3072:DHea4CTDUjnwJIXMb6kzz5aTHACdYV8P4eLa:zePCTDQ6IXu7zdaM38P4eLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924771, "uuid": "4de48009-e3d0-4c05-80cb-185e1d877ec3", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924771, "uuid": "6514568e-769c-4715-a477-d8aba8e03eb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924771, "uuid": "d47f73fd-9d54-4088-958f-e9d85c724d79", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9692054f-59cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779888354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888354, "uuid": "c7349cf2-e800-4af7-be98-fb96dfc16803", "comment": "Malware payload (Mirai)", "value": "72b09acc39b6ca053df628ab7ba65c47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888354, "uuid": "359ea036-5f0d-47de-b6df-710d7a46e089", "comment": "Malware payload (Mirai)", "value": "c5f1144f4e4b3fd1cd5d668a44900b94308d1371da44496e3cf664503644a0b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888354, "uuid": "d02fbce6-05ef-4ff3-922f-2a40ed84719d", "comment": "Malware payload (Mirai)", "value": "7ec01fa5071ebffef102bc81163c4a543355d85b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888354, "uuid": "862e98ed-c640-4f9e-b1b4-f8263df1c050", "comment": "Malware payload (Mirai)", "value": "80e4f940a6de18cac9bd0d368617d8115e115400a6ded8743401c0c3f4764d41f70f933585df5e78be44db1c8ec99aea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888354, "uuid": "41aa63f2-c4ea-4480-b082-cc627f4d62b5", "value": "T1F1A2F63376BA5A5BC0A0337600D31363629BBFF45568431F7E881D960EA53903E2AF97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888354, "uuid": "d7993a44-c02e-4fe8-8bea-ec795e36986e", "value": "384:MawuZ3qIouCaWcPASPsVl+n8JULXdo6Ej3vDW9Io6z:MawYdouCqP7PIlbakj/DW9Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779888354, "uuid": "59ef303d-ee72-48ab-b754-4ed8ad24dae6", "value": 22964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779888354, "uuid": "bd624f0f-72a6-4f1e-857e-da95a5041a9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888354, "uuid": "8d0cd260-b3c1-41ab-b80d-823ad5f50f01", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c066b1d1-59da-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779893149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893149, "uuid": "3a254a61-13ee-4382-8704-5735ab7dacb7", "comment": "Malware payload (Mirai)", "value": "44b92f8810dfff307312ea5fe6fca0bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893149, "uuid": "09f11867-17cd-48d5-b07f-5c480f854028", "comment": "Malware payload (Mirai)", "value": "c7ae488ae575fa649af5f2c6faa3de8a06ff378e5176e29c71d6d96290c51227", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893149, "uuid": "6ea691e4-6f0b-488d-b54b-840fd819fc7d", "comment": "Malware payload (Mirai)", "value": "929b43ac3ead057c95b62874da3dcacab610d77f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893149, "uuid": "7def3c5b-a068-4b98-b6c4-21da4275ed83", "comment": "Malware payload (Mirai)", "value": "974583519819d9d3af76858b3e2e193b95f03ad350d64810551d156c296990545744c97a12b541fb80f7f3ffac22fe04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893149, "uuid": "e26522c5-2416-47d2-a0fc-6c9f82237136", "value": "T17B932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893149, "uuid": "a07c4b8c-8ef0-4eb8-b513-3f3f4456e6d4", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2L:AGUJtkyYEETn0T32TDBf0ns0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779893149, "uuid": "881fecb8-f929-476e-bd80-d8533f1af33c", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779893149, "uuid": "3a741d85-89b9-4527-9956-d132c818fc0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893149, "uuid": "b0fe4ba3-1133-4025-a36b-ea2c6459f32d", "value": "c7ae488ae575fa649af5f2c6faa3de8a06ff378e5176e29c71d6d96290c51227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7895000-59cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779886799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886799, "uuid": "e0828c8b-ab54-4dc9-b730-7f6319fd8a52", "comment": "Malware payload (Mirai)", "value": "a41db61c23f3cd7bd41d7c150bf2b32a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886799, "uuid": "ef403d7b-8f7f-46a0-a6aa-3061903c5c53", "comment": "Malware payload (Mirai)", "value": "c80e8082c121dbe0da486749d5df3651832fbc9cd91024e9a8833876219373ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886799, "uuid": "94222957-1d66-4a42-b023-abc8555ef0fb", "comment": "Malware payload (Mirai)", "value": "716cf20df52f79ad35dca84dd055cbb62fbc3fd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886799, "uuid": "b5e08994-e574-4c25-8c53-fc1a50dd4cc6", "comment": "Malware payload (Mirai)", "value": "b2d6e2ae2ad7ae5320bb06f5747a2c7d9dd2656d8708ca7549282631f783893b5f0008a50070210987167bf1e17c6bb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886799, "uuid": "84675dd6-5cd3-4a6a-83c4-080692d3cd8e", "value": "T129F318C7F900E9FAF819E7374853080AB130B7A244925A777257357EED3E189147BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886799, "uuid": "996b6f28-63a0-4dab-a66f-0658d4041630", "value": "3072:ToX8S29WugpV7ybjwUtI5RJNK0lpE7EMCVgjbiyLGabWsrfnF+0M:kF09gjybEUtI57NHIEMFL7BJ+0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779886799, "uuid": "8127ce7c-3170-450d-8256-35c7c2b593cd", "value": 162648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779886799, "uuid": "e0c4d61a-fe8d-4cc8-99c4-1eba87b97564", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886799, "uuid": "a187616a-65ca-4b64-80d2-f5a4e301c33b", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9918badc-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878909, "uuid": "503536d6-9795-4c11-b6d3-d9a5fe3b9e88", "comment": "Malware payload (LummaStealer)", "value": "60b90127fba0655fa4ab945a5858ea2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878909, "uuid": "02405115-7924-435f-970b-fdcb2160e211", "comment": "Malware payload (LummaStealer)", "value": "ca6d6e0d7f818076a8519da5815c021f1f2dc82ac661d1581cc103b2bd73fdc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878909, "uuid": "56a55c30-3741-4634-847d-925d8c2dad1d", "comment": "Malware payload (LummaStealer)", "value": "bd240a60a797a32b22ab8ea23148ec43c6686091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878909, "uuid": "2bbe4baf-0715-45b3-9d1a-26cfb260c976", "comment": "Malware payload (LummaStealer)", "value": "9ec97bdde111fac09ea35e71dc6bfb137d5cc30af4253a49f869ff4b51b6fb9fd09d8825c4712a57eca997df07b74df3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878909, "uuid": "7a6aeae1-7e29-4c3d-b6d5-579f98dd4247", "value": "T12B747C8AE7A758B5D94B0838229FB33F9F3417194728CECBCAE0DB8079376D25535606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878909, "uuid": "31fb0cad-23ae-4cee-9bb3-c076f0ee003c", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878909, "uuid": "a04b1660-5eb2-4b79-8893-c0e0d1397b67", "value": "6144:EfVhOeLXTkgw1XNDdeqMkDQ4HZ/r0j3qjBDrVSEOP3qdUnghr:86eLXQ3cqTDNHZ/r0OtDrIPAUg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878909, "uuid": "91ecdc42-e021-40b5-8f2b-118e3b5a186b", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878909, "uuid": "e14e7db3-de01-4a72-9ef4-6894dd86544f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878909, "uuid": "d9c30525-5200-4873-b93b-39b0bab04870", "value": "ca6d6e0d7f818076a8519da5815c021f1f2dc82ac661d1581cc103b2bd73fdc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5305fa-596f-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779846892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779846892, "uuid": "202f523d-785f-40c9-b390-cffe556978d8", "comment": "Malware payload (Prometei)", "value": "5dd5f242e45b50a8007c3b7a260639ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779846892, "uuid": "62799eaa-f02f-49ed-a592-c0e97574a243", "comment": "Malware payload (Prometei)", "value": "cba670087fa4e0dc5c27a2593bd8fef33568263c9eacd9d3c2ea89c7d4b261ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779846892, "uuid": "56b916be-1bfd-4af5-9eb3-c40d5d9c9967", "comment": "Malware payload (Prometei)", "value": "33cfbdd88a3a15fbd41a843cfea73e94c0e549d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779846892, "uuid": "a4cc9d3c-a874-42af-9770-21794e13c467", "comment": "Malware payload (Prometei)", "value": "b342dd89e111ce95dc426677f3596722fc55be6d6ed992a9d53ec03b095b306c31188706d5f1a1b38cd9272ea567db41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779846892, "uuid": "1739452a-07c4-48cd-b752-ef10bc8b74a9", "value": "T1DE746C01335E9AD7F167187060583A735DBCD630E36F18B6F7C56C89346CAC0A6A8B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779846892, "uuid": "93bdcf69-8ad3-4c24-8f97-111b4bf623e7", "value": "11d7574f4124bae26b618543eea709ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779846892, "uuid": "f7b9acbe-5953-4baf-a04e-cb1284f6ed2f", "value": "6144:JQf08a+Tc8XVi2K1W7zXDWjWhgfhlW+0Hx:y3ar8XVi2K1WXSjWhgJg1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779846892, "uuid": "63d1f565-80e1-4c14-b143-f5655321eec0", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779846892, "uuid": "c48308ad-bb92-4bc4-975c-2dd07461f161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779846892, "uuid": "441348c7-4bea-4f90-a042-5d4a1b0e4e3b", "value": "cba670087fa4e0dc5c27a2593bd8fef33568263c9eacd9d3c2ea89c7d4b261ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37b8983-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878980, "uuid": "35012847-d95d-468e-a488-a272a2063d6b", "comment": "Malware payload (LummaStealer)", "value": "0f146ae973ad1e68e0ed7d4f381c34cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878980, "uuid": "e025eb10-ee80-4da8-b351-ca7ef4ca9b23", "comment": "Malware payload (LummaStealer)", "value": "cbb4dd827e1c9b1ec021531c772921b3173e398a20125740010c899c9c8625fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878980, "uuid": "73e0c999-c68f-40f0-8aea-b833e9f8999f", "comment": "Malware payload (LummaStealer)", "value": "1c450e00cead17e754bb392df8c68a382413c482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878980, "uuid": "d9578c44-2e11-44b6-b679-f4cc52318ee3", "comment": "Malware payload (LummaStealer)", "value": "31cb43db2417e3fb0e5975bc64f2b7c42cbeab4849aa8b0fd7416f58e4f103ae16440f6a3c0a63b337bb24d81f96677c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878980, "uuid": "74f24fe3-d679-452b-8a4d-f771602a6c73", "value": "T1B9748C99E7FB58B1D5470938215FB33FDB3416158728CE8BCBE0DB00752B6E26639606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878980, "uuid": "8c8dac1c-f0bc-4857-b712-5dd563548002", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878980, "uuid": "3aa27dd2-008a-4995-b587-2fd33b64bfe3", "value": "6144:Jq59DxVbJnraQYg/MqPUZ52LJlEfsX/quQhqQmWWuI40ANKwywe9IHyaQvRegSqU:gPDx5JnfvU2l5sWuG4Kwywe9IHyaQvRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878980, "uuid": "e38044d3-e93d-4950-b439-37111cc1a8e4", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878980, "uuid": "ebebb441-9dbb-45fd-bf90-5b4b617c3670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878980, "uuid": "b83750fa-db8c-4b61-adaf-2e33f6afdbc4", "value": "cbb4dd827e1c9b1ec021531c772921b3173e398a20125740010c899c9c8625fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdf9c11-59a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779870411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870411, "uuid": "0900c34d-0317-4d48-a2b9-c88236f3ac43", "comment": "Malware payload", "value": "1e553b49c791407d9e85e2b8eb1ad0e9", "object_relation": "md5", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870411, "uuid": "333caf55-96f3-420d-8381-16c6d5802b86", "comment": "Malware payload", "value": "ccb5d00b79010a6b56cb53cbaf1437e0ed91d9bf40afcd9b7a0388cda18bbfa3", "object_relation": "sha256", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870411, "uuid": "7c328151-6250-4b53-a260-f02b84310850", "comment": "Malware payload", "value": "4300002dfd82b436c570157335a038e8b18c3348", "object_relation": "sha1", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779870411, "uuid": "892f4ba8-bee0-41ee-951e-b69cf99d5509", "comment": "Malware payload", "value": "de125d10c142e26b47db73ae740e097b1c972a894114924198ff6918a5d8b08ceaf01c5634498c60926e53cd2acc6778", "object_relation": "sha3-384", "Tag": [ { "name": "Adobe-Activation-Guide", "colour": "#BC47CC", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870411, "uuid": "9ae90351-fc14-4f66-ae9e-2583d05cad1a", "value": "T1C2D022334DA5E7CA0BE7AA0A8460362B403F234367384129F6A30506B900B80C3733DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870411, "uuid": "7919a1bd-cd4d-4d33-9667-c31593b8bd75", "value": "6:sny1R3KIIYAGQO0cGLzxkO6h5nNkikkt18fkTTkkQBXm7Cj:sngkIIYAHpcGJkO6h5nFkKsk0mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779870411, "uuid": "8798ddb9-e2f4-4f3d-9007-91f618bce918", "value": 214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779870411, "uuid": "c14d2e61-d366-47c6-a7dd-abcfe3730684", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779870411, "uuid": "7dafa71e-3857-4897-b92a-a131a7f2705c", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fb6f82-59d1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779889098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779889098, "uuid": "93e8eb16-d58c-4602-9ad8-74c588e04707", "comment": "Malware payload (RemusStealer)", "value": "b54877136bd689c817ddce19c6d51787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779889098, "uuid": "39b783ba-4cd1-45bc-8295-5449c948da1b", "comment": "Malware payload (RemusStealer)", "value": "cdd16fc0a2bf1499ba815bc95288456e46c7245b64c9d06033f2c61eb06900f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779889098, "uuid": "af1bd5b7-0ff4-45d5-bb30-11593723edb8", "comment": "Malware payload (RemusStealer)", "value": "85014d9372d9d70ccd1a57bc018b985564ac5e49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779889098, "uuid": "23dd9562-dc70-4d07-9fcf-e8733fc761ef", "comment": "Malware payload (RemusStealer)", "value": "eb2d958d26315502089b1e895532cded23d644b2af260d96911413fba3f4d0cc29e74c09f21b57294121904357c111b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779889098, "uuid": "14657b5c-2793-4031-89fd-4cab130efb79", "value": "T1577559477C9064BAD5FA923188B5A2D17A31F8490F3127C33B51B6BA2E773D44E39398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779889098, "uuid": "730d47fa-76c2-40f3-a8b8-1150f485ca02", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779889098, "uuid": "facfdf44-cdf4-4332-9098-be0c32a5fa36", "value": "24576:Zg18kF36aZTWynBjQ6OgLP88WoSSQxf0QVD1m5:ZW8s3xZaEYgLPN8VD1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779889098, "uuid": "e8cf43eb-96bd-4dfb-9e3f-58ce103f15fc", "value": 1559680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779889098, "uuid": "5c2e145f-125e-4e65-9662-91fe8cf15748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779889098, "uuid": "491b483e-f04b-486b-a9e6-54dfefcda311", "value": "Bootsrappper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7837d19-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878987, "uuid": "ef9b1fba-60a9-4592-b370-2b419be189ae", "comment": "Malware payload (LummaStealer)", "value": "f626f554f70d3ac2bd95bddbdeb9b208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878987, "uuid": "05eba395-e72f-4807-80cc-a828c6005e55", "comment": "Malware payload (LummaStealer)", "value": "cdd58fdc774629af782ff9005adf2f2086b29c35ae280fdb442fcf7ee679ea77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878987, "uuid": "aab00141-b185-475d-846e-615c4377f4f0", "comment": "Malware payload (LummaStealer)", "value": "b9043d679a1034414adc97578a8846654e56b149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878987, "uuid": "af23cee0-dc45-412d-b84b-8b14fc457ba0", "comment": "Malware payload (LummaStealer)", "value": "4d845adee97acbf9505ceddbc6c96ac4c7a9e698e10405aff4e3824b12f3ed1780cf4c1fc478717e79f7e0e173cd7a43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878987, "uuid": "c1aa84c1-846c-4609-b97a-7c7cb234d2f2", "value": "T12B748C99E7FB58B1D9470938215FB33FDB3416158628CE8BCBF0DB00752B6E26639606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878987, "uuid": "40439f63-f118-4baf-9920-8ff34c716bd5", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878987, "uuid": "c9057df5-f0df-43d2-bfaa-14aaba706210", "value": "6144:Jq59DxVbJnraQYg/MqPUZ52LJlEfsX/quQhqQmWWuI40ANKwywe9IHyaQvRegSVf:gPDx5JnfvU2l5sWuG4Kwywe9IHyaQvRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878987, "uuid": "28f9a235-62f5-4655-b956-e458a21a46ce", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878987, "uuid": "b3880dea-1303-4096-bfed-5e4a2eec5d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878987, "uuid": "3d9f66f4-9e20-4427-90d2-d7ba886e7202", "value": "cdd58fdc774629af782ff9005adf2f2086b29c35ae280fdb442fcf7ee679ea77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc19e82-59cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779888473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888473, "uuid": "9a59de1d-621f-4a05-b04c-6b687497a1a6", "comment": "Malware payload (Mirai)", "value": "72f4bd0bb220d86d7b224c9ec83b13fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888473, "uuid": "0c09c161-95d1-4a9e-b3e8-ba011b88ecf0", "comment": "Malware payload (Mirai)", "value": "cf8dee7b9d5904bba57a6419f28b63f06191f6b179ab3ad080b1990da7d8472b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888473, "uuid": "94847c1a-0e64-4450-90de-345e51b9d8fd", "comment": "Malware payload (Mirai)", "value": "31fa5f3fe1f57329f124786d2de8d2d88504641e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888473, "uuid": "34dcd882-2138-42ec-8601-50f88136048f", "comment": "Malware payload (Mirai)", "value": "5b3082b3058240e64dfdb85f6371878b0394763ab76aede215580cda5b50c65bae4fe0aa2895b5e824a35d3f89a47b65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888473, "uuid": "da026a9a-182f-47ad-a08c-f5565c33e646", "value": "T1A304D80AAF920FFBDC6FDD3302A90A4235CD555722A43B357674D928F64A90F49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888473, "uuid": "0df7b144-55ea-4a62-a189-8ace32210abc", "value": "3072:deC8TT8jDWyJY+DlzJvqOSNWDZUyHc9mj:deFTiJY+D3yTWDmyHc9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779888473, "uuid": "3ad76837-e999-4ff6-9822-b5c6cfa1e2a9", "value": 185660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779888473, "uuid": "38ff27f7-533e-4828-87bb-44c8e75fb5db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888473, "uuid": "37456161-a109-4803-9840-286c21120f8d", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d446d5c4-59ed-11f1-a769-42010a9c0008", "comment": "Malware payload (NWHStealer)", "timestamp": 1779901342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779901342, "uuid": "1e98fc7b-fd11-4e7f-9e50-f6e06395770c", "comment": "Malware payload (NWHStealer)", "value": "5df23519a849057bc412a310405ba7f0", "object_relation": "md5", "Tag": [ { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779901342, "uuid": "95f1ddac-1057-4f4a-97aa-617627300542", "comment": "Malware payload (NWHStealer)", "value": "d03ee65646287df92db7851ea426131cc06d85ba05b3c46d65914450960fb591", "object_relation": "sha256", "Tag": [ { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779901342, "uuid": "f81d73df-df60-403c-a8cb-0c58d0029dc6", "comment": "Malware payload (NWHStealer)", "value": "5179c5780d4f719c4c4b4e680b19256073c62735", "object_relation": "sha1", "Tag": [ { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779901342, "uuid": "f9640b25-d4aa-4235-b360-5d5e0477d1d8", "comment": "Malware payload (NWHStealer)", "value": "f3b48931c41553e6dc6b75b1f58fcf6bfa7049d86244609e8bb1f53308e37531dc5d241007da19484179bc5d3f26df0b", "object_relation": "sha3-384", "Tag": [ { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779901342, "uuid": "6b25ab41-39d3-44fd-a7a9-58ae75a1c38b", "value": "T1979733EA84232C4FC9E7B677A7F9D40FD6A2654B5950883BF4110AF648CFBE5523C40A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779901342, "uuid": "c9f3982e-6fc4-4f36-a427-7c7a5bfb7a4e", "value": "786432:SRRgw65wiQToXD9sGnCdqgp0uK2AEvE9fesS+3Pu48p5txDgcJ00SeI4AZF:SRRg5hKoXBJCdPpHU1fe+Pu4w57nPSeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779901342, "uuid": "63f763ae-5b93-493c-b205-b86a2d794366", "value": 41708983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779901342, "uuid": "f9553a18-6718-44a3-b598-1bb4b4266236", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779901342, "uuid": "d475322e-41d8-4d97-8944-3d67c81b7609", "value": "Unicore.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bcbbc2-5969-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779844698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779844698, "uuid": "b4c758d8-a07e-4149-8e30-6f8c99e1b6e9", "comment": "Malware payload (LummaStealer)", "value": "49f72030f1c27cc37109ef6480e9a8ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779844698, "uuid": "d8688aae-6532-4184-849d-8bac5c2bde55", "comment": "Malware payload (LummaStealer)", "value": "d0eb957c90d90902f92cf980b642938e4a0dacc411ad55501a9a663098194aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779844698, "uuid": "e8c37a5e-02e5-42c6-ae21-e10a12c79daf", "comment": "Malware payload (LummaStealer)", "value": "231572bb735b9506715b648679fce4663efd1f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779844698, "uuid": "363bde84-27e9-406e-8b83-bcd78e28f096", "comment": "Malware payload (LummaStealer)", "value": "bb2d7f15766123cc71e3e2356fbaac4d2996236646169f3a911eba508c89f8a3b9cb44bcf590c5dd4843188ea531d5a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779844698, "uuid": "1f34c358-a906-4c23-b142-3cdde92da8f1", "value": "T15626D001B4C0C472D122253055F4EA340E3DBDA14F66D9EF77982BAE9F353C1A726AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779844698, "uuid": "30785ae8-7fe9-41f6-bc57-937a0a166ba6", "value": "15145246279dbac9c0f3d99a59f6d9e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779844698, "uuid": "b5f4211c-b2eb-4212-a97c-14aba7f9840a", "value": "12288:ygyaoFkygeMiHux4N0pXuqHo0L8T01TA67:/onhMk0Q01L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779844698, "uuid": "6b3ca56e-4271-490b-9703-598ba19a0eb1", "value": 4551680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779844698, "uuid": "383d2e57-8e5c-4273-9974-e86dc4ea7009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779844698, "uuid": "a14413aa-997c-46a6-aed9-836d13f83abf", "value": "d0eb957c90d90902f92cf980b642938e4a0dacc411ad55501a9a663098194aa6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54005d10-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880941, "uuid": "eba4c69a-7708-494f-a855-6bee0ebfe1fb", "comment": "Malware payload (Mirai)", "value": "1e19ae470aa5bb5dfaae778a3132807c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880941, "uuid": "a31dc7b3-f6cd-4663-b70a-391f421c5001", "comment": "Malware payload (Mirai)", "value": "d16fdf743ee265358529011ff515cbe1e16160a1cf3c64a759a9ac3cd38df2ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880941, "uuid": "b5b94359-0f06-4caf-b011-a083081c3786", "comment": "Malware payload (Mirai)", "value": "d7521771acc5a160ef73b9b945c5a1ae5e2c495c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880941, "uuid": "d421b676-8449-4033-aeef-888a015dd698", "comment": "Malware payload (Mirai)", "value": "64416a04fdfc10533aff52aa8ad90caeabe8bb76e2ead7c854d2c286748d80efae33cb38c0413a64c05cc7440082fbc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880941, "uuid": "b8dcaa47-90d1-42df-907d-14de6de2f707", "value": "T142431985BCC28A5BC5E423BAA56F518E3365A7B8C2DF3717CC224B20378995F4D77680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880941, "uuid": "7068c792-32ba-4f5a-b681-94699ef48825", "value": "768:YO8X0LI7LVu7K9/b/cLvVmSOAoSPqg/oQfuT7XEvSzQsQUB/TBTGvrZynLq52xhU:YiOu7K9/7sohXMCQUyZoheSU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880941, "uuid": "e1a17c76-06ec-42e1-894c-a39c9f97604d", "value": 56036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880941, "uuid": "511eb51b-d955-4f60-a23f-5e091453ad43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880941, "uuid": "19c15dc9-2cad-43fc-9ec2-b19f71210397", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b646db37-59e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779898715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898715, "uuid": "eea29553-fbf8-4ff1-8156-07bee126de1c", "comment": "Malware payload (Mirai)", "value": "561b74702398a2fbe452b189bc87eddd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898715, "uuid": "cec08266-ceb7-45d4-bd9f-91e2bef0ca1c", "comment": "Malware payload (Mirai)", "value": "d1a1570f7b8a1a5c503a30b5cceb41655dc6f02b7ef93dc6cf698d89febfd90a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898715, "uuid": "53d6d0ff-ab12-4d5a-a855-a186db06fab7", "comment": "Malware payload (Mirai)", "value": "a28105da82517a22825aae174ed0ea61e63927c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898715, "uuid": "dee7f11c-24e7-4c40-8084-ff3ed0c0fe4a", "comment": "Malware payload (Mirai)", "value": "809affe19053537eaabac05fb0a24347f5128a3b308b0638a9bf624286f64fb4f2723ae826a977dc90f7e063385a4882", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898715, "uuid": "9da36555-74b0-4820-9c3f-d83ccd7b4835", "value": "T154357D5AF2F370FCC067C030435BDB62A839F46511226E7B65C4DA352E66EB01B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898715, "uuid": "7f98f37a-8b52-46a7-90ed-8671f0cbc140", "value": "12288:m+xPw9Hc+mDY1lE1ngB4c35jyHaiJ3RI5k0O/IrmyziIqePFt5k:m+xPw9Hc+mGegB4cJjoJhCPSd8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779898715, "uuid": "c0a85130-f0ec-47ac-a252-1be0207c53f5", "value": 1098848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779898715, "uuid": "288e6ee3-9fa9-4d65-a417-9f3a6d2eb399", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898715, "uuid": "cf92e529-be38-4780-bf9b-5573705dd7ad", "value": "nova.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d30c15-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913579, "uuid": "1df2f1d9-0935-4732-8737-1d5885b553c0", "comment": "Malware payload (Mirai)", "value": "19feafe0d322cd320bd11e0e247362c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913579, "uuid": "1a5343af-5748-407b-9e6c-8da586e0c4c0", "comment": "Malware payload (Mirai)", "value": "d24595c93c9614ecbbe18a39d9f254d5f1dfd4809d7efc81e80e795a81af706b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913579, "uuid": "1f05ab67-916e-4340-8394-dbc7c5f4d423", "comment": "Malware payload (Mirai)", "value": "08047e3dd036bed0ffb43602c6e377bac6bd1caf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913579, "uuid": "ccc8b577-cc7a-4b17-8d89-1761bf58faa2", "comment": "Malware payload (Mirai)", "value": "9037c04cbb98278641a6b650411b39742e99c740b990f59c8f81711d3102e07dd0fc9e223a91f426e5f0095f8ace0a57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913579, "uuid": "4f7cbb31-2e59-462d-8941-911fca4a7b38", "value": "T15B430AC5F4CB41F5C4174A38609BF37FDE32E56680709AEDDF89AE23D66B6019202399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913579, "uuid": "1a76d30a-baa8-450b-b728-d1ad880dd964", "value": "768:+PKg0gAS5O++vAsBzhkhqvIKRuMSE6/p8KokLFx6QxH3dKKA7ufwVGvgqm4MXfi:MKViF+vAaNFIKRsROK4n0wgvgh4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913579, "uuid": "684feca0-a60b-4fd6-abbb-66fd529f8d84", "value": 59388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913579, "uuid": "84ad11a0-a530-4ef4-bb28-6611498af37d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913579, "uuid": "fa7a734f-b7f0-49d0-8929-ebef0e56e0f9", "value": "Akiru.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abab2c8-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880952, "uuid": "4a18d2da-b5bd-4e17-9092-529cd5b0b3d8", "comment": "Malware payload (Mirai)", "value": "a8b9ccd9eff09f2aaa2ea057b8498006", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880952, "uuid": "aa2c42fd-b642-45e3-b947-96b1e4b2432e", "comment": "Malware payload (Mirai)", "value": "d3028fb0480d307ba83273846794ec5931aab72d56892004dfc865c7aadafe1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880952, "uuid": "3c1f6669-5391-4744-bff6-3d3d5545da01", "comment": "Malware payload (Mirai)", "value": "f32fca3f4072b03ab75d4291a1bea3947d04bcf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880952, "uuid": "53a5dda6-f5f4-4060-8741-847659bb4047", "comment": "Malware payload (Mirai)", "value": "eda6f653536d4862c2def2865553a96683c7df5a39bd0c3ad5203caa58537eaf39f839b18f6effa8bfa1bce7287663a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880952, "uuid": "622efe4e-5a85-4bcd-bcd4-1d577ce13b03", "value": "T19514981E6E228F7DF668C77447B78E24976833D627E1D644E1ACC2101F6029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880952, "uuid": "4fc3d572-45b8-4342-917f-8baa5b4d5443", "value": "3072:ueCpp6IqL8no8sJ3XeXWROx4pNNkXV/3d98aKn2Xf:ueCKIFodJ3XeX8OiHE/r85nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880952, "uuid": "6781b672-c2cc-418b-aa88-723310a5fd9c", "value": 198184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880952, "uuid": "41d0c6cf-2e65-4d67-8eac-1debdf132886", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880952, "uuid": "6cf71d4a-b793-48a9-96b8-ab3e7fe42414", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286a9058-59f8-11f1-a769-42010a9c0008", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1779905779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779905779, "uuid": "79a563e5-bc31-464b-8797-579bfcc4f060", "comment": "Malware payload (MaskGramStealer)", "value": "c85e55c488f0dfcc4b63abfe354f23e5", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779905779, "uuid": "19b63e4c-7c6a-4a56-b3f1-c21465e761ab", "comment": "Malware payload (MaskGramStealer)", "value": "d327645ae15963609a232e2295f1b588e4daa4a1551c4f76c31cc0f0984d9b78", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779905779, "uuid": "23fffec6-9933-4ef1-9dfa-4911df8e783b", "comment": "Malware payload (MaskGramStealer)", "value": "1be675309d79e87e4deeae778c1f5ac89591a69b", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779905779, "uuid": "fb8ce287-d444-4bbd-8daa-0ee9de347ec8", "comment": "Malware payload (MaskGramStealer)", "value": "5ffe80e869b658c8d5e63be2fb947c1874b89e600cf7fe3fa429ee68b18b20ac4b2396df6c9a86ca0b21147368f49618", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779905779, "uuid": "6df7c9dc-9493-4dfd-a4b8-a0ee9cafc7ca", "value": "T1C4044A1BD9D140F9DC29C638869AE637A4B3B85A1936BA4F6BA0DF151F40B30B71DF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779905779, "uuid": "dd5c349c-c484-4131-a650-d294b6698ce6", "value": "ba456e94eafa9e6a7757d90b7ff6310a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779905779, "uuid": "35933206-9c52-46e8-b751-84a2edfa9399", "value": "3072:YTYbsMaR0lcdmoSdr443mK0X6TVVfqLqVS7CnwOTU0DU7jIB1r4q7mv:pbsMqmoSZ33mGxVfqLQTvgCD7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779905779, "uuid": "613d36ca-c644-4767-93f1-45ce7dc02037", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779905779, "uuid": "53cc228f-9d8a-4279-8159-a4d763a3b950", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779905779, "uuid": "40e43f04-ea54-4b83-b8a7-bca2180cf7d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6293f096-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779880536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880536, "uuid": "1eefe371-0bd3-428b-ad44-52a1710a0990", "comment": "Malware payload (QuasarRAT)", "value": "6f51f83a9614f8cbd061227813ad55c5", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880536, "uuid": "6426bc61-ab8d-4bb8-b893-73cb8c9966ab", "comment": "Malware payload (QuasarRAT)", "value": "d3a49cdef256d313ae4245701b15a9767f208dbadbd18d9f36870b3829a9f91c", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880536, "uuid": "cf23e56d-9c8f-43c0-bcba-030b51ac20e2", "comment": "Malware payload (QuasarRAT)", "value": "86ebc3b38cd1bc666f187a67e08fcdfdee0c35b1", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880536, "uuid": "6d7d2855-4d4a-45eb-940b-54f407ffbf00", "comment": "Malware payload (QuasarRAT)", "value": "04dc330b404a78b24f8268a79481a941a9e3e9ccc00f5a9cfd165cd8f6f6f8a24cae533d6724d7519844829b2b6c44ae", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880536, "uuid": "cf1e2c65-8bf4-4f6c-8553-6704d9c782d0", "value": "T1F938333BC5A93A5561F3E8521EE62B4B021D85E0613FC5D9C91751884BF4BABCE2FB30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880536, "uuid": "78108471-ce22-4c33-8ad8-945d83f3fb57", "value": "3145728:Q8IieNUx84MS/S/MiVx44hXhMOLiQCnbvQslQD/cw9QL:Q8IiuUu4MJ/P44HMUiQUJlKVQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880536, "uuid": "cbc1b86d-6227-4208-a36b-a922406aaf95", "value": 103252407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880536, "uuid": "80a6f815-a494-41fd-a10f-8487d238acf1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880536, "uuid": "885aaeff-4f52-4d69-90bd-a62b068183e5", "value": "Full_Unboxing_Process_Inspection_Record.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc60f0d8-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878995, "uuid": "cf4d9082-bc6b-4382-bc51-9bc99f702ee7", "comment": "Malware payload (LummaStealer)", "value": "83924e227d32a4385190ade13606f6e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878995, "uuid": "4c3a9a10-3c40-4842-af62-7c235f4d7c1c", "comment": "Malware payload (LummaStealer)", "value": "d535aae7680b6032be7368310102e1ded72ed6b74c618a1446d9606a9a9ce819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878995, "uuid": "afe1452c-c440-443d-9a10-689f503a5fb8", "comment": "Malware payload (LummaStealer)", "value": "b6a10e1f7641c8a5f471390fb169cc8a42fb65a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878995, "uuid": "08a1ba5d-bbca-4bb4-bb76-eecf5fee6673", "comment": "Malware payload (LummaStealer)", "value": "8e3194e0c269a5102bb9cc3cd35d5cb3d1533558126a0d098235a36d24975e60aaae98e5b112edd8fd0f487dd13bdc1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878995, "uuid": "0d4907cf-4c17-439f-b4f1-78c17888d2f7", "value": "T138748D99E7FB58B1D9470938215FB33FDB3416158628CE8BCBF0DB00752B6E26639606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878995, "uuid": "06832a06-2eaa-46fc-b2e7-6a7596065059", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878995, "uuid": "be7181a4-f862-41cd-8daa-270a89722cfa", "value": "6144:Jq59DxVbJnraQYg/MqPUZ52LJlEfsX/quQhqQmWWuI40ANKwywe9IHyaQvRegSVU:gPDx5JnfvU2l5sWuG4Kwywe9IHyaQvRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878995, "uuid": "1646509d-3ae4-4769-8092-e93f26a1aadf", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878995, "uuid": "ee4c6e57-ae8a-4383-8c39-2c08a5909e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878995, "uuid": "595253a2-f2e0-4e79-8d11-c0491c055d31", "value": "d535aae7680b6032be7368310102e1ded72ed6b74c618a1446d9606a9a9ce819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ce6e7d-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779879072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879072, "uuid": "e87998ac-601d-47a8-950f-4f00a4c5dc08", "comment": "Malware payload (Vidar)", "value": "c1a9b747a87ca5117d3d2f5eee4bf32e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879072, "uuid": "f92a8096-5855-4b96-add0-0de8a7666e9d", "comment": "Malware payload (Vidar)", "value": "d649e1419040a18035ff1c19ef46e9a1994ad40094977cb1be2996e2edffc6f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879072, "uuid": "c9d2623e-7b09-4dd0-acdd-b22bdc76af48", "comment": "Malware payload (Vidar)", "value": "fa1ac349ac1319864921602bd9372d9fd5131499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879072, "uuid": "35aed704-bd08-4382-b29d-ed28cfb8cd1e", "comment": "Malware payload (Vidar)", "value": "4c76366c88b1cd89d6c3fa414d978a5b54a0934e852cf362b9f400d72e2a47323fc79310cb47ba4bccfab4205db0b30e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879072, "uuid": "923cb6a3-38e7-4768-a7df-06edf8a9898a", "value": "T1021519EFAB6071C4DC556BFCD9E16D1197B0BCE07AA0459F1586EB2BCD29A038F1C260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879072, "uuid": "78d4fbd0-2f5a-4435-8e15-ef1e36c23a64", "value": "12288:pYLlHGoKRY/DCg9CVnnuNW56U7zhEvdxLKd/avV60L+QU:iL3KODcnu7U7FEned/aE0dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879072, "uuid": "1b9aade1-2f82-4187-9347-d99af13469b1", "value": 888088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879072, "uuid": "2e3647ab-df4f-407c-bf66-ca7b6ef897e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879072, "uuid": "ad902c95-4506-4a28-bd2d-f7f25f94c36e", "value": "d649e1419040a18035ff1c19ef46e9a1994ad40094977cb1be2996e2edffc6f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cc5ceb-5a0c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779914574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914574, "uuid": "c8a010d8-aec5-4d78-8ab4-a6f96b85f9a9", "comment": "Malware payload", "value": "a6223365f7792b278f788aff26a43ebc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914574, "uuid": "0cda8793-1d4b-4a68-b68a-8d463ecfe076", "comment": "Malware payload", "value": "d64a7e0299a537e211114baaa7f1341f5018a1e432d39d6aebb26b1c98c38da2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914574, "uuid": "d9968aa5-b63a-4648-89fc-f8fe5255b1a2", "comment": "Malware payload", "value": "5811961ae1b37ea220dff13bd35cf6039a696f87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779914574, "uuid": "9ce309a5-c32b-4eaa-ab2f-4a0e527323a0", "comment": "Malware payload", "value": "baacb307e4eeac2e0ba83faf4f745bc6458a7e13eeeda637924ecbfd086971cd0eb6996c13f97739b368eb71eff5b58d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914574, "uuid": "0117f1d4-9b2c-4d71-925e-54c0b68f93e0", "value": "T12525CF53769C00B9E1A7D635C29B8613D3B2BC166B01DECF63A0D25A6E636C1D73BB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914574, "uuid": "bb80824a-a9b1-4f0c-83a2-74527993f53f", "value": "04041ca64a92136d9d8782d9ea054d3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914574, "uuid": "8da8ee98-a080-49c2-b00d-d67fce4c58e0", "value": "24576:sscCJIQZr4XfmKWDLcNfJT5WO+R3w0NbT+pTba3:sTmr0x+1pbTOP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779914574, "uuid": "e7d4d4d8-4578-4ad6-b9cd-533f0a5754dd", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779914574, "uuid": "e5e57513-5fb4-49b5-84df-01a591df31f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779914574, "uuid": "8fb29382-196a-44fa-aacb-3ef65b6ad9ce", "value": "SecuriteInfo.com.Variant.Tedy.855242.43647765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb7b4dc-59b3-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779876102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876102, "uuid": "6d143f9e-3b47-42c6-a07b-3d7c8c0abf9f", "comment": "Malware payload (ValleyRAT)", "value": "b7a8287a4b6efafe218d270b5d4a3e2d", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876102, "uuid": "d0b12c3a-1ef8-4562-a70b-1160b545fe73", "comment": "Malware payload (ValleyRAT)", "value": "d6e5c930f64854c5dbfb670ec84d6941ec880ee0546cc322dc500767750e77ab", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876102, "uuid": "990c70d6-8461-41fe-9207-4adcbd4eb1cb", "comment": "Malware payload (ValleyRAT)", "value": "c1e2651ae87e8ef2903d5819a9b18ba6479bc0ac", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779876102, "uuid": "cd002d27-ceb6-4c99-9d3f-58ad2c536682", "comment": "Malware payload (ValleyRAT)", "value": "9abf6b60f861d95e4dcbdc4fb5b92d82a92bc5f719c23b24543252f274c94f2b54080e11392b441c2c6793531df8f1e4", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876102, "uuid": "0e69e492-8b23-45d5-9658-55ef9eb8a57a", "value": "T13DD43903E69290FCC56BD2B9C7AA9336B572B84911397E2F5B94CF312F24E20572D724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876102, "uuid": "5c54ebe4-51bd-4bfb-abf8-84b6c8afea6b", "value": "32128674e4d14b65f94a06a366453910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876102, "uuid": "2bda646c-5573-4bf5-9db3-382a32688599", "value": "12288:GSf+qlyNyclSgbH4WxlUt2Nd1ekzgiatdH0KEcLfq:GS22yNyclSCYWDxfRgLH0XKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779876102, "uuid": "39d49d9a-3662-435e-8121-6bdb68702f03", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779876102, "uuid": "9e6a701c-e63c-4eec-a479-d07797985845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779876102, "uuid": "fbc88075-b201-43b2-8c21-b003341974b7", "value": "update_installed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9484095-59ea-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1779900035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779900035, "uuid": "06acf587-dc06-463d-91f1-5de6e3906325", "comment": "Malware payload (ScarfaceStealer)", "value": "b0e7bbb559b5a67458e98b054a99e745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779900035, "uuid": "de5be0e8-250f-4342-89ab-5f06c5d0e76c", "comment": "Malware payload (ScarfaceStealer)", "value": "d73f8b8522d7dabc19ffddb48d671b5c4a518c168d969ab43299156617361f37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779900035, "uuid": "2a11a052-2247-4b05-8cd6-2d18f86efe96", "comment": "Malware payload (ScarfaceStealer)", "value": "d198590ac22e46968d8a82f103aa249c8b63e738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779900035, "uuid": "bba8c6ac-3088-42ee-be2a-728d58492f54", "comment": "Malware payload (ScarfaceStealer)", "value": "354124770e543e6a10fcf2c31bf223c56a7c78c57a41b3bcbf1f45c2406d49e39eae4e23aebce2fdec85ab45202674bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779900035, "uuid": "bb240747-aac3-4e72-8dfb-0aacb6a039e8", "value": "T129F5194369DB0DE9DED277B862C35335A778FD71CA2A1F3AA604C13129536C4AD2EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779900035, "uuid": "af1d26fc-b7ea-4acb-ae90-89cb13194f09", "value": "9b0dc33bab417a1f674e6f4b6afd4b59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779900035, "uuid": "c37b5a08-d8b4-4f7c-aff0-0b6a5f042448", "value": "49152:gB5+QAE3RSQ5Y5Bzc+5WOr2A/GpoUJEezCu:gf1SQ5Q8poUJEezCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779900035, "uuid": "817920a1-6d5d-4ba9-802a-1ff1e1a121fa", "value": 3372528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779900035, "uuid": "c1602933-8ef9-4577-b3d3-1c407cb9186e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779900035, "uuid": "4d49ad38-6bf8-462c-a114-919e4f828a81", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eefeb9d-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911507, "uuid": "9864da4b-cd73-4915-adab-8599bd779fdd", "comment": "Malware payload (Mirai)", "value": "6f998ffdeaccba228f2aab0d8e706946", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911507, "uuid": "7874604f-3320-4f04-bd07-cabde9205d33", "comment": "Malware payload (Mirai)", "value": "d97d7a6abc68f051a8e3eac1d34eedc994d8776415630649edb834633fd55c1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911507, "uuid": "329c2c91-2af6-4d5e-a4f1-7c73d8865e48", "comment": "Malware payload (Mirai)", "value": "7c28f5d4e6c6c9a986e932bf120a74a3462ed3a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911507, "uuid": "71863042-f962-4fd7-a5d8-f2cbee9b1b92", "comment": "Malware payload (Mirai)", "value": "c6295f86bc847bd9fbad132294a01c8861dba63d9e1d0e5c9ee2fd2492cc5ca8bd554f1d25b87ec563fa211e90ab7bce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911507, "uuid": "ed89fb25-e0bb-47f0-b6b6-ba523bbb346b", "value": "T13CC65B43B6099DA7C3B31F30DC782652B63E9D466A095366D32BF73CB8B93015A1E385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911507, "uuid": "c51abeff-b941-4b83-84a5-2a2d17ea9911", "value": "98304:BRnDbbxwqaw9cW/6RWTUB+jn++91nz+SGZJGxWRdTyvEl:BdDN2W/6R8++91nz+SGZ2WPTysl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911507, "uuid": "21d4f887-7553-4f6d-93a5-fafb536a42f6", "value": 12583074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911507, "uuid": "92bd5ec2-9642-4775-8f69-ef8dc65b42ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911507, "uuid": "74643239-ce74-4d35-863c-fa2172a86c4e", "value": "wife.loong64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83565bd3-5990-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779861263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861263, "uuid": "d8834c5c-04fc-460c-bed1-b22f4e09accc", "comment": "Malware payload", "value": "7c76e51390b0d2e2759fad5ccee2bc30", "object_relation": "md5", "Tag": [ { "name": "BLUEWIPE", "colour": "#3B87DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "WprFlock", "colour": "#F30CEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861263, "uuid": "5acc6cf3-3d86-4197-9659-bcd062bf74da", "comment": "Malware payload", "value": "db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674", "object_relation": "sha256", "Tag": [ { "name": "BLUEWIPE", "colour": "#3B87DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "WprFlock", "colour": "#F30CEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861263, "uuid": "ee2fb6ca-510f-4b97-ae05-7d7cea1fb5c7", "comment": "Malware payload", "value": "b91be21e984407529691edb1bfe3f97dd4a1ae24", "object_relation": "sha1", "Tag": [ { "name": "BLUEWIPE", "colour": "#3B87DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "WprFlock", "colour": "#F30CEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861263, "uuid": "5f893d82-239c-4147-b069-60a3838abf9b", "comment": "Malware payload", "value": "6ddbc73c27839d464d4cdef25413037cbfefb7a0e7ba93051eced628b3e9b332570bb050473d122254574ab4060def7c", "object_relation": "sha3-384", "Tag": [ { "name": "BLUEWIPE", "colour": "#3B87DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "WprFlock", "colour": "#F30CEB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861263, "uuid": "5e3f681c-b124-453c-8db3-05ba380c93f5", "value": "T1E6247D11B991C032D566097589B9CFB98E3EF8614FB1A5CB63C40EFACE306C19735B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861263, "uuid": "ac269be6-ac4b-4f0b-a2b1-0397402e6827", "value": "20fa839ee337736e051e82149bbdbcd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861263, "uuid": "a28a8e43-39af-42f9-9c70-05794f1f1895", "value": "3072:0Ok/xmqDdeQwFDRCaDUGI//S4CYElBv5RVr/BEZyvUJQ4j6ySZHTky6Dj3d:01mqEPCawbnhRElzRx/BEZPjmzwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779861263, "uuid": "ae7622f0-70a4-41bc-8696-b18371f43dcf", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779861263, "uuid": "14dc2b0f-7b58-469b-9fe3-1b0a9aea145a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861263, "uuid": "a9046a8c-d939-49e8-9322-61613f1b5683", "value": "CWipe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534c30eb-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913581, "uuid": "26b2e12d-672f-46b7-a304-7b0a390a8990", "comment": "Malware payload (Mirai)", "value": "82dcf78c689af92000158088cbd6bc8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913581, "uuid": "1de4bbc0-3537-4d8b-b4ab-f5b574aeca72", "comment": "Malware payload (Mirai)", "value": "dc541938032c65f63469b24b869a3b15cd0b3d143c86851c06e11918fc78a6d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913581, "uuid": "7aa3b25c-6857-4499-9f82-0b57dbe02f0e", "comment": "Malware payload (Mirai)", "value": "07a3783a9a7a9b44adb53d9c7f32f1b3ee9ed26a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913581, "uuid": "7879b97a-2111-4526-9833-e574faf7d2b3", "comment": "Malware payload (Mirai)", "value": "f0cc4935bbd0f9f14b3b32043b337bc29563321aabbaaa608e7bd635c1206183841b910b207c76dd39d415fd2891c7bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913581, "uuid": "20b6720b-026a-4d01-9bd1-5f8d91cad6c6", "value": "T1C921CE9AA7D76E2BCC540233DDAF5710F322AE54C69EF91BE39112210C6E30A5F31149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913581, "uuid": "78dd6c2d-536e-43bd-80fb-c8df2da72146", "value": "24:Jysdht0gP9qD0at6EoKG1YrUlFSy40VzLCkIddx2H5I3yeNfO:J1/DFqDPtCYrkFSy4CzLxIieN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913581, "uuid": "13bd18eb-2a4f-4824-94f0-34fe8c9ff43f", "value": 1176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913581, "uuid": "896e0adc-4ff6-4d0f-b592-3bd9d15643b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913581, "uuid": "f3cd4127-288e-4911-b9c4-184f285ce2f2", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca2a6f6-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924710, "uuid": "a518a582-473b-4e4a-91de-cafd25c44c2c", "comment": "Malware payload (Mirai)", "value": "23215d908306006a8cca5b2f47f004f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924710, "uuid": "a48b811b-3816-41ee-b2d5-96deae48f362", "comment": "Malware payload (Mirai)", "value": "dc844b4ad00430801f3ba257fa06ee82130f0ab9ee3c415b5393d0a60b355f95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924710, "uuid": "71d241e2-43be-4ade-bf9a-dd61e595a469", "comment": "Malware payload (Mirai)", "value": "785f9978c3e9e237f334115184bb91e0955671f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924710, "uuid": "998744ab-aec2-4ccd-abe9-d3bd34e1fae1", "comment": "Malware payload (Mirai)", "value": "6ad5ff8b22f98d9b929a4a040fd872b7fce6d06c4e1b3a9ba19ae341d2df30b498c7fb0540cbf72f48d74e1af24c9771", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924710, "uuid": "5f1a0eb7-3074-4a30-ba65-d81eed03a7f3", "value": "T129C31B45FC405B23C6D612BBFB5E428D3B2A17E8D3EE720399255F60378685B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924710, "uuid": "8d603338-8a51-4571-a9a9-cec92b4dd3de", "value": "1536:p/Ka0rG5yC/cMChygtiOBdWFAcJX4VlgXTAXYFkWUGZrSo51WhrV1l3GwywEReQB:ZKaprMh7sOXWFh4UXcYFkWpZlvWNUmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924710, "uuid": "ceee4270-6b2f-4874-89e3-7bd57c48a36f", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924710, "uuid": "d978523c-9826-429b-b2df-4f5062b7aebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924710, "uuid": "bdadde0a-6756-4a7d-bbde-74765ccb4501", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7800e6-59ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779908872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908872, "uuid": "86f9dd2f-9c2f-46fb-b1fb-2a91fca9f5f5", "comment": "Malware payload (Mirai)", "value": "3eb6793dc2254346ad1dcdca67b6d4b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908872, "uuid": "667c5a66-150e-4203-8a59-6fcf490d10cd", "comment": "Malware payload (Mirai)", "value": "dc9be3263ee07ab296ed8bac65eddd14eabd556697e5fab17280d2e8160ed4f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908872, "uuid": "50ab362a-00cb-4b61-9d58-733e3db73bbd", "comment": "Malware payload (Mirai)", "value": "6eddd932410ad0a9e8821e2dae16214eb4f288d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779908872, "uuid": "cf0febcf-3658-4858-b549-07a43198d375", "comment": "Malware payload (Mirai)", "value": "23d23a3351241d7269a7b3f4c1166a4052b353939f64ed12da3e72cbf83a781694761576d1c116f4b5b0217eff4c26c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908872, "uuid": "6355b008-d252-48b4-bbef-675aa184ade2", "value": "T14ED30845FC419F17CAC655BBFB4D438C7B2A07A8D2EE720399256F21378B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908872, "uuid": "5d5b37d5-1808-421a-af65-9d2e914ec2a8", "value": "3072:vwbl6vB1T6hRvKjnWFiwCEWzSCeXIt4zcBrP:IbliZqwnWkwLWzSn4OzurP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779908872, "uuid": "3511446d-755c-4833-b7d9-80d0a6584893", "value": 136536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779908872, "uuid": "99d04800-5f02-4ed8-a362-e2eea3991fb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779908872, "uuid": "6f3b8d80-b851-4ff5-8757-32cbb2d4f942", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d247f5b-5991-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779861709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861709, "uuid": "16070cb8-6cf2-456b-be23-6179cd1b7812", "comment": "Malware payload", "value": "0fbec4b8c52890564de62613b1f2e9ec", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "pwd-fanbot", "colour": "#FB428C", "exportable": true, "hide_tag": false }, { "name": "pwn-fanbot", "colour": "#5B6266", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861709, "uuid": "203c553e-63e8-4e56-8dab-a0d5d9d344a2", "comment": "Malware payload", "value": "ddc559dfa8b98029e23e883202867879215bd455d5bd1acd03122bfb8750ccd7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "pwd-fanbot", "colour": "#FB428C", "exportable": true, "hide_tag": false }, { "name": "pwn-fanbot", "colour": "#5B6266", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861709, "uuid": "6a4c64ec-2818-44f2-9f08-5bb4440b0887", "comment": "Malware payload", "value": "887f4bac1291c7d4041d29ad1d56402d260dbcdc", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "pwd-fanbot", "colour": "#FB428C", "exportable": true, "hide_tag": false }, { "name": "pwn-fanbot", "colour": "#5B6266", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861709, "uuid": "3e4202ff-b842-4b4b-9539-8f687af108b8", "comment": "Malware payload", "value": "e6852ff8911d2bfe6a25525a09ae23fcfdc4fa9c04c7a727cca1a101496c9c061b285903497f079d5811e5a46bac9da7", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "pwd-fanbot", "colour": "#FB428C", "exportable": true, "hide_tag": false }, { "name": "pwn-fanbot", "colour": "#5B6266", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861709, "uuid": "cf5b88ce-5bd5-4927-9cdb-8a4360f52097", "value": "T1A67533B5AE3E834DDEE1B198E5D9E69D010A4D57ACD43C64A4087F4CC82BD85F28FB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861709, "uuid": "501eb63f-a3e4-4dad-a549-c2c23e4c2eaa", "value": "49152:9L+Mx68wUt2L++8TjMQNAtCzyYUbudtuC1rN7EJD:h68uL++IfCtCOYiuy0pWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779861709, "uuid": "79cb68f2-833d-4c57-8874-69e9648e8929", "value": 1695760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779861709, "uuid": "90683a6f-060f-4da5-a0a3-a3241e093b9a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861709, "uuid": "d689f238-5d0e-4d05-b7a9-1631fd22b4e6", "value": "grace.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3e9250-59e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779896554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896554, "uuid": "74d65c55-c674-42e6-89dc-9be376ee9b44", "comment": "Malware payload (Mirai)", "value": "3c80da1db66000aa898851a8ea9fb798", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896554, "uuid": "510bf80a-f3a7-4078-8e8f-63aec7e93c90", "comment": "Malware payload (Mirai)", "value": "ddcfbd444a3a6e46112590856d97d04e09d9f2b324983a5bf1e28f7f04f2997a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896554, "uuid": "62b014ce-f92d-4883-9fe5-a3ea6e7c0e09", "comment": "Malware payload (Mirai)", "value": "86852d56be168cc79bec37ebb99681c8aa276701", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896554, "uuid": "a243fe36-0992-4a95-97f5-c43f047584f3", "comment": "Malware payload (Mirai)", "value": "e28bed9a2af3e47b8bb9035a9f61419586cfad12470bb0bcfcdf5420a296c3c2ea5202d786836df1080d0952c49b1dc1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896554, "uuid": "ae78baec-f4b2-4922-b79a-ff74d5e98673", "value": "T1FF436BC4F643D8F5EC8705702077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896554, "uuid": "5eaf4fc4-0705-44c2-bf79-4b779186facb", "value": "1536:JeESt/basV2rcZhG6ySN7na6FlSR9zWOIaEjrqMfs:JeESt/basVTgS7na6FQRVtXESI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779896554, "uuid": "15eaa1b1-721b-409d-97c3-9387be0df929", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779896554, "uuid": "61d326ec-241f-4f3a-915f-c2a4140291ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896554, "uuid": "f42a7c22-47df-43e5-b80d-016e319333e2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd67606-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911532, "uuid": "b7427a14-8b65-4a59-bf51-635a93849e26", "comment": "Malware payload (Mirai)", "value": "f0b0ad15fddbb7f638f11cee4eece78c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911532, "uuid": "f099799d-8cc2-43d5-a187-5e5c34d9e73e", "comment": "Malware payload (Mirai)", "value": "de7d263dcc4808553fb78a17409583b1b1d19052a93e4b5f86511a6504c0edef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911532, "uuid": "d113b178-5c97-49f5-a2b6-4ea4c0d08721", "comment": "Malware payload (Mirai)", "value": "cab51bc556f66f9362e483ef5405f17d04fcfc6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911532, "uuid": "64d3ba36-682c-4b3d-96f3-6d2605665b9f", "comment": "Malware payload (Mirai)", "value": "eef9c5db7aea43b793dae1309d797669ab38379d45d6505e487923f7d77274ef1ab36c0653b9d9aa4ccaffc129d1b239", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911532, "uuid": "e1450583-ff1d-485f-b6d7-0f8440676a3e", "value": "T1AAC65BA1F70CA165EE4B0B3284670F74B3A11D41D2E4889B8309F72F55B26F76A4EED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911532, "uuid": "63a25ad2-7605-4855-b0b6-b4e59cfbc7e0", "value": "196608:DncUcI7g/Rx6dA2THxKCUA++91nz+SGf6rz8xb:TDBKCx++91nz+SGf6rz8xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911532, "uuid": "a46ddd69-8f91-4b13-8126-dd200fb9c2c7", "value": 12517538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911532, "uuid": "12ec1243-d460-4128-8afe-6de6c9d01078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911532, "uuid": "4ad8e6fc-756e-4a81-ab7b-4d8d846c819b", "value": "wife.ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba098df-596e-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779846486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779846486, "uuid": "41a25487-6253-4ec6-a39a-e4581dab0053", "comment": "Malware payload (CoinMiner)", "value": "cf5ee1a12b467b8a5d44354c3e6051d5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779846486, "uuid": "442638f0-b606-4a7e-afab-8f3a8b66d56c", "comment": "Malware payload (CoinMiner)", "value": "df2be42b8a63be17ff85f4516e308406afcd131afc183bc54fda8dfdb8b90685", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779846486, "uuid": "5790102f-ab57-47a5-862a-40984af20ad1", "comment": "Malware payload (CoinMiner)", "value": "c0ec96a8984726eeb6ed89b8179d63c93c309ba0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779846486, "uuid": "006e20fc-e321-498e-9562-f043cb29aff0", "comment": "Malware payload (CoinMiner)", "value": "69873d895e9f068255ac5d62f70566110df77f5a69840a7f52f8cbcded5d53216f419587a4533eb8c8ad2fce54dba06e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779846486, "uuid": "cf97b9af-92f4-4018-9d1d-44aa3b87e3ec", "value": "T192A6CF407BE2BEF17291C11EB356C8344A5F3CB8F0DEEAE6904597A72482141AFED974", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779846486, "uuid": "7442bf89-2a40-4f0c-b636-01677124fa05", "value": "5b3ebef3da244b3ac4de5a75d6d1e4c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779846486, "uuid": "4b4b7a1c-6588-4631-b228-355fc1c7d410", "value": "49152:i+HWcQ42IY8TChpiMC7bjYu1GCrDyIpGRlWAcW/5XGvRKa7sOsu0/Z8ak6F6yGo1:Kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779846486, "uuid": "66335f9e-28b5-40e5-b42b-e336f83f89ef", "value": 10043392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779846486, "uuid": "3912301e-3a57-4085-a834-da13134cb6dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779846486, "uuid": "2bca5c46-e8b6-481b-a59a-e37f6b5a30c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c17c04-59de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779894842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779894842, "uuid": "17acbef4-50b5-4997-8801-a24bbe83ac7b", "comment": "Malware payload", "value": "a7d15753adecee723884133178816339", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779894842, "uuid": "469beae6-04ce-40ef-9aa9-cd851f7f420c", "comment": "Malware payload", "value": "e0a07a4c60f8f8c23f20e87f8dd2ca623829ee8bf080da61daafab200f145794", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779894842, "uuid": "c3cc5840-7754-4d28-95b1-f20feeb98621", "comment": "Malware payload", "value": "8766f77c49caf1eb669fdb64cf5f896e0f734f46", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779894842, "uuid": "b263f180-2e4d-47ee-ade5-2c575484d44d", "comment": "Malware payload", "value": "84260f569479af513fe84bdb68b12d60d759cd6e14ce1ab3d120255fb9bf4853c6fa02a62180514eab68d764115443bd", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779894842, "uuid": "38c9aa50-0d3c-473a-9d02-9ff704b02d61", "value": "T14326336D10E0AD28DF3ECFC0FD7D8925E7764A51281CEAB1CE950AE55E052C48A3993F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779894842, "uuid": "b6f0abe0-e6ec-4e6f-b3e6-e7296632cb6a", "value": "98304:9h0lAslsooenNk1QnRXuWJnzrJizd4L6VzjhJvC+pw:9eSsX+inMgnzrJ4jfvCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779894842, "uuid": "ea5b9e75-24bd-4245-a1dd-6fe95fa6f83b", "value": 4691146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779894842, "uuid": "e0a4d953-1a30-4038-bc7c-7e4338a9e630", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779894842, "uuid": "aec9ed70-3cab-47a2-9e89-09b118959703", "value": "596b3a3d0b8338db655d1ba0e4eca723aeb49668f3af4b275ba44afdc95b2cde.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52426ff-5998-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779864890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864890, "uuid": "291b685b-da3a-419c-b936-8f6e1be57737", "comment": "Malware payload (RemcosRAT)", "value": "150d6032c9dfa7d6f46d08e4757acf93", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864890, "uuid": "ca47d057-d725-40e5-aef0-60ecbdc2f622", "comment": "Malware payload (RemcosRAT)", "value": "e1c27a877bbea8863536c2ba291991c1dd033c88a4eb7da9465e3e2224ba6177", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864890, "uuid": "42dfe90f-612f-477e-9262-0e3cfb09974c", "comment": "Malware payload (RemcosRAT)", "value": "a8a71c77f8eb9da5c6ee2d8165ef1c846f5cea9b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864890, "uuid": "982058f1-617b-42b1-8d90-f6c99d89b137", "comment": "Malware payload (RemcosRAT)", "value": "564d81b42a8822e88226a0ca4005fce3e9d439de661032b69665b5227aaa2d5f7ed0cc967556bb44961cec9d49d7e6e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864890, "uuid": "cb0d38dd-2e93-40cb-9774-176296e46242", "value": "T1CDB5389203851BBDF68D0EC5C94B215B21F2D467BD291258EFB36EE7BC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864890, "uuid": "1281e476-5f2a-4362-86d9-dacacdebb43e", "value": "1536:AXddeiFKSUcGuMHHC+i3pRs7LYzCsHCdJaPVKDyGWXG83ZKnjrPMke9SD+7DdMwF:AtdeiFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779864890, "uuid": "4123abb1-abbf-4be8-a8a2-5c8a0e790945", "value": 2408897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779864890, "uuid": "73be0386-e861-48fb-975e-27a0ffdbf448", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864890, "uuid": "3dc01ed6-0f4e-4c69-822a-d34dbd5532a2", "value": "Doc_4665784949383756474856574845648465.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcddc61b-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913759, "uuid": "cfa12c18-0bf0-4ce0-a1cb-6f60d4f10f50", "comment": "Malware payload (Mirai)", "value": "86e76e7d6d69a259707beb0d137e3766", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913759, "uuid": "2469939c-9792-45e3-a4c7-420142d6cead", "comment": "Malware payload (Mirai)", "value": "e3098c471c75f5e473ac05f3779586e6fc2edb5f74902368001ee0990c1069cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913759, "uuid": "58e7e208-f01b-497f-8bf4-f6838609309e", "comment": "Malware payload (Mirai)", "value": "1d2ffd6ec03b99aeaecc26348041f4b79e05bc75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913759, "uuid": "13b053eb-c3f1-45fd-ad30-45fa9a0d7d36", "comment": "Malware payload (Mirai)", "value": "0475fae7c4bb4828432a8bee2556b578cae69527c399fa303763b8327395672218806f878c6e942f067521d7f3984196", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913759, "uuid": "ca537cd2-1c71-4c63-879b-d8b7ec85ff8e", "value": "T1AC3329C4A583F9F5EC10157D306BABB1AE37F03E643AEDDBD7D855239801A02960729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913759, "uuid": "1da84da9-2cf4-435b-ae7e-0b190f4d23c5", "value": "1536:7PMAJpg1ExSdDRdRVOZzsbjNQ7qTnu4VOEYVHSg7J2bYa:7Bpg1kSDRdRVOZp7Gnu4UESSg7AbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913759, "uuid": "3a82ae19-7bde-4e59-b66b-1ae2af09e54e", "value": 53848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913759, "uuid": "ab40e93f-a2f1-4e8c-b09a-e7e71bc86773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913759, "uuid": "802235f3-2eb5-4ed7-b5ee-1728779927d3", "value": "Akiru.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa77eb9c-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880791, "uuid": "629a3a6d-7094-40dd-a367-8ac330f72435", "comment": "Malware payload (Mirai)", "value": "de375ef67b919422bf98ea2d36b07bc2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880791, "uuid": "1db662bc-cbc9-45de-880e-eda5081ead82", "comment": "Malware payload (Mirai)", "value": "e3329cc4c338362f2c5be99afcc9ff68e2b013f2a7ad4b192e5b8df7f0c23e6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880791, "uuid": "b18991e8-973d-4086-83f1-dd26381d991e", "comment": "Malware payload (Mirai)", "value": "f99d9cf7ed9b535a66e587e10069590b5adb8979", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880791, "uuid": "b258e1fb-b25e-44bd-972a-3632fd6e6b74", "comment": "Malware payload (Mirai)", "value": "7c0b0c8190db362a66ad51b6e0e04f983051302f2663fee06db22205086052f9d3299b5e15a6d8a557d3a72343964ac8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880791, "uuid": "4e123f4e-cd9a-4d18-9ff8-e100f3e6c7b5", "value": "T1F543024E5A693199C98D54FC08926B671F64839F8343CE06AB74F5C29D02F2C7583EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880791, "uuid": "90fd887b-9476-4f83-a049-b27bc674280b", "value": "1536:i2zXxOsVKVhm9KGHx2bX+Q93EPZcgEdecTe9XVJuN:NbxKC9b2z+QC0dZeRVQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880791, "uuid": "b4d2113d-47e1-426d-95f3-4c807a1cf7e0", "value": 59848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880791, "uuid": "0a6dad28-7be4-4783-95c0-95ddb82a1a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880791, "uuid": "ff64f6c6-3e6f-450f-a386-92b3a71444e7", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7cda02-59a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1779871775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871775, "uuid": "13f61a1d-7a03-42f8-9a48-06fdef50f652", "comment": "Malware payload (Gh0stRAT)", "value": "2863fa303ebbe4dd991483f23b0ed8eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871775, "uuid": "52bcebda-db0c-4e56-a4fe-05c1b6489e18", "comment": "Malware payload (Gh0stRAT)", "value": "e3b986eadce4946056956aaa9b233dd91eb88dce16978be57f976631cdb4402b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871775, "uuid": "98a80460-1d34-4e12-9a8c-088cb2e47d45", "comment": "Malware payload (Gh0stRAT)", "value": "f883b3e320403b7d14ceb9412ffb20b4e0482aef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779871775, "uuid": "0f52fde0-29fb-4585-972a-d936eeb16534", "comment": "Malware payload (Gh0stRAT)", "value": "758ed4ae122a80271f5e3175b6cae2fc207213f33ea9ca47afbbc7b52ddaa15bd9ccdcbf7afab1cceb80557499d055ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871775, "uuid": "136fc506-50fa-40ac-885b-5039c7f643a3", "value": "T19907333FB198A13EC5DB4B310572826058BBBF65256A8C1E53F0A94DCF7A6B01E3B705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871775, "uuid": "890a65d5-01ab-4f86-af58-9a8fb8628ed8", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871775, "uuid": "c04fcbb2-62b9-4c37-b568-0c9664e3fb0a", "value": "393216:W2Why3QXwBMh8mHl+NNoBbgK5Ft3EgBEY1hTL01TmfS3HX:PZAgq34E5giFlRBEYXQhmfSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779871775, "uuid": "2e273358-287f-4815-965a-1cb33bfbe6f7", "value": 17245175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779871775, "uuid": "53d37051-82bc-48a9-863b-f0d9143a3775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779871775, "uuid": "3c1fa2c4-3a7b-4b84-b963-96227a78b692", "value": "\u70b9\u51fb\u5b98\u65b9\u4e2d\u6587\u8bed\u8a00\u5305\u94fe\u63a5\u4e00\u952e\u8f6c\u6362.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91a1873-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913752, "uuid": "23b1b02c-bef9-4ea0-a1f3-3a831e278b0d", "comment": "Malware payload (Mirai)", "value": "6a84d24c6d60c0e3eea392c89d97f4d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913752, "uuid": "121399a8-f4a5-4e6e-ad41-2014be5c9318", "comment": "Malware payload (Mirai)", "value": "e649749c6bd3da7c47e81c52ef8658af49d82c78716bc14b529542aa8a083a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913752, "uuid": "4b69aee8-00d1-46a2-b97e-e118bcf247ed", "comment": "Malware payload (Mirai)", "value": "cb61ad1e03b650a96f264106386359013b393f13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913752, "uuid": "0ec2fff7-2740-4615-86c8-2d081e806bc5", "comment": "Malware payload (Mirai)", "value": "2fd984ee05a4e7b4a9d43eb49e265b444f11aee45daab3324a61450584465d10f300a3f3ee8b0430178ab754f33382da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913752, "uuid": "95dcfe2e-8c7d-400e-bcae-6eef1622f21d", "value": "T10F534B24AD7A2E26C0D4B17A21F78325F1E6260E26B8865D7CB12F4FFF1874064177B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913752, "uuid": "5c96376e-6477-4bef-b277-acc33e58b1c7", "value": "768:RuWo+zpXq9hGJD0YoehAyCzP/8IceYAWsXdh6XzBd8G+XO+CBO+t2+/b/eScn:RB9zpXShGJD0Y1CP9ceYAvXKzI2xtDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913752, "uuid": "c33088ce-7276-4527-814a-f9167392c907", "value": 64044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913752, "uuid": "ed4a7939-c208-4ea5-9844-d6a2720b7725", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913752, "uuid": "62d4227d-d6fc-4b9f-8b42-6dade0341766", "value": "Akiru.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9757652d-59cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779888355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888355, "uuid": "d3131e64-0d2d-49b3-bf84-f2ebb8fa171a", "comment": "Malware payload (Mirai)", "value": "b916e901c4e751569ca8fd7864f18951", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888355, "uuid": "2873ecc2-5817-43a7-acb0-d3cbbbdbb7f6", "comment": "Malware payload (Mirai)", "value": "e7cc6d7bf2f266a097443cd01f593f58e49d28ef7cb6c3e95583293501fb2075", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888355, "uuid": "cc20dd54-5b6e-4aa0-ac57-6c53d02489f3", "comment": "Malware payload (Mirai)", "value": "64f1148a980d72842a2d43e83f675092754a5c19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888355, "uuid": "a4328907-5931-43eb-b801-411133c4c1f9", "comment": "Malware payload (Mirai)", "value": "284a152e590c95c417003b49c0dc125325f4029fcd02c9757a67322b84dd85b2269db77d710b48c95c9a633e17022bc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888355, "uuid": "c7c3a790-44c5-4218-ae52-4ed5301dda90", "value": "T17D145BA9BA0F6C41F2C2D3F8DE4C87E13E1735E3C7768971791212EDCAA39D95A90502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888355, "uuid": "02127cd4-1ba2-4974-986a-94efefe65247", "value": "3072:0VvPajL4mPK7d5iURG/Kjp9pc73z7mDiJLlMCsnoq:0VvPaf4AK7d5iUU/49673vFLlMnoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779888355, "uuid": "12d11f0e-f3e1-4e05-9907-e97f320ef247", "value": 190448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779888355, "uuid": "4dcf0deb-7855-4708-a3ed-4da6b87d4320", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888355, "uuid": "8ad3e4c3-8964-41ce-8b12-dbd316e32f2b", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e266e59-59ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779879106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879106, "uuid": "1016b4d9-7fed-4f0e-abaf-19408a840d38", "comment": "Malware payload", "value": "e52f02452ba65b7ccf589e05eaa25198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879106, "uuid": "b6db5f06-9aa2-4740-ac57-095a031b7753", "comment": "Malware payload", "value": "e7ce613f531b396de4e58ae90bf2aa378f678a284f3bf81c42bc8b26693f6d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879106, "uuid": "12bc8a9b-507f-4060-8a3c-965f6fdcedbb", "comment": "Malware payload", "value": "afea6ad4aa1c9233f5f41cf813c82a8f5e2b8e4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879106, "uuid": "8448e401-7ce1-4123-9ba4-654837dc013c", "comment": "Malware payload", "value": "ba44672f2cf3f924698b378656d08e0b0f060e5e12b0f0ebe544b4de7d310fb7bbc1becdc77a394aae1fea5bb9e6693c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879106, "uuid": "6d3bbb9d-2226-428b-8fbc-b41a0a517503", "value": "T1D0256C1AAA6C01B4E0A7D27C8D56C512F7F27C8953319FDF83E04EA51B676E06A3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879106, "uuid": "9085dcc0-70b2-480c-aa75-eb79b1384ab1", "value": "9a0e9663f96cbb6d92a119e6e2d7e760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879106, "uuid": "e052384d-1960-478d-af23-6200d5e63916", "value": "24576:ViqfYMmMKsmsCMmMaMmMCsmswVMmMCsmsRI6XZj9OBs3iIGDVj/GjDWNmaY:VRRJZOK3i9DVja6Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879106, "uuid": "a70c46ca-634c-40e8-8157-8bde4bd710d2", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879106, "uuid": "9f34ef31-d649-40e3-a0b1-27f3d3942611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879106, "uuid": "361a7353-12b6-4600-9b14-9d377456d57b", "value": "e7ce613f531b396de4e58ae90bf2aa378f678a284f3bf81c42bc8b26693f6d6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6873aa0e-59ba-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779879257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879257, "uuid": "49655ace-fd0c-4cf5-97a7-995bea4124b1", "comment": "Malware payload (LummaStealer)", "value": "72df84fafaccdface53acde93540d2e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879257, "uuid": "4992a7a4-b04d-4d37-a019-55e483136bcd", "comment": "Malware payload (LummaStealer)", "value": "e7fb2837093bc57d6359a8015161ee1518274602aac87a63b22c0ded21d84cbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879257, "uuid": "b77f7f14-461b-4795-93e8-66f90b4a1e55", "comment": "Malware payload (LummaStealer)", "value": "2d580bb2ee7d6106cd421cdde14d01c0e5d69375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879257, "uuid": "436f67da-c56c-4814-9223-b81a2e90364b", "comment": "Malware payload (LummaStealer)", "value": "acbe75dec54fc6c48e7c999e7dd642d7cb88ec6a6bbd99d758aca44f7073b455e477b45d428c5a1ba22112b03be71f80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879257, "uuid": "8e1e6834-6b52-4070-a807-5eb3e2d46acb", "value": "T1FE0733D8618889A4F053F67008A57F66A534FCC5FEE083C71EC7B2365D7EE81882E569", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879257, "uuid": "d2c366ed-2894-4d46-ba17-c2de9fbdd629", "value": "393216:7Yg8KVKBx3dRrXjIS+dhxmM+nFHbEeS55P5:sg8KVKBxNRfIjxgFHbEr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879257, "uuid": "76ae1d43-0a10-42ee-ab2a-f382c86b96a5", "value": 18435584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879257, "uuid": "963e8fbf-eb1d-442b-a538-2ca9cd3a1a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879257, "uuid": "b8a1d040-2369-4f3f-887a-720f633261f5", "value": "e7fb2837093bc57d6359a8015161ee1518274602aac87a63b22c0ded21d84cbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac9eb6e-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878858, "uuid": "bbaf56fc-b4c2-401f-a845-f0b69b296004", "comment": "Malware payload (LummaStealer)", "value": "5bd96bc9a2a16446ebcf5666accbe072", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878858, "uuid": "b28f580d-fa6d-4adc-aef7-54c3a6880f6f", "comment": "Malware payload (LummaStealer)", "value": "e825d2769b56c7a988c4b62858e1e6ecc08950404415114e40ab135e73d1faef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878858, "uuid": "f0b687b7-7b6c-468a-8cfd-fdc760d963a8", "comment": "Malware payload (LummaStealer)", "value": "40936ee82ed526cdd8ecdc98d0b62e17a0e03743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878858, "uuid": "372e61cd-0124-4c94-988c-9b3e045d4f6b", "comment": "Malware payload (LummaStealer)", "value": "0a34113d7d7a8cd0e6eef8fda5eb1293abbff0e757276ced169ee998afd592b7db5d909fe87ce7559c7c88abc31fc8b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878858, "uuid": "486fbd44-d96e-4abf-bc65-42ee2d3fce0c", "value": "T164748D4AE7B748B1E5470975229FB33F9B2416144328CDDBDFE0CB447A33AE26539A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878858, "uuid": "de51f7a5-2d6c-4a84-9af6-e1c1555f8a3b", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878858, "uuid": "f015bb7c-2257-4345-902a-0e47c49384c2", "value": "6144:oRLI6zZvCw5/8m5RtUHD2zSnK90dK7KDhAoK4Yeh9bDvJFeqRLg1WX:QTj50mhUCzSKGPlAoK4YehVvJFe6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878858, "uuid": "251108ed-3000-482c-9747-789b2c1d57b5", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878858, "uuid": "879ec4b8-748a-4486-a8cc-ae3fb50b93da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878858, "uuid": "925587de-c40f-45af-ad6b-facb9e106b54", "value": "e825d2769b56c7a988c4b62858e1e6ecc08950404415114e40ab135e73d1faef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89da675e-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911525, "uuid": "08fafecd-0e63-4104-a08d-face1f509dab", "comment": "Malware payload (Mirai)", "value": "60533f4d3b706db4cc040b21231aab4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911525, "uuid": "c81f774a-582a-449a-9788-66d048b88a9e", "comment": "Malware payload (Mirai)", "value": "e82f53e3d431363b155163b30d016f105d973eceecaa266b297bb141f0021eb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911525, "uuid": "ad3af0c4-b4ac-49c1-8417-99bcb811fc69", "comment": "Malware payload (Mirai)", "value": "3506f0bce973a8093a8e862ba2edea46b42692f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911525, "uuid": "a9cc7bfa-ff1a-4ca2-aeff-5b2063231bff", "comment": "Malware payload (Mirai)", "value": "9bfc404b0eb870109994b237a170c54156dca411cc4c32dbe604779db2094d6c0c3b35aaade676a473ed87e177a9a1f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911525, "uuid": "cc68965c-055b-4baf-b42a-7a42b21dad6e", "value": "T1E5E609927F84DE4FE2A820348AA6C23463D53E40C6E074368666F7191E7F2759D2BDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911525, "uuid": "52518c16-6e13-40a1-817f-c1f5fc88e38b", "value": "98304:gP9IyJNUn++91nz+SGOuy6uEV9Cfrz8CjE1:gnUn++91nz+SG/y6Wrz8x1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911525, "uuid": "936327e6-081c-49df-a1a6-f225a9727e22", "value": 14090402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911525, "uuid": "e0b7fa81-ccfc-42b6-a817-72ce9eec258c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911525, "uuid": "9b99edfb-bb8e-4178-a599-c491cc5cb410", "value": "wife.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b98350-5998-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1779864776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864776, "uuid": "477605df-97fa-4b84-aab2-cc838503e00b", "comment": "Malware payload (XWorm)", "value": "22e3d4a0aceb25b9f31c8c59ee88a2ea", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864776, "uuid": "972ed636-033c-42c2-a474-8cf813fd07b6", "comment": "Malware payload (XWorm)", "value": "e90d5891b3eb341d4d4c97cad0c7cda528341ef40cada4cdfbfc17f939181bf4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864776, "uuid": "7eebbd01-8fe7-4f50-82b1-f8e978c98a41", "comment": "Malware payload (XWorm)", "value": "aa9a79d247f29bf81f0bba39180b7ea061f5e68b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779864776, "uuid": "eb7bda15-5d61-44d2-b517-f3d2aa7a4747", "comment": "Malware payload (XWorm)", "value": "323ff975bbac3b7ef39bd7368c5ed69b4f65f70d87b7e15b7b154951784cc385a0fc3e1ac4d30aabf0d8eb46a1713c6a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864776, "uuid": "2347ab4b-e276-4b31-8019-61032221831c", "value": "T18C029639DA67B8808B6A328175E1D8C3208EC7079F6F76A4F75D145A2B14710F7EAB4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864776, "uuid": "469aa407-a834-4342-bf8c-fe265ce542ac", "value": "192:t7RTq2Q/W0MrM/MPdNxEDvs09UuPoYAwE4OR17v4Sak1UZchvn:LIYM/6dNcJotwYASakaZchv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779864776, "uuid": "1debf917-c0c6-49f7-8561-70c015c39034", "value": 8377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779864776, "uuid": "e8f97c84-e458-4dff-83ca-98c298a33e6d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779864776, "uuid": "1b6c274a-3ea4-407f-baa2-d3c4f84905e3", "value": "awb_shipping_documents_bl_packing_list_commercial_inv_05_26_2026_0000000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c1475a-59ba-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779879229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879229, "uuid": "d730e76f-ac96-4e75-b505-ea593297ce45", "comment": "Malware payload (LummaStealer)", "value": "d05f11fd51f311a746c67f26ac39617b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879229, "uuid": "f114596f-de96-4ff4-aeb0-030cdf4dd8ec", "comment": "Malware payload (LummaStealer)", "value": "e953696af12d84a049df3ac84d5abcce24bbe9a4e1f92878f5f656f4ad700b4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879229, "uuid": "e4193891-45be-4eb5-a6b5-ff201107a796", "comment": "Malware payload (LummaStealer)", "value": "20e5fcc33e035711d33daac0d1455ededbcb42cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879229, "uuid": "0fe4e3b4-a393-4f52-882b-af68fca846a7", "comment": "Malware payload (LummaStealer)", "value": "1dcc1fd48c1c27786d1efa60c4f1b0d7df74c77213a1d1cba86f12620c970e83d4405d0aedc9db87ee5523e6d3d38375", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879229, "uuid": "377b9dcd-4a42-4dca-ad94-fdbf5116be30", "value": "T16BF633DE85DA45A1E88A347914333F1AC23DFCDA65E194CB13633932653D982192EBFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879229, "uuid": "7d50f469-eb61-44c6-957e-11ed014304a8", "value": "393216:5yafBO03sQG+h7KF66rmblbgQkawDrvVW8kSYpCSC7Hy26eaBKq:5rfBO08l+hn6yBbgQCDTVW8kS2EHLjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879229, "uuid": "ff38db2a-b68e-4c74-b871-2d8c621fd32f", "value": 16366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879229, "uuid": "c2c2bc16-6c16-4fa2-ad6d-d80a9cd59f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879229, "uuid": "8820c555-a285-4321-b98c-d35491c122a6", "value": "e953696af12d84a049df3ac84d5abcce24bbe9a4e1f92878f5f656f4ad700b4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e879a01e-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880760, "uuid": "b93e30c5-c687-4fa4-8922-79a72df63cad", "comment": "Malware payload (Mirai)", "value": "16ee863e773df0fe1636b73e594aa04b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880760, "uuid": "391e632a-6565-40a4-b778-67875e86754c", "comment": "Malware payload (Mirai)", "value": "ea182eb3ec602e353a08ae53cacac2d0dcb5d4269afd8bd00cbfb3ea379c7ce5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880760, "uuid": "f1d7fabc-81a1-447f-b6a7-ba8b4b16c795", "comment": "Malware payload (Mirai)", "value": "b441c0102242d140e6ceaeae27767b1f1cee4282", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880760, "uuid": "6dbd4ce6-8e2b-4158-a828-18c44c1128fc", "comment": "Malware payload (Mirai)", "value": "02c5ad04db905797fb937da01d0b6fdf06ab29df222c1794a6ade95ea3dddb9aa34d7ff8d6718c3aabea3c34d3d50bc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880760, "uuid": "67df0124-c4fa-4794-a3ba-01bf936e8ccd", "value": "T174E32A42731C0947D2A32EF4363F27D193AFE98121E4FA45294F9B899275E32454AECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880760, "uuid": "b10eec1b-7a4f-4a94-955a-e5e8604dd80d", "value": "1536:U822JUryj404Qx6JIcTNFffsxjaYAHpnOAhuvedqSxrTvAA5c4y3tLqvSkwsp14:s2UXrQx6icnfsx+YAOVe1xwAHJ14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880760, "uuid": "5d9f2131-e1af-4f29-934e-7642470128ff", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880760, "uuid": "35777ff8-aa43-43ce-a42f-5a451890c1d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880760, "uuid": "b3116c8e-cb24-4f25-8d6a-1e3d9f160cc8", "value": "micro.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf9d037-5a27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779926080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926080, "uuid": "967ab528-4127-47f8-b4f5-eae7f772699b", "comment": "Malware payload (Mirai)", "value": "20de3289eeac8dbe3972c447672f55b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926080, "uuid": "b5f3e955-a9c1-4f0a-9b86-db497837d0f9", "comment": "Malware payload (Mirai)", "value": "ea62639ea64ed1168e780977d32381a2a5cc59582d5e5583c75ee4354f66a6be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926080, "uuid": "6910ecb2-b141-49b3-a801-4c38ff83cd70", "comment": "Malware payload (Mirai)", "value": "645dc059167da0b0c3bf23f3bfa9c6cdc67fa177", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779926080, "uuid": "b984cd58-423f-4aa7-ba5c-38f3d71e2486", "comment": "Malware payload (Mirai)", "value": "cbf0758091b6180c56b4ff1dba3380cf301ad1a4c9bfd5deb81c746c8bf5a6269464a7330e812144a1b17f817dc0b5e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926080, "uuid": "1387bbfb-bce8-42f8-b8db-0ba1c5df1dff", "value": "T12E243B46EA404F13C0D727BAF69F02453333976593E7B306A924ABB43F8679E4E23615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926080, "uuid": "383bbe8d-f63e-4da5-83f0-adc591291b4d", "value": "6144:Ba4fLzdul1+xvxY0Hfa9GHXNiF8FmcKmKrcTwM/RdTwmH2WNLB5n:FfLzduluY0Hfa9GHXNiOkedTF/zTwmHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779926080, "uuid": "5ec40a64-6fbc-46cd-a1bc-270e71f4b8e8", "value": 225082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779926080, "uuid": "73f30e4d-ba6e-4d82-911a-dd9933874445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779926080, "uuid": "95e1ddc7-0ba0-478e-b4a3-4a051f1332b6", "value": "SecuriteInfo.com.Linux.Mirai.9816.12186.9680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776bf640-5991-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779861673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861673, "uuid": "23680301-bcce-446b-9125-b91b81e6e264", "comment": "Malware payload (NetSupport)", "value": "a61aaf60ee37f1480c6f9260cd0f8962", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861673, "uuid": "58885f7b-6aea-485f-bc99-2f6bcccdbe2e", "comment": "Malware payload (NetSupport)", "value": "ea701a593942223d89f967310be0a5f80e941a68589e9786e6fd3c91ee6648ad", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861673, "uuid": "b8a2cc14-a3b8-4660-af4c-b4d1fd251404", "comment": "Malware payload (NetSupport)", "value": "7a7aa931b5a4cef617e69c134ab5d50a8b402c6a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779861673, "uuid": "81d12e79-0a1d-4fdc-83a8-7ef90d656b32", "comment": "Malware payload (NetSupport)", "value": "8c51ffafb3f41f7d851cfc543be8da7c684aa11d5b6a20bb614c2719ce4d4180a3cd8932b2522ee93f21979e32e1e547", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bryonsad-net", "colour": "#C869B4", "exportable": true, "hide_tag": false }, { "name": "feersona-net", "colour": "#C4B52D", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861673, "uuid": "6d2d8993-624f-4363-8c85-4dde1a252447", "value": "T14A90025420C10255E1705AA073612394918224D16595005884587492E9A60A477A5381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861673, "uuid": "5f1b4d88-13d0-40ab-b788-5350c64f7f34", "value": "3:rhmiTaigFNFALggKLWOK0:NmGpAYL1eWl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779861673, "uuid": "beb6b540-0fbc-4363-b3ee-8da3154974a2", "value": 53, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779861673, "uuid": "9703d8a0-3a87-4e7d-a293-90b5cc3678f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779861673, "uuid": "c5612b33-9c62-4435-8bfe-fe8ffa141d3e", "value": "msIeXEc.ExE -PAcK\u1d43GE http209.99.186.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb2bf46-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878865, "uuid": "384ea7c5-9c42-4c02-aeaa-59baced9831f", "comment": "Malware payload (LummaStealer)", "value": "fe15e79d038d2ac59b797226d21227f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878865, "uuid": "21ec1036-99e2-4f15-bc6d-6b8217850ca9", "comment": "Malware payload (LummaStealer)", "value": "eae6c129efb4414d5c36044d06158a2caaf3dcfab0a928bf806885bf9b4c8b45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878865, "uuid": "8e3a89e3-182e-4e77-b576-e44b8336b4a8", "comment": "Malware payload (LummaStealer)", "value": "37bc7b70472316745df2dc8cd48488faf1c00858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878865, "uuid": "a332728a-94b5-40a6-8f5c-78fac238b708", "comment": "Malware payload (LummaStealer)", "value": "4387349ed9f393bbcadec51ee0eb90fa8cc9e48907c81e42a4e1c4c1594d0e687eb35275669890258d6a6f973a900d3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878865, "uuid": "bdceb5cc-3f16-4f24-8715-823cb4eb3d79", "value": "T1E2748E4AE7B748B1E5470975229FB33F9B2416144328CDDBDFE0CB447A33AE26539A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878865, "uuid": "c43f4025-4fea-4168-beab-e66b09e069ee", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878865, "uuid": "0f83784b-c186-4618-a4c8-0d4f76161fc3", "value": "6144:oRLI6zZvCw5/8m5RtUHD2zSnK90dK7KDhAoK4Yeh9bDvJFeEEs1WX:QTj50mhUCzSKGPlAoK4YehVvJFeEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878865, "uuid": "0d2cf45c-370c-4cda-8db7-d6cac52a9618", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878865, "uuid": "6ebf6ac6-0f8d-4e54-8895-29ed8e837734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878865, "uuid": "23f8b63e-ee1d-47e9-b345-65d80eaa9106", "value": "eae6c129efb4414d5c36044d06158a2caaf3dcfab0a928bf806885bf9b4c8b45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30d91da-59e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779898710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898710, "uuid": "67329883-8720-488a-b935-3b5b92fea1bd", "comment": "Malware payload (Mirai)", "value": "47d7df07ee19fe59645dace6cede8d88", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898710, "uuid": "123cc961-754a-432a-a05a-2ecb9bedde53", "comment": "Malware payload (Mirai)", "value": "ebceb9dbc06f796c199744d45c3e81654dbf6f928ab844c6b5af59d39e45ff26", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898710, "uuid": "268e42ce-9d0b-4d9a-9e65-c2857f17dc20", "comment": "Malware payload (Mirai)", "value": "47e1a460cc812a3e2050f7daf235c227cc7d398e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898710, "uuid": "074e58e6-d4c7-4dde-80e7-66bb93b4b2db", "comment": "Malware payload (Mirai)", "value": "4fcc9fb1bcde98428c5982c175ce0e9b8650ce34accb11014fd04295580cd11528a67e5caa84fd5a7adf8c70a12ce015", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898710, "uuid": "f3e288b9-f66a-4bb3-b0d6-96bf5d03b946", "value": "T1ADE32A45BD428F13C5C721F7FB9E428D37266F69D2FB3102E9256FA0278A5D60E3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898710, "uuid": "03ab4ff2-6c2e-411d-9c47-97ed76d07a80", "value": "3072:gaH1ex1Pfk2Q3Ub84mvs5NvDmCTp4EallcCq:L12Xs484mE5NvaspvaLcCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779898710, "uuid": "05f60282-b742-419f-b3fc-e66b031676f9", "value": 154700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779898710, "uuid": "ee568d4e-a439-4e97-8e45-f5fbeb3741f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898710, "uuid": "fd00607c-10e9-4afc-9311-cfcdca000a39", "value": "nova.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd48700-59e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779896552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896552, "uuid": "8f248a70-8007-49fa-923e-6869b64da63d", "comment": "Malware payload (Mirai)", "value": "f8cdc31ac851530b09314bc8bf83af35", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896552, "uuid": "97b05f45-c798-4f4a-a716-3c7a27d9b89d", "comment": "Malware payload (Mirai)", "value": "ebfe8a9e44cc0fb43949d6888b87ae43dbbc34420cb34ea5d4675e7678e92334", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896552, "uuid": "d19356a0-69c3-437d-93dd-2cfa5da5aaaa", "comment": "Malware payload (Mirai)", "value": "d0cf1a70643b0fdecd669ce4ee9bb1fa98151963", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779896552, "uuid": "adbf572d-a077-41f1-a18f-4208ee98b053", "comment": "Malware payload (Mirai)", "value": "8cf42fe35d83b6a1a89d95df5df5753d3c18486eb189cc506ddf5459338161527b883cfc2c0c888f2673609f720a7902", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896552, "uuid": "bf08104b-6a41-4135-a28a-98a0bacee7db", "value": "T194633BDAF801DD7DF81BD77A4857090ABA30F3D502831B376397B9A7BC721981922E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896552, "uuid": "08271019-444f-4f85-8955-dc8157d6a5bb", "value": "1536:nIgNflENo7E0KDYnPq8VpHw1ox16P9dJWLa1ngChQB2:nIAflEGqEnPTw1y1y9/SChY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779896552, "uuid": "6a9453c6-7710-49ec-b1e3-514eb8388b94", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779896552, "uuid": "ff6e52f4-b684-4e22-b9a8-26dcedafd482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779896552, "uuid": "f706601a-6088-4256-9762-a4c9e4aa2e55", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda43b2d-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880689, "uuid": "1b44732c-339d-4be2-85ec-4b789c38b258", "comment": "Malware payload (Mirai)", "value": "459047904ebbd77987898a1bef23614a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880689, "uuid": "bc9ee383-6fc2-4a7f-b4a7-6378278da0c5", "comment": "Malware payload (Mirai)", "value": "ec71de1ba9c0edf21b46f0f37c8cf8e8a627f2c09d9fb3ca8790d15c886b309b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880689, "uuid": "5706fbc7-5766-455a-8786-a03a49aced3f", "comment": "Malware payload (Mirai)", "value": "f273a1d8ea39af9cf17b407c079c159856925ed4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880689, "uuid": "ffdf2326-ecf9-46b7-8f33-65c22be15c7b", "comment": "Malware payload (Mirai)", "value": "9edae3f6cba8a2dd722fd224384491e5dcfda272417a1ba1ede6c54c472cb830f4bdea09d4679e321ce1ec0c27a0c546", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880689, "uuid": "e223c531-fbf2-48d0-b50d-e2fe3840624e", "value": "T134F33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880689, "uuid": "940257b2-e83d-4a93-ae00-d30cad610655", "value": "1536:CdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpSEn5p5M/LW:87vDtrnPTR71gmX7Dy7fMpSxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880689, "uuid": "e091f85e-f6a6-4478-96fb-c972ea6c9b56", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880689, "uuid": "c9e39234-66b3-43c3-a98d-ddd63527567f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880689, "uuid": "1ca0faa1-81c3-4cf0-b9b4-b1167a8fae3f", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf346987-59b5-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779877255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877255, "uuid": "62b01e34-571d-469c-8f9a-93a64c2272f6", "comment": "Malware payload (NetSupport)", "value": "1593147dab8e7e8ae788b8b562686b8f", "object_relation": "md5", "Tag": [ { "name": "65-109-104-71", "colour": "#BBD6B5", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877255, "uuid": "0fe6bb43-c37d-4116-b24c-d371a1b9aa53", "comment": "Malware payload (NetSupport)", "value": "ec846c136296f60387bf58fe9846a8bce05f024e454f51888e434a76654b99ae", "object_relation": "sha256", "Tag": [ { "name": "65-109-104-71", "colour": "#BBD6B5", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877255, "uuid": "f80b9460-4de8-40f2-aea7-0f2b7642d7b1", "comment": "Malware payload (NetSupport)", "value": "4adb32be5a8344cdea3a747745135446694c6e8a", "object_relation": "sha1", "Tag": [ { "name": "65-109-104-71", "colour": "#BBD6B5", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877255, "uuid": "33483236-13af-4c07-b7f9-6b679f822f55", "comment": "Malware payload (NetSupport)", "value": "9ce55de3a80964a313777d0d7726e23d07dfcdb143dbad3f4310bb4a6f8249be064525965c0c9fed923058bf142108dc", "object_relation": "sha3-384", "Tag": [ { "name": "65-109-104-71", "colour": "#BBD6B5", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877255, "uuid": "bb6cad3b-b754-49f8-b555-68c838af26a1", "value": "T1ACA2E1C698387A43E005C7BB6378974313677C9D4B4F077AF9E6B3506C260B95EDA818", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877255, "uuid": "2817526c-9482-4cc3-b42b-6de73cb79cc5", "value": "384:RRaScOps9u2j2UlY1Zi9pVL/0+Y3Ga7q749prswcOmrOR68bvELtPMjfe:RBcOp6u26UlSZEV/x3a7VlmrKXjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779877255, "uuid": "e8dc270f-dff3-471d-a7e6-d8fcf9f326ef", "value": 22107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779877255, "uuid": "6342dacd-00e2-45c1-8f20-fb48a62c2fff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877255, "uuid": "2917cc14-3e8c-41bb-9385-57e5f05ffdfc", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9a7e50-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779881007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881007, "uuid": "c5e0269d-3024-4214-9dff-0058d805b43a", "comment": "Malware payload (Mirai)", "value": "e82f8691a9cbeba31ad3167a925767f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881007, "uuid": "3d49d407-cc07-4de8-9d97-e540a2c8de8a", "comment": "Malware payload (Mirai)", "value": "ee0761c29e4ac9d03656dfb793064704bbcab7892ae341e0ae242e4cec921055", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881007, "uuid": "6fae1138-721a-4f3d-83f2-7582185efbf1", "comment": "Malware payload (Mirai)", "value": "921731de850902b1e5ab4777cfc522bbe6eaea56", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881007, "uuid": "b38927a2-4e69-4531-bfd1-6666e1af4616", "comment": "Malware payload (Mirai)", "value": "c1e58b9a939602d3db39b632e13e9a40351d38ce95e8be0549fd5aa644b4e240b63fc7e6072b26ea20236bc1b9a07b54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881007, "uuid": "14a6fb42-b380-4994-9b5d-1ebf779dab84", "value": "T1C2B43A49F8809F61CAD539BAFB5E429C73574BA9D3EB700699101B3437CB89B0F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881007, "uuid": "e76fa861-8fd5-4acd-975f-98cf73b84be3", "value": "12288:PkrLxxEReNr7nsE1JuS0Xwls3nFPwWS9XqZ6Ey9ikvhZpKq1yM:PkrdxEReV7ltlHr9XSWikv7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881007, "uuid": "a3a83d3e-21c8-4fe2-a479-ac1804ecea89", "value": 529612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881007, "uuid": "3e87d5f1-3172-44ac-8fab-c3c04ac2b50c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881007, "uuid": "9f2625a6-0f74-4277-a7f8-cf06df2572f4", "value": "bot_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc4c725-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878915, "uuid": "07cf4d49-0456-4a89-9cc5-011f081366b2", "comment": "Malware payload (LummaStealer)", "value": "8498701072be977693809ce11f80e6a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878915, "uuid": "ffb17188-c9c1-4944-a946-410dccb14488", "comment": "Malware payload (LummaStealer)", "value": "eedd6d76f687ff01274bbd3b6ccc4e751fc50f5c4b8fc774d21ee91aee857638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878915, "uuid": "869e4a02-2aba-4c70-b338-ad6b78830c9b", "comment": "Malware payload (LummaStealer)", "value": "9e3cc977c8ce3b5728b830a8e258aba3f7366e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878915, "uuid": "feeef53d-6629-4b72-8d9e-3b4f319fe1c2", "comment": "Malware payload (LummaStealer)", "value": "db64c6406f3fdd3abab4952f58a285a7c454f345650331aca7ca34fa2cae9df6b7e4b862422eb6ed815e3e0dd7e7fd44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878915, "uuid": "8bda9abe-8bd0-40c0-b058-3b3309800bd7", "value": "T194747C8AE7A758B5D94B0838229FB33F9F3417194728CECBCAE0DB8079376D25535606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878915, "uuid": "0c5e8159-49a0-44a7-ac94-9b12848b0ec1", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878915, "uuid": "69e904a3-ad53-4f02-b855-66201eab5fd4", "value": "6144:EfVhOeLXTkgw1XNDdeqMkDQ4HZ/r0j3qjBDrVSEOP3qdUng5r:86eLXQ3cqTDNHZ/r0OtDrIPAUg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878915, "uuid": "bbccf550-3eee-43c8-8140-0c0506d69fe2", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878915, "uuid": "182f6fdb-41a7-4cbb-9516-111b5a9251cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878915, "uuid": "5a98c48f-e81b-43f9-aa14-69d691ce90ab", "value": "eedd6d76f687ff01274bbd3b6ccc4e751fc50f5c4b8fc774d21ee91aee857638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d134fde-596d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779846086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779846086, "uuid": "f490f811-c008-455f-b8c9-f407e2a6856d", "comment": "Malware payload (Mirai)", "value": "6b7e639ac7356f4a2623a09376a255fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779846086, "uuid": "61680141-0e2a-4ec0-b087-0963fded2939", "comment": "Malware payload (Mirai)", "value": "ef59883df2f7d787cb605d61a765b1208975ac6f5a547d3b85b0eaff870a96bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779846086, "uuid": "f8c9a43f-0af0-43fb-a714-15e1f2d566ec", "comment": "Malware payload (Mirai)", "value": "de963272c9143689bed3100563ab1706cb90c8e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779846086, "uuid": "9940cab7-dad4-496c-839c-7227abec2eb7", "comment": "Malware payload (Mirai)", "value": "60522b0102a107b9572d9946cf60e6062df252dbb5c1c7092f5b8a6ea3aa7e8e4b5e1077bb8777f6aa4f41e419e3dec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779846086, "uuid": "a2fc273a-96f2-4b01-bd08-fadc33a021d3", "value": "T1A3B3D70AAF541FF7E82FCD3B05B51B0A248C651B22E97F357538C928B95A60B46E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779846086, "uuid": "6a555fb3-988c-45fd-878c-d3cb592788cd", "value": "1536:K8+MzfGRag7l9/VKWlT1lODAQWz/S6I6938SHMu4DYMwXZHpKm9rdu:K8/zfGAg5N8WlmDAQWz/SbQ74DYMkTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779846086, "uuid": "6876ddc1-da88-4153-b014-9c09f6214790", "value": 110116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779846086, "uuid": "cfd8bc25-68d6-4980-ae1d-ca9e33147923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779846086, "uuid": "0d7befa1-1f61-432e-b886-202c332702d0", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46aa14c-59e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779898712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "97454b59-0507-46c8-bde2-9f6c6e736d17", "comment": "Malware payload (Mirai)", "value": "8f40b87cb65735213c352ce34c0556f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "beeb05ef-d69f-4c13-9a6a-304913b68675", "comment": "Malware payload (Mirai)", "value": "efded22b2ba90d1ead2c5314532c0f6f0a9f80dc0c2e07efc9c4277184e6a020", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "8ab84b47-fdc2-48a7-8889-1f4dd042d7ec", "comment": "Malware payload (Mirai)", "value": "56e52d11faf3d12d5597f85ad79357844287f7ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779898712, "uuid": "b054c17e-e287-45af-8c46-5c89f293b62a", "comment": "Malware payload (Mirai)", "value": "c27c6cb548bd9615f93419c0de4887e8a4b3d1093ac50fd358f5c935ab62e5393641bfe9aaf2321fe56bb56131a6980e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898712, "uuid": "eda28a4b-4b01-4c1c-af4f-11e4de5bcb9e", "value": "T165C30982FB43DAB3E44315F111FBAB255A31FC3E0C36D946E3647CF2A9216C19616368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898712, "uuid": "c10f3d4a-c7e7-43ac-849b-c92959731d6f", "value": "1536:EpaVasNSgRmQRRbQoUl4FD4qi/7N/kmI3jyVSuMrKeSCBgp:EYaGvsB8o/XI32cucfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779898712, "uuid": "62810352-ec4f-41f6-93ae-a5ae1720e6db", "value": 121780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779898712, "uuid": "8861dbf5-1beb-4120-9892-059750474eaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779898712, "uuid": "19245dd7-e522-498e-8fb6-d314de518232", "value": "nova.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef776919-59b6-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779877766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877766, "uuid": "9ba5e81f-09af-42a9-9285-1c7446dcf229", "comment": "Malware payload (NetSupport)", "value": "4120011e8e9d68ba1af80759ba86a01d", "object_relation": "md5", "Tag": [ { "name": "5-252-177-201", "colour": "#6D7D18", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877766, "uuid": "8ea72ca0-d166-4c73-a2ab-2136de1343d0", "comment": "Malware payload (NetSupport)", "value": "eff4d6646db1a4b4b8810a7804340edbb5d0b9f3f89ca0300a58887bbc49e302", "object_relation": "sha256", "Tag": [ { "name": "5-252-177-201", "colour": "#6D7D18", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877766, "uuid": "7003d0d3-dca0-41ed-99bb-071c033096ca", "comment": "Malware payload (NetSupport)", "value": "7ec94d29081e90ac43e0161d1c87fcbdd4129620", "object_relation": "sha1", "Tag": [ { "name": "5-252-177-201", "colour": "#6D7D18", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877766, "uuid": "198dc5a8-3640-49ef-a78f-a94d1e95ae4b", "comment": "Malware payload (NetSupport)", "value": "4e2ef489c94c78abf9de767df29e7d2fe6f9764851df615ea5fd2486527edb1b2615d11ec0238c13b94da7d9574748fe", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-177-201", "colour": "#6D7D18", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877766, "uuid": "1904ee6d-595f-4413-b6e9-5460b465ddd9", "value": "T1E6A533C6640BEC9ACB44CB30C05FDF225BBE2F158F963581F39A159CAC8D9184B2D967", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877766, "uuid": "82ea914d-6f94-4bcd-8557-9af5704354b5", "value": "49152:HGWKcquayYrp7mnpVhEBNO9GAeuAGW4XpY2F8cMUCFQOJK02w1N9p:H5quJSiZENOzeuAGrXnF6uolVVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779877766, "uuid": "fa6fd584-82dc-4d12-9ca4-1e69462acd86", "value": 2235611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779877766, "uuid": "9f266c94-d424-40a7-9a56-21f42bd1986d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877766, "uuid": "99974aeb-f443-4bd0-aabe-7833b9c2ae67", "value": "eff4d6646db1a4b4b8810a7804340edbb5d0b9f3f89ca0300a58887bbc49e302.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5929179e-59db-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779893405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893405, "uuid": "188aac68-4c87-462c-8816-a9f367709c6f", "comment": "Malware payload (NanoCore)", "value": "c3e4defb584bfc76abd60129a5e84817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893405, "uuid": "1bad13ed-7f43-46a1-93f0-b9682965b289", "comment": "Malware payload (NanoCore)", "value": "f017a517cca5e63ad557dc9541ab6284a23ecfb7e6ccbc0d24bf42981af81d6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893405, "uuid": "794df4eb-de39-41ee-b347-9cceb3aeadad", "comment": "Malware payload (NanoCore)", "value": "d3bc0eecc0f1de4199feebd14b7549d6bd3d796e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779893405, "uuid": "5171b7e2-c869-48d5-9f7b-1fe08ac207d4", "comment": "Malware payload (NanoCore)", "value": "4b70643d01546a758a530947f98fbf58c5f99a839d5ff1514f43b77b4f2986df2982d650956f2886ec98a7d91c146395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893405, "uuid": "4ac74d0e-e003-4185-9072-4bf08a916353", "value": "T1C014CF2A77A84A2FE2DE85B9611201574378C2E3DCC3F3EE18D855B39B663E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893405, "uuid": "ccae15f8-8223-4200-8203-ba4376c29a4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893405, "uuid": "70fb09d7-75c3-4e60-bee7-d9a32bfbd536", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIe0svu1SEImfAF8V7m8CJvflR1:MLV6Bta6dtJmakIM5DuvImfVqflRj0vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779893405, "uuid": "6361bfe3-0b56-40fb-b8fa-4480fe4913a7", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779893405, "uuid": "c6f25d04-45b4-43bb-b222-1cf60aa8c227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779893405, "uuid": "62570a50-4b4a-40e9-886e-b59d1cc4b915", "value": "EMU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ca999c-59cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779886797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886797, "uuid": "7ca583ae-3e62-4f3f-97ee-efa8e204241c", "comment": "Malware payload (Mirai)", "value": "f1e996fe10bd44f48843588caf13bbd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886797, "uuid": "84cad01d-b80b-48c7-a313-f201e60ee9fe", "comment": "Malware payload (Mirai)", "value": "f054a91b6f33dd32b449f4f2ad57a427750239f007c9a1ec760e96f39bb85d9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886797, "uuid": "012f8dca-b045-4b9f-9614-9674fec4df13", "comment": "Malware payload (Mirai)", "value": "3346dedcf99992b28dd8a5a5af7bd0a64aad09d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886797, "uuid": "f02692c0-f924-4e3d-aed2-598221871598", "comment": "Malware payload (Mirai)", "value": "3f38ef0077e6be1196e08abe0a98a67b311a3e4351a1582f575f7896f80fd81535935f0200ac5a3380fbcf80371ef2e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886797, "uuid": "bc7adbf2-b399-46d1-ad28-06dffd8e81dc", "value": "T129D30945FD509F17CAC265BBFB4D438C772A17A8D2EE720399256F20378B49B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886797, "uuid": "a9877548-c9de-441e-8034-caec4221f49f", "value": "3072:Fkf6myBYDtOOumbG3wzDFYbP5bt6i74MXKEKBTwDj:qACtj5bG3wtYbRb0i7FXKEKBTwDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779886797, "uuid": "7200b761-573a-463f-bce0-e7cce53612d8", "value": 134200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779886797, "uuid": "d9bc5169-504b-4cb1-9de8-129ca1b171ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886797, "uuid": "c16f99f8-a9ac-4ec1-b11c-23f0a9110afe", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca34aed-59b6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779877761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877761, "uuid": "5c532d10-c2d8-4392-ab40-2dba40bbbf60", "comment": "Malware payload (Mirai)", "value": "b28600a763dd900b9bf1969538ff4269", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877761, "uuid": "3dd8a264-8dfa-42e8-a958-49dd767e39e4", "comment": "Malware payload (Mirai)", "value": "f088e37c4e991303929b587b9ce4e0f69a6a3b89fd3f7e90ace855b5456ca257", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877761, "uuid": "0e1027ca-a8a4-42d7-b5f2-ee7372773cab", "comment": "Malware payload (Mirai)", "value": "e1cfdc24af1b07e153c49da5da400aa079c8ff18", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779877761, "uuid": "40cc5365-6a94-4bcf-a330-8f43bfd12318", "comment": "Malware payload (Mirai)", "value": "654c1258626c59ef59ff02ce01cd4aa068973598b7c5d78f300492e49c0f45c794ff6a419e089f01b04271ff0a59f6b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877761, "uuid": "d94ddd02-0bf6-4ade-9ffb-eb2dca42f4ee", "value": "T1A1333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE62AE32A02B117618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877761, "uuid": "bf4d5b31-e416-4d54-bec3-51c8e12e8d7d", "value": "768:7wheNR1eCZWUJ2S7pRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV98fN+s:7wOt37pOzwLMU431ANA0BLBCTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779877761, "uuid": "847acfda-6427-40d6-b194-ef9231620dd1", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779877761, "uuid": "e6d33201-e634-455b-a0c6-e16830bb29ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779877761, "uuid": "fbedb9ed-cb97-4198-9c36-7a18bdf48f4d", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a3db51-59d0-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1779888941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888941, "uuid": "fc7ddcfd-e9c0-4f8e-98b2-c0440e2aa4e3", "comment": "Malware payload (SilentNet)", "value": "b491f4a9c86f8348e4b5f8625f2884c3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888941, "uuid": "be4f4d27-0b6b-40cd-baaa-af4c8b484b59", "comment": "Malware payload (SilentNet)", "value": "f26b9f6711b29af723871707e5256ebf496d08f8f09678b646baed89168b85ae", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888941, "uuid": "4ce14841-78cf-42eb-8f98-0cd5882f195a", "comment": "Malware payload (SilentNet)", "value": "0af7ce99b7b747ec6fed77720e90250319fc1a14", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779888941, "uuid": "70c43a29-0a5f-4a73-88e1-5f095d30cf73", "comment": "Malware payload (SilentNet)", "value": "ca309a7abef4f50d23ccf4420749f4ef233ba53069ae4aa8d4ea72011d77c5c4fd6db3cb29bd0a28b91fd0abdace06da", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888941, "uuid": "13fc307a-a03a-445a-9534-31f9faec252d", "value": "T173F63305D4BC2A36CC6B7733C21169B0FD2D12E8564BA4BF65BD06CDA88969707483FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888941, "uuid": "64bacbf8-a59a-4e98-b877-ac1c7f08f61a", "value": "393216:NSAb5BcQFGJJ1YU6GYZTbgS6x4QhHlD/83xeg/Jv7:Bb52QFUmUKZTbRlwpkfRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779888941, "uuid": "350fb28c-b08c-4582-be48-544c6983dda8", "value": 15717873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779888941, "uuid": "f3a0e0fc-d216-49d2-b7e1-48e07d78491a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779888941, "uuid": "d531dd1a-5dc8-44e6-9437-8d6682c5c52f", "value": "molesthack beta (1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5fc577-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913593, "uuid": "c63209f1-46ab-40c5-8f88-34ac66520b51", "comment": "Malware payload (Mirai)", "value": "4097a70213b8c0c1d9f84384df5655b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913593, "uuid": "c12154c4-31e7-4803-9f83-ad6ea7f2a7ee", "comment": "Malware payload (Mirai)", "value": "f3833c9e7daf508a9d09e7836a71ec3d83b587f4f3ff0fbb3cc89532956c9c4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913593, "uuid": "902f657c-f865-4d32-8e7e-fea57d81f592", "comment": "Malware payload (Mirai)", "value": "a2fd46c380a50da7e45d6aabd68278e7d2425f91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913593, "uuid": "159fdfc2-3bd7-499d-a582-cf40433abe99", "comment": "Malware payload (Mirai)", "value": "1da9022be7a48cb0c2370cba08749f974410d1633233452c24843a8890619b5611cfc43ea20e91f58d6b2b389a21b8e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913593, "uuid": "6caea6fd-35f9-4d98-bff7-6893b42f442f", "value": "T14D632A8178819A15C6D502B7FE2F008E3316976CE2DEB3128D145F647B8BD6B0E3BA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913593, "uuid": "1a086951-1bd7-48c8-85d5-54ba66ceab4d", "value": "1536:rdnou4rxxFGf3tqPmh6X4d+v35o/28UEBybEPXsXTAMx1JLTWwL3ILiWPw9KW4q:1ax7Utkmh6X4d+v35o/28UEBybEEDXxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913593, "uuid": "461ab918-630a-427f-8a15-ce1ac1e3adb3", "value": 70784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913593, "uuid": "4cd620b7-df76-45a1-a3ae-d79e379e173b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913593, "uuid": "ee2dcb0a-39c0-4c8b-a4dc-70bd2cbb43c3", "value": "Akiru.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c6c52a-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924705, "uuid": "4d922437-7529-445c-b972-9601f2a9a41c", "comment": "Malware payload (Mirai)", "value": "ca55c27b5ecc77ebfc2411390a57d408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924705, "uuid": "369b5b12-f52b-4620-a5cd-61bc069c96db", "comment": "Malware payload (Mirai)", "value": "f3dc0675822730c6b3b491a5704c4038faecc1cadb411d38d1ce45ad134494c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924705, "uuid": "39cbed0c-3bd9-4560-9f34-f34e93cf1c16", "comment": "Malware payload (Mirai)", "value": "550c5bd378b52397333fbd5cc74fbe7472a2607b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924705, "uuid": "7e45fae1-efec-4ff1-ae3e-ae83c6d28032", "comment": "Malware payload (Mirai)", "value": "43e1107745b2cd1368601c0575a092c1a45f6e9ba3218e3c899ada6c48dace66044a67813c61b335724a191a4b069c13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924705, "uuid": "1078f7b1-5d5c-47b3-9a6d-7cd3a18960c2", "value": "T12473024136C5518ACB58757F80BD8EF73AD8CBC2552A21B0602BE031ACBD5708D2AF7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924705, "uuid": "a26ff5a8-8ded-4590-96d9-431e98c28873", "value": "1536:IIxdjI7Zq/gn/2rZ9wtVFx4lTC+neylBc7klCMN18EQnIxaZZgEcPe:FdM7ZqkO9GVj4VTeylBcQbN18EQR6ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924705, "uuid": "f8353b11-2b09-43c2-8e08-2a283ff16c5a", "value": 77848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924705, "uuid": "e30173e0-e842-48d9-ab2f-bdb2d5e70753", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924705, "uuid": "f8c15c88-8608-4f47-bea5-e427af20725f", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ab6670-59be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779880866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880866, "uuid": "65f3ad82-b4fb-4af1-ad58-2a1f154e30e3", "comment": "Malware payload", "value": "5407883f53c9c02e96f39516d7ce3dc6", "object_relation": "md5", "Tag": [ { "name": "cac-py", "colour": "#957F7B", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880866, "uuid": "7743b57b-3982-45f2-b3cd-d34f03df7371", "comment": "Malware payload", "value": "f3f978924ca786f108a31ab045a0f30eb0ed4cdb66c487df88cfb92e3d9f4b00", "object_relation": "sha256", "Tag": [ { "name": "cac-py", "colour": "#957F7B", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880866, "uuid": "db165b9e-7c5d-452c-b521-e32a83a414f2", "comment": "Malware payload", "value": "d5b5c16b6de25f4daf4a0c11baad6bdeb4090a4b", "object_relation": "sha1", "Tag": [ { "name": "cac-py", "colour": "#957F7B", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880866, "uuid": "f117ec67-9ae0-40a3-b1a5-20feb91b94ff", "comment": "Malware payload", "value": "2751eb07dd7a4892859b0c95213ba79e2741f89013b841b012b4b3fe6534fe6bf4066456563ea13b23deab148910e23e", "object_relation": "sha3-384", "Tag": [ { "name": "cac-py", "colour": "#957F7B", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "sharedrivedocuments-com", "colour": "#84BD2A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880866, "uuid": "9e5be7bd-230d-4336-b6c8-6881b6b1b069", "value": "T1172533659241FBC9242D25F4DE10771F794D259CB8F82A50CBE37886B2D880CE277A7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880866, "uuid": "f743db6d-6ae8-4f57-835c-04d7b566e204", "value": "24576:aG6wv7uLokMnkCdPw6g/JMgVRY51sGHnObYbMou8Gp6RCEFC:vpi0DkCdP6/JMgVa51+oR1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880866, "uuid": "15a6b1f8-9502-4f80-816b-009f69a38f3e", "value": 1044023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880866, "uuid": "2a2482df-029e-4825-9932-4746ef8c3d82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880866, "uuid": "493c4b89-d07b-4e29-85cc-f7fab10b2649", "value": "cac.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c153fa11-5994-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779863085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863085, "uuid": "b67c282f-6bdd-48af-8006-54cb4d43c33d", "comment": "Malware payload (Gafgyt)", "value": "d8324bd7a187101a82f28e7ee9020222", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863085, "uuid": "4d9f31fa-c33d-4fcf-bfe0-09718bfff09e", "comment": "Malware payload (Gafgyt)", "value": "f47ff6f8a84107e83bda9c0a5bc0b966b14429af56816ea3919bd559c6c96d17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863085, "uuid": "f7ace9f6-ac32-47f7-9cf4-fab5886038d2", "comment": "Malware payload (Gafgyt)", "value": "5288d8394f3949db9a864903bd7cd9e14b54b589", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779863085, "uuid": "c2788cf5-5302-4bb6-b2c9-1a2c563f65ec", "comment": "Malware payload (Gafgyt)", "value": "2da3dbf22144fbf492c66e4c4bc0851cdec10627b34c53c57f1575894109b3e8021c59ad4dcc1612f4df881bf2a507a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863085, "uuid": "84ad3900-3388-4a3b-9cef-ecdc94407998", "value": "T1A7E30706670D0F43E1532DF4277B1BE1839BAD9228E9E584750AFEC993B1DB25106ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863085, "uuid": "93badf88-7227-4a54-bc3b-4e4ec7026640", "value": "1536:W4qjwGWndLThzLUxI4SXG0uosJLLUuc1LJlY5Zp9QNPrLFhVOvA7U4JSx1UZGlHA:W1jdcTJUxoXGAuLLudJlYcNPrpH7Gwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779863085, "uuid": "dd3a9b81-b2e7-4cc0-9532-9534a5c40744", "value": 147240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779863085, "uuid": "bc07987d-a79a-43a2-93f0-54f5fa99ddb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779863085, "uuid": "cdbe8ec9-8af2-4e3f-9ba0-2c7fe860ad1a", "value": "wife.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63adec97-59ba-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779879249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879249, "uuid": "36499b0f-4b14-4b38-9a44-ba41c4ffa2f8", "comment": "Malware payload (LummaStealer)", "value": "52e60046e25bbcc9211118535848bbc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879249, "uuid": "7498c9c2-0569-4360-9e54-93f8b78832ae", "comment": "Malware payload (LummaStealer)", "value": "f4e7253057c0f3a88e3161cc29fe7fb89899b0c3935cc32ec4c8251e30a4b857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879249, "uuid": "41bd38c7-f0ff-4693-8154-00baabc33c58", "comment": "Malware payload (LummaStealer)", "value": "71a9b44bb739d38b2beed855a2f9899d0441d145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779879249, "uuid": "75f03367-725d-4b64-b70d-60b000a72b53", "comment": "Malware payload (LummaStealer)", "value": "bdbe386c3e1ec05ed33174018aa96a498ba4723290eea873f94baced3477c8876bff3dde88dccc227c0d0d46e412e4ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879249, "uuid": "26fea0bd-0f48-46ef-87ca-8489bfc51d69", "value": "T1590733CA318D0595F8EA3539A43B3F1A853EFDDE40E169DB019738137639EA2112A37D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879249, "uuid": "cd3e1bef-9b2c-42aa-b637-9591d985c760", "value": "393216:EZBCL3vPRepIhmTVHrFoI1j+nNXCx7K4qvnRD:FLRei49xoIdUIJK4a9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779879249, "uuid": "f2fb20da-e4aa-4b67-b478-05df6281f20e", "value": 17390976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779879249, "uuid": "04334eed-31cf-4ac6-a2ac-0bf905cd5c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779879249, "uuid": "ea581ac7-c276-4317-a002-45af3676c572", "value": "f4e7253057c0f3a88e3161cc29fe7fb89899b0c3935cc32ec4c8251e30a4b857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916da561-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878896, "uuid": "393be07b-5da4-43e5-bfc8-5c39deef5fe3", "comment": "Malware payload (LummaStealer)", "value": "1f9cf93c50ddf1c39ca2e848cd12627f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878896, "uuid": "b9d14b90-391e-445a-bcc4-e0da5b50eb9e", "comment": "Malware payload (LummaStealer)", "value": "f6547fd81be956f1a63feb41e6d52602260c59f537dab801a8d633dd2145262e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878896, "uuid": "5fa878fc-58d8-4365-b3de-ea69578de17f", "comment": "Malware payload (LummaStealer)", "value": "f3ffac9db9333fe7a3a1b123612be4b58aa115d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878896, "uuid": "258b2c46-441f-42f1-bd1f-d03d7aeda982", "comment": "Malware payload (LummaStealer)", "value": "5546c79ddebff54fa555e8fd4187066f1c35cb0b97b079d38805c3ee29bb6730a336e2c61cf6c6bd58fc5b2e732a7529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878896, "uuid": "daf3afa8-6668-4a2d-9603-390cb3eb25ce", "value": "T1AC748D9AE3B758B0D5470979216F733FDB241A168728CECBCBF0DB4079272E26535A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878896, "uuid": "f8cba37e-ac67-4515-b07e-8d1424a4d230", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878896, "uuid": "932a92cc-0b61-4425-970d-a02c8f03e8d7", "value": "6144:zYZ1hfBjV7gE7gVPMBa58tvPES6x6vZLE579QPv1ebx+RVG:8Ph5Jst8tUcV3lnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878896, "uuid": "f1537f6b-f1a8-4bde-821a-649d2fb6ea69", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878896, "uuid": "d37b85b7-2a98-452c-82ef-986f5de28446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878896, "uuid": "82135310-1ab3-4770-94b1-02bd621deb7b", "value": "f6547fd81be956f1a63feb41e6d52602260c59f537dab801a8d633dd2145262e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a233394d-5972-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779848430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779848430, "uuid": "74ff12f1-e76c-4aa7-9982-14d834b1423c", "comment": "Malware payload (Prometei)", "value": "b96c609a23d99311412be16d71f72439", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779848430, "uuid": "8e4ab89e-c8db-44bd-86f1-66a73821523d", "comment": "Malware payload (Prometei)", "value": "f6df6524e0652c9a9d3449bd4be4aca123d9d0abf287bb79e883ef7d0c329223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779848430, "uuid": "099d4ffc-9313-4c67-81e6-64e40ac3571b", "comment": "Malware payload (Prometei)", "value": "e024314e3cf7e171736eebcc285073c3c5e442bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779848430, "uuid": "f12f2740-9c07-4488-878d-3510f298d3d6", "comment": "Malware payload (Prometei)", "value": "1bc46b58ef52dee80d65cd863b824a05d41187ce7611810912162d13d8fa065b9906a0ac8b05eb5ccd01f8d506874df4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779848430, "uuid": "7993cac2-524f-4f58-a24a-81ca304d5847", "value": "T147C68C73905334D9E5A88DB4D11416526DBC388B5738A3CBBAC471F667BABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779848430, "uuid": "9974d9c5-c02f-41d1-8585-709e0693f7cf", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQU:cqYUQuVDt0TZEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779848430, "uuid": "fdaa6557-d1d8-4084-91b1-ca23db4f38bd", "value": 11796480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779848430, "uuid": "e2f15458-1c3f-4a03-92c2-ea382b6903cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779848430, "uuid": "442e378b-6eb7-46df-9a0d-f12aadd67829", "value": "f6df6524e0652c9a9d3449bd4be4aca123d9d0abf287bb79e883ef7d0c329223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab13e58-59ca-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779886106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886106, "uuid": "feb0e8ac-6697-42c4-91c2-ca7c1e298698", "comment": "Malware payload (RemusStealer)", "value": "83f841092d1e2d11303507eade2c8ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886106, "uuid": "023c9552-733e-4589-b426-62c535539d35", "comment": "Malware payload (RemusStealer)", "value": "f718b444d39a0aa1a1635878b05c7ff7fe1528bbe63093fe20e7c6dab7ad992c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886106, "uuid": "a6d02bb0-0c8e-4e94-ad4f-45a39635215c", "comment": "Malware payload (RemusStealer)", "value": "e2ad7999e57db49b48353cd855677dbaa5574e4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779886106, "uuid": "2d658b51-7544-4a1a-9a4b-467c37adeef1", "comment": "Malware payload (RemusStealer)", "value": "bc6ad9373c688982090fd42b1c7723d0670ba9dcae061e3253af4619239b6eb8bfba1245fd95a505cc42e9078e3990c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886106, "uuid": "e8ed6c88-ae51-492d-85d0-30f27bb8ad05", "value": "T15C755A477CC064B6D5EA923188B6A2D17732F8490B3127C33B51B6BA2E737D44E79398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886106, "uuid": "5a330fab-386b-43d1-aab8-ed918f1aa402", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886106, "uuid": "b91b0b68-7292-42a4-862b-bdfbe3b13382", "value": "24576:3g18kF36aZrcBddXyszIOjQ6OgLP88Wu20yUp8KD1mEiS/:3W8s3xZ6nC+IJgLPwKD13ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779886106, "uuid": "2f32bc2d-7fff-4f30-8519-c7a6804cf7d6", "value": 1643136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779886106, "uuid": "9b2eb4e7-c8c3-4959-be4d-4e91706e1879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779886106, "uuid": "76facccc-232e-4c04-9c40-69031fdf8490", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37abc47a-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924702, "uuid": "8e452e66-3c88-450d-8381-ddb207dfaa12", "comment": "Malware payload (Mirai)", "value": "89f95f18e2a39c61d658fe63845e2e5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924702, "uuid": "65b8ec00-77ec-4da6-8fc5-9e25f467e126", "comment": "Malware payload (Mirai)", "value": "f72b0c07cd2253596c0c480faa3ed5bed75ba3af88749825a24d9951901f55b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924702, "uuid": "b0aeb36e-0698-4f3a-bc2a-283383ab284f", "comment": "Malware payload (Mirai)", "value": "8352b22e5b0567616cb86973a46aa2430d93e0e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924702, "uuid": "48737c93-2754-4ac6-890b-31b3d04cd022", "comment": "Malware payload (Mirai)", "value": "6686f05891cffa94131f14fa7cc1e19036a4bf3ff7c0e3f55b2d9ab65e81c4b09f078b44a4ee1151f84abd0433f40385", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924702, "uuid": "420d74f9-c412-4daf-91e1-f4857f7d9c39", "value": "T131D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924702, "uuid": "ae81da31-2081-4645-b438-3cfdc203c605", "value": "1536:UFKdzElm18uZJNb4AdFa8eAZHk4VB7fzTTr71igYSvGueqZvd2UlqKwyw6RNPYTo:UFKp50yU8e947Lb71izSftBdRalKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924702, "uuid": "cc178540-c879-4fae-b665-5c9dfe499491", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924702, "uuid": "4f5eca1a-a5c1-461f-bbeb-65c42b661bc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924702, "uuid": "d6b29e51-8c90-4537-a9ab-18003bcf60c6", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a94cf9a-59e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779897729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897729, "uuid": "410b835e-4ba9-487f-a8b1-7f144820e1e6", "comment": "Malware payload", "value": "48f04c04682c8d02e05419c0efe699b2", "object_relation": "md5", "Tag": [ { "name": "89-40-206-73", "colour": "#29C15B", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897729, "uuid": "d8105a97-a2c3-415e-9b1c-941016560dbd", "comment": "Malware payload", "value": "f797946b59964b2caabba8e9ee65f1e8e59f9841a40b3e1097c315c8cd1a63b7", "object_relation": "sha256", "Tag": [ { "name": "89-40-206-73", "colour": "#29C15B", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897729, "uuid": "9bd5669e-e616-4ac8-9c62-5c10914bd9ae", "comment": "Malware payload", "value": "444c45fa99c731bfdc32bf5cb16d6c3736ceb7dc", "object_relation": "sha1", "Tag": [ { "name": "89-40-206-73", "colour": "#29C15B", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779897729, "uuid": "ca423c99-552e-4d57-adfd-34f003ee81b1", "comment": "Malware payload", "value": "5905ddb8d320416e31428df8f003e4f10e23ec424516e80307ad56182517fc73dcb6cd48bf7b72d629c721a8a1cc5bee", "object_relation": "sha3-384", "Tag": [ { "name": "89-40-206-73", "colour": "#29C15B", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897729, "uuid": "5c351411-c22c-4882-b830-2ddf3f558f74", "value": "T162E423D3B663E42008D169B5A4A605EFEFCC36CC1DB7D5E500E91B5AA076F67A03123E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897729, "uuid": "d176dd81-30d8-4acb-aa08-0bf5a179b5a3", "value": "12288:1czbH+YuMhAT5fVWzoYQHCs/NxJw6UqHGo/SH1trqlQkfXQnDv5pVmIi:sbH+YmKzkCsFxOxSGQSDulQkvCDxpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779897729, "uuid": "cdc78a6e-0564-4cdc-9877-b7f602d8d543", "value": 688406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779897729, "uuid": "5ac7017a-d218-42f6-9e48-ecd811c61a4a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779897729, "uuid": "269a682f-738d-4acc-9701-306ca7bacac3", "value": "NUIBQAWYABUVVGLNNJUT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819e0e93-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911512, "uuid": "0d9c5690-29f7-4ddd-9e71-48d66cebc6fd", "comment": "Malware payload (Mirai)", "value": "c5b30619520bb254388b45bab5aeb19c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911512, "uuid": "db309681-f365-4d52-ada0-79993b7b8ed1", "comment": "Malware payload (Mirai)", "value": "f79f734fbb986e430bec0f5c6a131c8115b1561896ce92f329594949b58baf73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911512, "uuid": "9196c03d-049b-4e86-9499-f2a3b8eeea22", "comment": "Malware payload (Mirai)", "value": "8d49d671809bb34773187d049b486e49e0872d81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911512, "uuid": "8d805769-2fec-4413-ab7b-8d0f228a49e9", "comment": "Malware payload (Mirai)", "value": "8d31ed8302a2eaa4adec950a36854ba5ededa1f9b074b2134df82cea1caf132f8468f737202b47c6cb59a79a3afd4842", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911512, "uuid": "69f002f8-e096-4de6-a37e-a661642c4737", "value": "T1E1C67D95FC0D7472DACA7970AF6612943238BC089F42DB136A18BB3DA9F2B55CF13161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911512, "uuid": "50f0f84f-4577-4910-a71e-5081feca38b1", "value": "196608:LRDeDyaRG60SB9ghjGxlCS++91nz+SGJYpXhWVL:lDejG60SBGhjGxlCS++91nz+SGJwX4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911512, "uuid": "ebe008dc-c628-440d-9cb3-1c423fb54cbd", "value": 11862178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911512, "uuid": "134c4085-1746-4bd1-9877-5ca870934b61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911512, "uuid": "30734d87-cced-4084-94f4-f013b848fae7", "value": "wife.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7642f360-5982-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779855228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855228, "uuid": "21496083-9259-451e-b78a-407f5b81c596", "comment": "Malware payload (AsyncRAT)", "value": "0e9cfa89ff9d48538b81f4e198219489", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fiend RAT", "colour": "#D72C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855228, "uuid": "19c54895-53e7-4180-98ed-e2bc8ba6a346", "comment": "Malware payload (AsyncRAT)", "value": "f8dd628d4f6675854f25eedad9480ef52b90aab6af6e207283fc909650f73e55", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fiend RAT", "colour": "#D72C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855228, "uuid": "dbfa4a85-06ba-459e-8312-7ed0fa41feec", "comment": "Malware payload (AsyncRAT)", "value": "870723150388dd8088b75105411b6ab519d077bf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fiend RAT", "colour": "#D72C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855228, "uuid": "4d6532c8-ef7e-4c3a-9f21-35a1497d0fbc", "comment": "Malware payload (AsyncRAT)", "value": "59d6ff88bfba1a9c462fce8ec3432f86f18e5737de8c8834d5bca0434d3a11212d0a668c577140bc3bd6e3663058e050", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fiend RAT", "colour": "#D72C7B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855228, "uuid": "72a234c5-f647-4661-aedc-f8832ba42cda", "value": "T17A464B47EC9146E9C5E9E230CAB68253BA717C455B3163D32B90F7382F76BD0AA79304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855228, "uuid": "509302d1-3b2d-4d82-8aa3-6feb898801df", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855228, "uuid": "5dcc699f-dcd0-45e6-9148-bf8a6e8980e1", "value": "49152:Qv1FNXfXEbd+Vrjb4Bu90uMz1xS3MOeb5EAKBhKqF3rbaXwacC3EIU:qsOrjghuM5JEZBpxr2iYEIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779855228, "uuid": "0e8ce51a-66b3-4750-a8e2-05f3d68c63f0", "value": 5626368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779855228, "uuid": "5031db55-a0f8-4fac-9f4c-e8868530f9ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855228, "uuid": "fd8c4a17-34f9-490c-9087-534b10023324", "value": "sefting.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c0dc69-5a05-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779911519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911519, "uuid": "dfe8939b-e6d4-4566-8453-6e1183af680c", "comment": "Malware payload (Mirai)", "value": "537e31c59810477096e6b594a4aaef30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911519, "uuid": "3a3b8476-deb2-4237-9f17-44ba30d19663", "comment": "Malware payload (Mirai)", "value": "f94275636ae16d7803aff43ef0ee9756a02ce68e0cf180ee96952333710a98fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911519, "uuid": "4c2226ee-f282-4627-8e97-a9ebc0b77901", "comment": "Malware payload (Mirai)", "value": "22014332efdf53795c79fa825ba290f9e4a0cefc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779911519, "uuid": "ea83bf03-d2cf-41fe-883b-3b54be112f5b", "comment": "Malware payload (Mirai)", "value": "22fe77f0ed5ac1dc72e1a9dda543e6a2d063b83fe09a6c0e6d7e944f48bed34f1fb5b26820d313ee5b36dcee908e16f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911519, "uuid": "d8ca6e03-93a3-4fce-972e-675d68feb0a4", "value": "T130B68D02F6969F66CA3D45B5CC9117A82330FC026F839B4367A4F63CBD7E6816E852C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911519, "uuid": "a9a3ddcf-40f8-414e-8540-73164e3d6a4f", "value": "49152:xItdtq0TGowUBiS4UWoHNhUOfT840REUX/OnuESGC+++91nz+SGT3xe4miCUuWEA:x2aG3A4kE1++91nz+SGM2qn4oUTqEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779911519, "uuid": "0b57b428-978a-44d3-aead-fda19cf45993", "value": 11403426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779911519, "uuid": "28d001bc-6953-416e-ac99-1299bd6d7dde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779911519, "uuid": "7b570d04-f884-4f8c-a9df-07a3da09f6d3", "value": "wife.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99c14a8-59ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779900090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779900090, "uuid": "f2e2ba57-bdb7-484d-b32b-e4f45f42733c", "comment": "Malware payload (Vidar)", "value": "fc602880769fd6a451fa93050b1b6daa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779900090, "uuid": "e56349d1-da0c-424c-80e1-1a9fa775c633", "comment": "Malware payload (Vidar)", "value": "f94f45a24746ee098abdc9b1a9e326c516010576c51a44a29d62c304657f9284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779900090, "uuid": "cfc69fb7-38d6-4de0-9b0b-aeda91e47aca", "comment": "Malware payload (Vidar)", "value": "8df75269a165d4d9482c0406bd565d496b270df5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779900090, "uuid": "d513f23e-a2b9-4e56-8791-827217d63ab4", "comment": "Malware payload (Vidar)", "value": "234f306c30cb511a5122472c229c6e44a4d4867357ef499497ba1285c21b500e6ba4349e1d86a119b51cc0b8c049a3fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779900090, "uuid": "6787aac1-2107-4797-a313-d2e6c9a955a4", "value": "T19DA59D477CD464B6C5BA9232897592E1B736B8490F3127C32E09B6BA2F373D40E75398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779900090, "uuid": "2dd81e4b-5ffa-454a-85f8-0c43afcd0449", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779900090, "uuid": "adfa6326-602a-42d5-bb21-94087b86d32a", "value": "49152:jzW3KQVuEB7XYdro1SE9k52NbRgLPCID1q:e33uE6+l9k1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779900090, "uuid": "52765d0d-e993-4a0a-bcb2-b7c11e9f2e1b", "value": 2222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779900090, "uuid": "e2505438-db70-4122-a4d9-9dd047832087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779900090, "uuid": "67ad0613-98dd-4832-baae-8d1ce4801bc6", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3ae245-599e-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1779867288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867288, "uuid": "49819cac-001a-4282-b5cc-40fcb89b9cc9", "comment": "Malware payload (BlankGrabber)", "value": "b5846086ee7390a55bad54897b0085ba", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867288, "uuid": "44c3cf7e-e89e-43f1-ba42-f78477eb3447", "comment": "Malware payload (BlankGrabber)", "value": "f9a13ee99330b4bb48d17d48737cd313cadff01abeaee519dd709aea5a9b5f24", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867288, "uuid": "54641cce-29db-471e-a49a-042daf2d2a15", "comment": "Malware payload (BlankGrabber)", "value": "49611478650fe0f94f7717e41fb3617afdc2e68b", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779867288, "uuid": "bdadbc1d-66a7-45d9-8083-0c2205569a0c", "comment": "Malware payload (BlankGrabber)", "value": "a464a2fe3771923d3c2969d2b8675bd84c99054d8e92a9a82dd70fdb31263c0fd3080896ed24d5ca752ac686c04b956a", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867288, "uuid": "1e676ed3-c420-454f-b7f8-898d7dda8d41", "value": "T17DC6337B1E1B5063DDA9B538BA368617F6B0B6102E632F8D1FB81B317D6E824453F604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867288, "uuid": "adc4f07b-8a5f-449d-b88f-aec54d6e0bb7", "value": "8d098195649b2e61b48ab91f9b521bc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867288, "uuid": "5ee8884e-7273-480e-9881-1e76c2b2987d", "value": "196608:T8/oRiKMBvOJwVqiqpCJk4dziYPSS3uaFm7977HskA4NqSRr4QRjMF0DbLiIn:TlMwasY96guQm7NHsn4qSRcQpi6KIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779867288, "uuid": "7ab80e51-11fe-44c6-af36-eccfaa0e3dce", "value": 12466724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779867288, "uuid": "0344049c-3349-4c67-9f13-ff4703fff036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779867288, "uuid": "badd5984-58d2-4edd-a245-fde7f3eb7921", "value": "SecuriteInfo.com.Python.Packed.104.28969.16229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0de1e03-59b9-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779878922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878922, "uuid": "1557d259-2edc-43a1-a27c-71189bd4a742", "comment": "Malware payload (LummaStealer)", "value": "832f69cd57ac577d8614b67d277462ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878922, "uuid": "9445cd98-0fff-451b-bac9-5b20ee16120a", "comment": "Malware payload (LummaStealer)", "value": "f9d321383e2af848332a0a15e1eb4c561c85f00aea243ba39ac0077421a340c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878922, "uuid": "37d443ec-f9fb-4719-a15d-1ba3947ba84c", "comment": "Malware payload (LummaStealer)", "value": "641dee3bb4f9844aa1feabc2abff35ab54b3232c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779878922, "uuid": "fe1e1c9b-f64c-4851-8bde-4fe2e89f16ab", "comment": "Malware payload (LummaStealer)", "value": "e65ec55c6aa11b0746c6608474acb687ff72bb6530ed2c13b37b59422a1163ffc0fa2724da199afc4ea754983852d6cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878922, "uuid": "8663a90e-dae7-4825-b933-cdefb3fb5f6b", "value": "T197747C8AE7A758B5D94B0838229FB33F9F3417194728CECBCAE0DB8079376D25535606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878922, "uuid": "cdc6c595-bd6b-4ebb-8eb7-dab233ae0a23", "value": "723e777b1dee1682594ed1ce566ddb93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878922, "uuid": "a3bfcd8a-5c5f-441f-a9f9-e90e042172de", "value": "6144:EfVhOeLXTkgw1XNDdeqMkDQ4HZ/r0j3qjBDrVSEOP3qdUnglr:86eLXQ3cqTDNHZ/r0OtDrIPAUgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779878922, "uuid": "d45b8339-e682-4415-a0ac-4801345421f3", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779878922, "uuid": "10d926a5-629e-4413-8bdc-1bfd9972cc7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779878922, "uuid": "94e7eb3e-36b2-4522-93a5-061561111f30", "value": "f9d321383e2af848332a0a15e1eb4c561c85f00aea243ba39ac0077421a340c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e07d2cf-5984-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779855939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855939, "uuid": "6416cb28-093d-4bbd-bc1d-1edf60417127", "comment": "Malware payload", "value": "df970d0f6d05021ff52bc7dd2f2577c5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855939, "uuid": "875d808f-2fba-4a65-8f9d-a04a99beea26", "comment": "Malware payload", "value": "f9ff724662898af2d7f86f6cbb6be814bd0b64e91d5b361539860e1e97eb9a9a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855939, "uuid": "5c5ee7e7-ee04-450d-97eb-1a7681926638", "comment": "Malware payload", "value": "8c07067e750f9f56449531aecc14a43e7c40bf2f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779855939, "uuid": "8539aca1-2641-4836-aa4a-b681d4b54cf0", "comment": "Malware payload", "value": "312bc8ee2809c58e70b4edec61f4894aec45fb8b205977827fb8601878be3f9f71ce9cc9b975b39b04893ca24da27226", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855939, "uuid": "d2a401b5-1966-42eb-a323-4babf2d09108", "value": "T11741CEE664E2BDE83895A99DB263421C14D4FAC85CFB478C780D7D35B346408F6263EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855939, "uuid": "f21723f2-cd88-4d1a-931e-473412c318da", "value": "24:o9qMkpnIDd3Eo+h/s54NvIaNHnJl9vYp1MSQ7BVKfF5Bf2DND7DtcgM8StLDJi5m:o9qMyIB3ETK8VE9cBCmRH4i5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779855939, "uuid": "3cf157d6-d1bc-4b66-b7dc-4baf4e195813", "value": 1982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779855939, "uuid": "785468db-564b-468d-84d6-62189b4669e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779855939, "uuid": "c598d7bf-a2e1-4d5f-a93b-744ca33899ba", "value": "bolts", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455370cd-59ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779873615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873615, "uuid": "594a08e9-c7f6-4b8e-b768-3ef749bac060", "comment": "Malware payload", "value": "d76f24d9c5de2d55aa6224c5b19eaa53", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873615, "uuid": "75aa617c-8a0d-4892-b1c8-b0046d7dfed8", "comment": "Malware payload", "value": "fba3d657c87ea72deb88222b1ce8e204b70f651a25d942edddf5f5ce49d0ad2a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873615, "uuid": "f11aeedb-56b9-4f31-ab58-74f67cdaab0b", "comment": "Malware payload", "value": "c7ceb84a9710d04989112100cb23fa3d78192c49", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779873615, "uuid": "ff4fbb9e-f74e-43e3-8db2-c6ead5475fda", "comment": "Malware payload", "value": "b870d9834726fe094a706892ae799c549ed672d091ff626da247b31b6f0dc1d3c81ad69f9719c76038454a110d74de61", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873615, "uuid": "5194311f-fdbf-4f88-83f3-e6423b2e3851", "value": "T12C4533AA8BC857C7378987F1134A5F2C2F6CEE4216376376610C130A4967FF1D94A1EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873615, "uuid": "4110b1f2-cc48-45fc-9399-8f249c9d2585", "value": "24576:WfX3Cf4AdqS75XxHXHUKP4drOn0cAeUkEpe08MtQCMv9CWD+XroJbDgpkntbDeSH:W/3RAdqWXxHX0KErw08MrMv9XD4roJoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779873615, "uuid": "80c1b76e-22a4-4feb-bda4-3ac419f680c1", "value": 1258457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779873615, "uuid": "fb21dc09-42cd-4dcb-b624-26f4b1e47395", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779873615, "uuid": "555ff8ff-9966-4663-b3af-6ea16b6582da", "value": "fba3d657c87ea72deb88222b1ce8e204b70f651a25d942edddf5f5ce49d0ad2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c052db59-59bd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779880693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880693, "uuid": "43b8123d-7873-4a05-a037-cfdfe21d1dc5", "comment": "Malware payload (Mirai)", "value": "6c937609a99188af4050bf8e7887d097", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880693, "uuid": "25862c7b-6ab3-490d-a261-ba07942f4ba5", "comment": "Malware payload (Mirai)", "value": "fba6ff6ea9e666f03642838fca610976e2c1a25f6820e3a670e166f51e52aff4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880693, "uuid": "98f95840-7f0c-4670-b76d-fb99b23395d8", "comment": "Malware payload (Mirai)", "value": "112c0c3bf27cc6b4f8497a4e54c370e2d9ce6a4d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779880693, "uuid": "1ecb3265-3af6-4916-b799-ee7796ac8d10", "comment": "Malware payload (Mirai)", "value": "8deb05e33c07d85faaa16f655334d0bbb66836ac08251691dc53669eee437fb6d40e5020248728bed1996c478215b41f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880693, "uuid": "9e0fbe9e-8087-47d8-b3a6-f5db7611e6f6", "value": "T15D4189E2F838D9A3B64B007AF58CB2502AC3093F4565A596709F2CD0277DD6DB42E339", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880693, "uuid": "62d4a7d8-0178-4ece-869b-3acca98adde6", "value": "48:vFA5158Na+rMmrDU1DhE4KZXYe+Ku34vkRCM:dAq/rU8Ye+FgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779880693, "uuid": "f35cb9db-9898-4909-bfcd-e61a3cb1dbad", "value": 2111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779880693, "uuid": "c22ff8ad-61ee-4e06-8559-d49c32c23e3e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779880693, "uuid": "d534d253-483d-4168-a1f1-a09ae2583f97", "value": "microc2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9eb558-59be-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779881012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881012, "uuid": "fdd2a689-ae33-4bd7-993a-6392e88d633a", "comment": "Malware payload (Mirai)", "value": "013f5099dc6f7f28022cab0f9464aa3e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881012, "uuid": "21900ba4-24f2-4db9-9ba9-608520ec6d25", "comment": "Malware payload (Mirai)", "value": "fc3daaa8827237406aff79a12b496534e5d1f38f571db010fffbbe8e5c04363c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881012, "uuid": "877e56eb-5a0f-484a-99e5-c747a1ff17f1", "comment": "Malware payload (Mirai)", "value": "43b22725223f184c97ad23493106653173750700", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779881012, "uuid": "b9504a39-f0b9-49fd-9b3f-0be56030199b", "comment": "Malware payload (Mirai)", "value": "afc9faa67c32471730506b99fbdd47bd7f886a62cf34f30ad7ef545073d267649ec8795b028e18b5cf375a318148582e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881012, "uuid": "df3a215f-98e9-4e73-927a-e9be7f8e3843", "value": "T1DDE45C237701CFA5E318D27106F3CA5045D525A31AE345E66378E32C7B606AD2E6FEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881012, "uuid": "c1172325-8914-421a-a9e1-b026fdf8f02c", "value": "12288:9qwHqDiAQJgMnmtNOV7L+Uwwigvi0+TI0rEQ+h76NPjnW/82mb/8lEg1CHpzrqJH:0wKDigupV7CUwwigvi0+TI0rEQNFM3Aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779881012, "uuid": "e75f27b9-38c8-4f37-b93a-c59af5a74947", "value": 688380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779881012, "uuid": "f772ec7f-f94a-48ec-8502-cf19d5605d82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779881012, "uuid": "309002c1-3402-454d-8371-7a3755cf88ac", "value": "bot_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca27526-5978-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779850944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779850944, "uuid": "dd0da1c0-6126-4f73-8d91-2b128e0f8adf", "comment": "Malware payload (Formbook)", "value": "6ba2add3b3429475e07822f3c4501bd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779850944, "uuid": "dbe30061-a81e-4831-ba9e-ab7d847cd4f6", "comment": "Malware payload (Formbook)", "value": "fc944b5465a41ab46b5ddaddd499c84170e2454ca6e5fce9987914aa8dba1cbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779850944, "uuid": "49afea87-ee8d-43cb-9aa9-5304ceffb034", "comment": "Malware payload (Formbook)", "value": "e417a120f0138270583747cbf78ff7d4c1a82f7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779850944, "uuid": "30b9ba3f-ec47-456f-a437-91cf5fd42591", "comment": "Malware payload (Formbook)", "value": "e95daea34f39c0299b5e2841212f8e91367843f3d73053f02fdc91e7f1e4d1f6480660783d5434674e7833266c97610a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779850944, "uuid": "16de0244-3e5b-48a7-aacc-14a8bade08e9", "value": "T11B351228275AD906C4925FB01D31E6F526684E8DE822D113DFEBBEEFF87E6453501382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779850944, "uuid": "22ad9d3b-7485-48db-8cd1-d833ab18ec1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779850944, "uuid": "c6126ac0-96ba-4c1d-a2fc-e57464cb458f", "value": "24576:nwAEFT0DnNv8cWIwOXR+/ry/h7F/co93o2:w3FQJv8cWIT+m/h7Bcu3o2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779850944, "uuid": "f7e96dd6-4b78-49c0-98a5-13fc38f5dda0", "value": 1060352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779850944, "uuid": "7a7350f1-6665-4183-a756-8df732f2caae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779850944, "uuid": "c6a0354d-3386-4792-947b-860a54fa69d2", "value": "TOMPS_209645_MV W TRADER_ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561ddb64-5a0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779913586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913586, "uuid": "51e08281-8eed-4a0a-b97e-d684b8464112", "comment": "Malware payload (Mirai)", "value": "0fcb0e187047b885163dbfc9f73eb935", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913586, "uuid": "9ca8feb3-5892-4dd0-ae5d-98e0ed3bda1c", "comment": "Malware payload (Mirai)", "value": "fe60ed662f919c0aa0fac40741e0b5901d294bd7b96ca4d614c4baa8e8aee854", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913586, "uuid": "92823ca4-1b2d-4dc2-b2a8-a4e196acbe40", "comment": "Malware payload (Mirai)", "value": "945be209a2eab0a3e2936a3a9f8252c5effb0ccf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779913586, "uuid": "b0bb5f70-a000-4569-b3a6-ae37e8ce9bd7", "comment": "Malware payload (Mirai)", "value": "c36e047f90dbcfaf57d904304ad18f08669682106959750672993df5fb8d3b2aece6a25a374b89f1e6fe0026a149824b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913586, "uuid": "848ec2ec-7a91-44bf-99ad-d98a557dd0dc", "value": "T153431907AA4582FCC0C8D17856BB7639D463F5BD123AB2A737C4FE1A2A45F711E1E209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913586, "uuid": "c284d879-e94f-4395-a8d6-28581af4540e", "value": "768:yAscK/rP5aLYf0Q/HeVNZb6SFSsJtzJ7+GHm/cETBNSxk8jgJkpaQwtTQ:CH/rP5aLYcQ/HKLbEsjZ+lNS7jccwtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779913586, "uuid": "4add565e-ba9c-4557-92c3-b3d927cdf807", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779913586, "uuid": "7ce379d7-5b47-402b-8c7d-69c8b3926380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779913586, "uuid": "374cb52b-e6ab-43b0-b037-5a2482f2fda3", "value": "Akiru.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385ef9ed-5a24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779924703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924703, "uuid": "995de70e-f801-4028-95f8-c1c5c9fc540b", "comment": "Malware payload (Mirai)", "value": "b00017be473b172d233075be9d24e610", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924703, "uuid": "0b749556-d53e-40d7-a7be-30cae214e482", "comment": "Malware payload (Mirai)", "value": "ffd6619b30974fc02fd23ae7668d9b1a7771559b54431c9b2464306f3e107c67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924703, "uuid": "0928ef70-504b-4741-a58c-c2be070988e6", "comment": "Malware payload (Mirai)", "value": "c172d0ddc1bfc413f1ddeac42c2dd37d81c9ede6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779924703, "uuid": "c80f2720-6411-48c2-9d79-a61b6884c920", "comment": "Malware payload (Mirai)", "value": "4ed14270dfdfdf69a8b82d5eaa19ed7c4c3f16931838e9105d461c970c1abeaefcbfd380c7f5902902d54934285d615d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924703, "uuid": "a1749029-60b8-4978-87a2-ecb88a8f9da6", "value": "T1FF330202837109F6EC82DAF12A96D9FD73DA4C6C5BE48E1EC4D8B7561DE586809243E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924703, "uuid": "280680ab-af19-4e55-966f-709c42291445", "value": "768:I2tU+Pv5mbHwH7Qt+9JERdCjQeWnwM9EAJ2QrwhNabU1IwjW7pDawXLh5lSidP9Q:dtX5EQP3ujwM9EXQrw77Kpew95b1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779924703, "uuid": "ab04e9ef-68ce-4a04-b3a4-b3d4b3b543bc", "value": 54708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779924703, "uuid": "d052aae7-a7fb-4c15-96cf-6459e66d38b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779924703, "uuid": "a5e3b37a-85ee-4b09-b565-b88555aa5449", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }